Changeset 13147 for trunk/src/bp-notifications/classes/class-bp-notifications-notification.php

Timestamp:

11/13/2021 06:40:37 PM (3 years ago)

Author:

espellcaste

Message:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

File:

• trunk/src/bp-notifications/classes/class-bp-notifications-notification.php (modified) (1 diff)

trunk/src/bp-notifications/classes/class-bp-notifications-notification.php

@@ -447 +447 @@
 
         // Sort order direction.
-        if ( ! empty( $args['sort_order'] ) && in_array( $args['sort_order'], array( 'ASC', 'DESC' ), true ) ) {
-            $sort_order               = $args['sort_order'];
+        if ( ! empty( $args['sort_order'] ) ) {
+            $sort_order               = bp_esc_sql_order( $args['sort_order'] );
             $conditions['sort_order'] = "{$sort_order}";
         }