Changeset 13147 for trunk/src/bp-messages/bp-messages-template.php

Timestamp:

11/13/2021 06:40:37 PM (3 years ago)

Author:

espellcaste

Message:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

File:

• trunk/src/bp-messages/bp-messages-template.php (modified) (1 diff)

trunk/src/bp-messages/bp-messages-template.php

@@ -1635 +1635 @@
  * @param array|string $args {
  *     Array of arguments. All are optional.
- *     @type int      $thread_id         ID of the thread whose messages you are displaying.
+ *     @type int      $thread_id         Optional. ID of the thread whose messages you are displaying.
  *                                       Default: if viewing a thread, the thread ID will be parsed from
  *                                       the URL (bp_action_variable( 0 )).
- *     @type string   $order             'ASC' or 'DESC'. Default: 'ASC'.
- *     @type bool     $update_meta_cache Whether to pre-fetch metadata for
+ *     @type string   $order             Optional. 'ASC' or 'DESC'. Default: 'ASC'.
+ *     @type bool     $update_meta_cache Optional. Whether to pre-fetch metadata for
  *                                       queried message items. Default: true.
  *     @type int|null $page              Page of messages being requested. Default to null, meaning all.