Changeset 7024 for trunk/bp-core/bp-core-classes.php

Timestamp:

05/08/2013 08:27:22 PM (12 years ago)

Author:

boonebgorges

Message:

Improved sanitization for Core component database methods

All constructed IN clauses for integer values are now run through
wp_parse_id_list().

Also adds tests for the relevant methods.

Fixes #4992

Props johnjamesjacoby, DJPaul

File:

• trunk/bp-core/bp-core-classes.php (modified) (9 diffs)

trunk/bp-core/bp-core-classes.php

@@ -300 +300 @@
         if ( ! empty( $user_id ) && bp_is_active( 'friends' ) ) {
             $friend_ids = friends_get_friend_user_ids( $user_id );
-            $friend_ids = $wpdb->escape( implode( ',', (array) $friend_ids ) );
+            $friend_ids = implode( ',', wp_parse_id_list( $friend_ids ) );
 
             if ( ! empty( $friend_ids ) ) {
@@ -806 +806 @@
 
         if ( !empty( $exclude ) ) {
+            $exclude              = implode( ',', wp_parse_id_list( $exclude ) );
             $sql['where_exclude'] = "AND u.ID NOT IN ({$exclude})";
         }
@@ -815 +816 @@
         } else {
             if ( !empty( $include ) ) {
-                if ( is_array( $include ) ) {
-                    $uids = $wpdb->escape( implode( ',', (array) $include ) );
-                } else {
-                    $uids = $wpdb->escape( $include );
-                }
-
-                if ( !empty( $uids ) ) {
-                    $sql['where_users'] = "AND u.ID IN ({$uids})";
-                }
+                $include = implode( ',',  wp_parse_id_list( $include ) );
+                $sql['where_users'] = "AND u.ID IN ({$include})";
             } elseif ( !empty( $user_id ) && bp_is_active( 'friends' ) ) {
                 $friend_ids = friends_get_friend_user_ids( $user_id );
-                $friend_ids = $wpdb->escape( implode( ',', (array) $friend_ids ) );
 
                 if ( !empty( $friend_ids ) ) {
+                    $friend_ids = implode( ',', wp_parse_id_list( $friend_ids ) );
                     $sql['where_friends'] = "AND u.ID IN ({$friend_ids})";
 
@@ -914 +908 @@
             }
 
-            $user_ids = $wpdb->escape( join( ',', (array) $user_ids ) );
-
             // Add additional data to the returned results
             $paged_users = BP_Core_User::get_user_extras( $paged_users, $user_ids, $type );
@@ -960 +952 @@
 
         if ( !empty( $exclude ) ) {
-            $exclude     = wp_parse_id_list( $r['exclude'] );
-            $exclude     = $wpdb->escape( implode( ',', $exclude ) );
+            $exclude     = implode( ',', wp_parse_id_list( $r['exclude'] ) );
             $exclude_sql = " AND u.id NOT IN ({$exclude})";
         } else {
@@ -982 +973 @@
         $user_ids = array();
         foreach ( (array) $paged_users as $user )
-            $user_ids[] = $user->id;
-
-        $user_ids = $wpdb->escape( join( ',', (array) $user_ids ) );
+            $user_ids[] = (int) $user->id;
 
         // Add additional data to the returned results
@@ -1012 +1001 @@
             $pag_sql = $wpdb->prepare( " LIMIT %d, %d", intval( ( $page - 1 ) * $limit), intval( $limit ) );
 
+        $user_ids   = implode( ',', wp_parse_id_list( $user_ids ) );
         $status_sql = bp_core_get_status_sql();
 
-        $total_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT COUNT(DISTINCT ID) FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ( " . $wpdb->escape( $user_ids ) . " ) " );
-        $paged_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT DISTINCT ID as id, user_registered, user_nicename, user_login, user_email FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ( " . $wpdb->escape( $user_ids ) . " ) {$pag_sql}" );
+        $total_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT COUNT(DISTINCT ID) FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ({$user_ids})" );
+        $paged_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT DISTINCT ID as id, user_registered, user_nicename, user_login, user_email FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ({$user_ids}) {$pag_sql}" );
 
         $total_users = $wpdb->get_var( $total_users_sql );
@@ -1070 +1060 @@
             $user_ids[] = $user->id;
 
-        $user_ids = $wpdb->escape( join( ',', (array) $user_ids ) );
-
         // Add additional data to the returned results
         if ( $populate_extras )
@@ -1097 +1085 @@
         if ( empty( $user_ids ) )
             return $paged_users;
+
+        // Sanitize user IDs
+        $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
 
         // Fetch the user's full name