Changeset 13147 for trunk/src/bp-xprofile/classes/class-bp-xprofile-field.php

Timestamp:

11/13/2021 06:40:37 PM (3 years ago)

Author:

espellcaste

Message:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

File:

• trunk/src/bp-xprofile/classes/class-bp-xprofile-field.php (modified) (4 diffs)

trunk/src/bp-xprofile/classes/class-bp-xprofile-field.php

@@ -562 +562 @@
      * @since 1.2.0
      *
-     * @global object $wpdb
-     *
-     * @param bool $for_editing Whether or not the field is for editing.
+     * @global BuddyPress $bp The one true BuddyPress instance.
+     * @global wpdb $wpdb WordPress database object.
+     *
+     * @param bool $for_editing Whether or not the field is for editing. Default to false.
      * @return array
      */
@@ -570 +571 @@
         global $wpdb;
 
+        // Sanitize 'order_by'.
+        $order_by = bp_esc_sql_order( $this->order_by );
+
         // This is done here so we don't have problems with sql injection.
-        if ( empty( $for_editing ) && ( 'asc' === $this->order_by ) ) {
-            $sort_sql = 'ORDER BY name ASC';
-        } elseif ( empty( $for_editing ) && ( 'desc' === $this->order_by ) ) {
-            $sort_sql = 'ORDER BY name DESC';
+        if ( empty( $for_editing ) ) {
+            $sort_sql = "ORDER BY name {$order_by}";
         } else {
             $sort_sql = 'ORDER BY option_order ASC';
@@ -587 +589 @@
         }
 
-        $bp  = buddypress();
-        $sql = $wpdb->prepare( "SELECT * FROM {$bp->profile->table_name_fields} WHERE parent_id = %d AND group_id = %d {$sort_sql}", $parent_id, $this->group_id );
-
+        $bp       = buddypress();
+        $sql      = $wpdb->prepare( "SELECT * FROM {$bp->profile->table_name_fields} WHERE parent_id = %d AND group_id = %d {$sort_sql}", $parent_id, $this->group_id );
         $children = $wpdb->get_results( $sql );
 
@@ -598 +599 @@
          * @since 3.0.0 Added the `$this` parameter.
          *
-         * @param object            $children    Found children for a field.
+         * @param array             $children    Found children for a field.
          * @param bool              $for_editing Whether or not the field is for editing.
          * @param BP_XProfile_Field $this        Field object