Changeset 7024 for trunk/bp-core/bp-core-filters.php

Timestamp:

05/08/2013 08:27:22 PM (12 years ago)

Author:

boonebgorges

Message:

Improved sanitization for Core component database methods

All constructed IN clauses for integer values are now run through
wp_parse_id_list().

Also adds tests for the relevant methods.

Fixes #4992

Props johnjamesjacoby, DJPaul

File:

• trunk/bp-core/bp-core-filters.php (modified) (1 diff)

trunk/bp-core/bp-core-filters.php

@@ -131 +131 @@
         return $comments;
 
-    $user_ids = implode( ',', $user_ids );
+    $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
 
     if ( !$userdata = $wpdb->get_results( "SELECT ID as user_id, user_login, user_nicename FROM {$wpdb->users} WHERE ID IN ({$user_ids})" ) )