Changeset 7014 for branches/1.7/bp-core/bp-core-classes.php

Timestamp:

05/07/2013 11:42:23 PM (11 years ago)

Author:

boonebgorges

Message:

Audit of parameter sanitization in Groups and Core database classes

• Uses wp_parse_id_list() to sanitize parameters of integer arrays
• Implements a more consistent approach to LIKE clause sanitization

See #4989

Props johnjamesjacoby

File:

• branches/1.7/bp-core/bp-core-classes.php (modified) (3 diffs)

branches/1.7/bp-core/bp-core-classes.php

@@ -837 +837 @@
 
         if ( !empty( $search_terms ) && bp_is_active( 'xprofile' ) ) {
-            $search_terms             = like_escape( $wpdb->escape( $search_terms ) );
+            $search_terms             = esc_sql( like_escape( trim( $search_terms ) ) );
             $sql['where_searchterms'] = "AND spd.value LIKE '%%$search_terms%%'";
         }
@@ -954 +954 @@
         }
 
-        $letter     = like_escape( $wpdb->escape( $letter ) );
+        $letter     = esc_sql( like_escape( trim( $letter ) ) );
         $status_sql = bp_core_get_status_sql( 'u.' );
 
-        $exclude_sql = ( !empty( $exclude ) ) ? " AND u.ID NOT IN ({$exclude})" : "";
+        if ( !empty( $exclude ) ) {
+            $exclude     = wp_parse_id_list( $r['exclude'] );
+            $exclude     = $wpdb->escape( implode( ',', $exclude ) );
+            $exclude_sql = " AND u.id NOT IN ({$exclude})";
+        } else {
+            $exclude_sql = '';
+        }
 
         $total_users_sql = apply_filters( 'bp_core_users_by_letter_count_sql', $wpdb->prepare( "SELECT COUNT(DISTINCT u.ID) FROM {$wpdb->users} u LEFT JOIN {$bp->profile->table_name_data} pd ON u.ID = pd.user_id LEFT JOIN {$bp->profile->table_name_fields} pf ON pd.field_id = pf.id WHERE {$status_sql} AND pf.name = %s {$exclude_sql} AND pd.value LIKE '{$letter}%%'  ORDER BY pd.value ASC", bp_xprofile_fullname_field_name() ) );
@@ -1046 +1052 @@
         $pag_sql  = $limit && $page ? $wpdb->prepare( " LIMIT %d, %d", intval( ( $page - 1 ) * intval( $limit ) ), intval( $limit ) ) : '';
 
-        $search_terms = like_escape( $wpdb->escape( $search_terms ) );
+        $search_terms = esc_sql( like_escape( trim( $search_terms ) ) );
         $status_sql   = bp_core_get_status_sql( 'u.' );