Changeset 7025

Timestamp:

05/08/2013 08:31:14 PM (13 years ago)

Author:

boonebgorges

Message:

Improved sanitization in the Core component database methods

All constructed IN clauses for integer values are now run through
wp_parse_id_list().

Fixes #4992 for the 1.7 branch

Props johnjamesjacoby, DJPaul

Location:

branches/1.7/bp-core

Files:

• bp-core-cache.php (modified) (1 diff)
• bp-core-classes.php (modified) (9 diffs)
• bp-core-filters.php (modified) (1 diff)
• bp-core-functions.php (modified) (1 diff)

branches/1.7/bp-core/bp-core-cache.php

@@ -93 +93 @@
         }
 
-        if ( !is_array( $object_ids ) ) {
-                $object_ids = preg_replace( '|[^0-9,]|', '', $object_ids );
-                $object_ids = explode( ',', $object_ids );
-        }
-
-        $object_ids = array_map( 'intval', $object_ids );
+        $object_ids = wp_parse_id_list( $object_ids );
 
         $cache = array();

branches/1.7/bp-core/bp-core-classes.php

@@ -302 +302 @@
                 if ( empty( $include ) && ! empty( $user_id ) && bp_is_active( 'friends' ) ) {
                         $friend_ids = friends_get_friend_user_ids( $user_id );
-                        $friend_ids = $wpdb->escape( implode( ',', (array) $friend_ids ) );
+                        $friend_ids = implode( ',', wp_parse_id_list( $friend_ids ) );
 
                         if ( ! empty( $friend_ids ) ) {
@@ -804 +804 @@
 
                 if ( !empty( $exclude ) ) {
+                        $exclude              = implode( ',', wp_parse_id_list( $exclude ) );
                         $sql['where_exclude'] = "AND u.ID NOT IN ({$exclude})";
                 }
@@ -813 +814 @@
                 } else {
                         if ( !empty( $include ) ) {
-                                if ( is_array( $include ) ) {
-                                        $uids = $wpdb->escape( implode( ',', (array) $include ) );
-                                } else {
-                                        $uids = $wpdb->escape( $include );
-                                }
-
-                                if ( !empty( $uids ) ) {
-                                        $sql['where_users'] = "AND u.ID IN ({$uids})";
-                                }
+                                $include = implode( ',',  wp_parse_id_list( $include ) );
+                                $sql['where_users'] = "AND u.ID IN ({$include})";
                         } elseif ( !empty( $user_id ) && bp_is_active( 'friends' ) ) {
                                 $friend_ids = friends_get_friend_user_ids( $user_id );
-                                $friend_ids = $wpdb->escape( implode( ',', (array) $friend_ids ) );
 
                                 if ( !empty( $friend_ids ) ) {
+                                        $friend_ids = implode( ',', wp_parse_id_list( $friend_ids ) );
                                         $sql['where_friends'] = "AND u.ID IN ({$friend_ids})";
 
@@ -912 +906 @@
                         }
 
-                        $user_ids = $wpdb->escape( join( ',', (array) $user_ids ) );
-
                         // Add additional data to the returned results
                         $paged_users = BP_Core_User::get_user_extras( $paged_users, $user_ids, $type );
@@ -958 +950 @@
 
                 if ( !empty( $exclude ) ) {
-                        $exclude     = wp_parse_id_list( $r['exclude'] );
-                        $exclude     = $wpdb->escape( implode( ',', $exclude ) );
+                        $exclude     = implode( ',', wp_parse_id_list( $r['exclude'] ) );
                         $exclude_sql = " AND u.id NOT IN ({$exclude})";
                 } else {
@@ -980 +971 @@
                 $user_ids = array();
                 foreach ( (array) $paged_users as $user )
-                        $user_ids[] = $user->id;
-
-                $user_ids = $wpdb->escape( join( ',', (array) $user_ids ) );
+                        $user_ids[] = (int) $user->id;
 
                 // Add additional data to the returned results
@@ -1010 +999 @@
                         $pag_sql = $wpdb->prepare( " LIMIT %d, %d", intval( ( $page - 1 ) * $limit), intval( $limit ) );
 
+                $user_ids   = implode( ',', wp_parse_id_list( $user_ids ) );
                 $status_sql = bp_core_get_status_sql();
 
-                $total_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT COUNT(DISTINCT ID) FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ( " . $wpdb->escape( $user_ids ) . " ) " );
-                $paged_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT DISTINCT ID as id, user_registered, user_nicename, user_login, user_email FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ( " . $wpdb->escape( $user_ids ) . " ) {$pag_sql}" );
+                $total_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT COUNT(DISTINCT ID) FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ({$user_ids})" );
+                $paged_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT DISTINCT ID as id, user_registered, user_nicename, user_login, user_email FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ({$user_ids}) {$pag_sql}" );
 
                 $total_users = $wpdb->get_var( $total_users_sql );
@@ -1068 +1058 @@
                         $user_ids[] = $user->id;
 
-                $user_ids = $wpdb->escape( join( ',', (array) $user_ids ) );
-
                 // Add additional data to the returned results
                 if ( $populate_extras )
@@ -1095 +1083 @@
                 if ( empty( $user_ids ) )
                         return $paged_users;
+
+                // Sanitize user IDs
+                $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
 
                 // Fetch the user's full name

branches/1.7/bp-core/bp-core-filters.php

@@ -131 +131 @@
                 return $comments;
 
-        $user_ids = implode( ',', $user_ids );
+        $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
 
         if ( !$userdata = $wpdb->get_results( "SELECT ID as user_id, user_login, user_nicename FROM {$wpdb->users} WHERE ID IN ({$user_ids})" ) )

branches/1.7/bp-core/bp-core-functions.php

@@ -142 +142 @@
                 // from the current blog
                 $posts_table_name = bp_is_multiblog_mode() ? $wpdb->posts : $wpdb->get_blog_prefix( bp_get_root_blog_id() ) . 'posts';
-                $page_ids_sql     = implode( ',', (array) $page_ids );
+                $page_ids_sql     = implode( ',', wp_parse_id_list( $page_ids ) );
                 $page_names       = $wpdb->get_results( "SELECT ID, post_name, post_parent, post_title FROM {$posts_table_name} WHERE ID IN ({$page_ids_sql}) AND post_status = 'publish' " );