Changeset 13147 for trunk/src/bp-messages/classes/class-bp-messages-thread.php

Timestamp:

11/13/2021 06:40:37 PM (3 years ago)

Author:

espellcaste

Message:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

File:

• trunk/src/bp-messages/classes/class-bp-messages-thread.php (modified) (6 diffs)

trunk/src/bp-messages/classes/class-bp-messages-thread.php

@@ -122 +122 @@
      *     @type int|null    $page                Page of messages being requested. Default to null, meaning all.
      *     @type int|null    $per_page            Messages to return per page. Default to null, meaning all.
-     *     @type string      $order               The order to sort the messages. Either 'ASC' or 'DESC'.
+     *     @type string      $order               Optional. The order to sort the messages. Either 'ASC' or 'DESC'.
      *                                            Defaults to 'ASC'.
      *     @type int|null    $recipients_page     Page of recipients being requested. Default to null, meaning all.
@@ -161 +161 @@
     public function populate( $thread_id = 0, $order = 'ASC', $args = array() ) {
 
-        if ( ! in_array( strtoupper( $order ), array( 'ASC', 'DESC' ), true ) ) {
-            $order = 'ASC';
-        }
-
         $user_id =
             bp_displayed_user_id() ?
@@ -178 +174 @@
                 'page'                => null,
                 'per_page'            => null,
-                'order'               => $order,
+                'order'               => bp_esc_sql_order( $order ),
                 'recipients_page'     => null,
                 'recipients_per_page' => null,
@@ -184 +180 @@
         );
 
-        $this->messages_order = $order;
+        $this->messages_order = $r['order'];
         $this->thread_id      = (int) $thread_id;
 
@@ -374 +370 @@
         );
 
-        // Fallback.
-        if ( ! in_array( strtoupper( $r['order'] ), array( 'ASC', 'DESC' ), true ) ) {
-            $r['order'] = 'ASC';
-        }
+        // Sanitize 'order'.
+        $r['order'] = bp_esc_sql_order( $r['order'] );
 
         // Get messages from cache if available.
@@ -404 +398 @@
 
         // Flip if order is DESC.
-        if ( 'DESC' === strtoupper( $r['order'] ) ) {
+        if ( 'DESC' === $r['order'] ) {
             $messages = array_reverse( $messages );
         }