Changeset 13147 for trunk/src/bp-notifications/bp-notifications-template.php

Timestamp:

11/13/2021 06:40:37 PM (3 years ago)

Author:

espellcaste

Message:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

File:

• trunk/src/bp-notifications/bp-notifications-template.php (modified) (1 diff)

trunk/src/bp-notifications/bp-notifications-template.php

@@ -998 +998 @@
 
     // Check for a custom sort_order.
-    if ( !empty( $_REQUEST['sort_order'] ) ) {
-        if ( in_array( $_REQUEST['sort_order'], $orders ) ) {
+    if ( ! empty( $_REQUEST['sort_order'] ) ) {
+        if ( in_array( $_REQUEST['sort_order'], $orders, true ) ) {
             $selected = $_REQUEST['sort_order'];
         }