Changeset 4619

Timestamp:

07/06/2011 11:36:11 AM (15 years ago)

Author:

johnjamesjacoby

Message:

Cast activity ID's as absints. Props Harry & Glyn. (trunk)

File:

• trunk/bp-activity/bp-activity-classes.php (modified) (3 diffs)

trunk/bp-activity/bp-activity-classes.php

@@ -129 +129 @@
                 // The specific ids to which you want to limit the query
                 if ( !empty( $in ) ) {
-                        if ( is_array( $in ) )
-                                $in = implode( ',', $in );
+                        if ( is_array( $in ) ) {
+                                $in = implode ( ',', array_map( 'absint', $in ) );
+                        } else {
+                                $in = implode ( ',', array_map( 'absint', explode ( ',', $in ) ) );
+                        }
+
                         $where_conditions['in'] = "a.id IN ({$in})";
                 }
@@ -324 +328 @@
                 global $bp, $wpdb;
 
-                if ( is_array($activity_ids) )
-                        $activity_ids = implode( ',', $activity_ids );
-
-                $activity_ids = $wpdb->escape( $activity_ids );
+                if ( is_array( $activity_ids ) )
+                        $activity_ids = implode ( ',', array_map( 'absint', $activity_ids ) );
+                else
+                        $activity_ids = implode ( ',', array_map( 'absint', explode ( ',', $activity_ids ) ) );
 
                 return $wpdb->query( $wpdb->prepare( "DELETE FROM {$bp->activity->table_name} WHERE type = 'activity_comment' AND item_id IN ({$activity_ids})" ) );
@@ -335 +339 @@
                 global $bp, $wpdb;
 
-                if ( is_array($activity_ids) )
-                        $activity_ids = implode( ',', $activity_ids );
-
-                $activity_ids = $wpdb->escape( $activity_ids );
+                if ( is_array( $activity_ids ) )
+                        $activity_ids = implode ( ',', array_map( 'absint', $activity_ids ) );
+                else
+                        $activity_ids = implode ( ',', array_map( 'absint', explode ( ',', $activity_ids ) ) );
 
                 return $wpdb->query( $wpdb->prepare( "DELETE FROM {$bp->activity->table_name_meta} WHERE activity_id IN ({$activity_ids})" ) );