Skip to:
Content

BuddyPress.org

Changeset 13230


Ignore:
Timestamp:
02/05/2022 08:50:18 AM (2 years ago)
Author:
imath
Message:

Bring back custom order to xProfile field options sorting

r13147 introduced a regression about this type of xProfile field options order. To make sure we preserve it, we need to check $this->order_by value before sanitizing it otherwise the potential custom value is sanitized to ASC and the SQL sort part is never set to use the option_order db field.

Props oztaser, espellcaste, niftythree

See #8623 (branch 10.0)

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/10.0/src/bp-xprofile/classes/class-bp-xprofile-field.php

    r13147 r13230  
    571571        global $wpdb;
    572572
    573         // Sanitize 'order_by'.
    574         $order_by = bp_esc_sql_order( $this->order_by );
    575 
    576573        // This is done here so we don't have problems with sql injection.
    577         if ( empty( $for_editing ) ) {
    578             $sort_sql = "ORDER BY name {$order_by}";
     574        if ( empty( $for_editing ) && in_array( $this->order_by, array( 'asc', 'desc' ), true ) ) {
     575            $sort_sql = sprintf( 'ORDER BY name %s', bp_esc_sql_order( $this->order_by ) );
    579576        } else {
    580577            $sort_sql = 'ORDER BY option_order ASC';
     
    599596         * @since 3.0.0 Added the `$this` parameter.
    600597         *
    601          * @param array             $children    Found children for a field.
    602          * @param bool              $for_editing Whether or not the field is for editing.
    603          * @param BP_XProfile_Field $this        Field object
     598         * @param array             $children     Found children for a field.
     599         * @param bool              $for_editing  Whether or not the field is for editing.
     600         * @param BP_XProfile_Field $field_object BP_XProfile_Field Field object.
    604601         */
    605602        return apply_filters( 'bp_xprofile_field_get_children', $children, $for_editing, $this );
Note: See TracChangeset for help on using the changeset viewer.