Changeset 7025

Timestamp:

05/08/2013 08:31:14 PM (12 years ago)

Author:

boonebgorges

Message:

Improved sanitization in the Core component database methods

All constructed IN clauses for integer values are now run through
wp_parse_id_list().

Fixes #4992 for the 1.7 branch

Props johnjamesjacoby, DJPaul

Location:

branches/1.7/bp-core

Files:

• bp-core-cache.php (modified) (1 diff)
• bp-core-classes.php (modified) (9 diffs)
• bp-core-filters.php (modified) (1 diff)
• bp-core-functions.php (modified) (1 diff)

branches/1.7/bp-core/bp-core-cache.php

@@ -93 +93 @@
     }
 
-    if ( !is_array( $object_ids ) ) {
-        $object_ids = preg_replace( '|[^0-9,]|', '', $object_ids );
-        $object_ids = explode( ',', $object_ids );
-    }
-
-    $object_ids = array_map( 'intval', $object_ids );
+    $object_ids = wp_parse_id_list( $object_ids );
 
     $cache = array();

branches/1.7/bp-core/bp-core-classes.php

@@ -302 +302 @@
         if ( empty( $include ) && ! empty( $user_id ) && bp_is_active( 'friends' ) ) {
             $friend_ids = friends_get_friend_user_ids( $user_id );
-            $friend_ids = $wpdb->escape( implode( ',', (array) $friend_ids ) );
+            $friend_ids = implode( ',', wp_parse_id_list( $friend_ids ) );
 
             if ( ! empty( $friend_ids ) ) {
@@ -804 +804 @@
 
         if ( !empty( $exclude ) ) {
+            $exclude              = implode( ',', wp_parse_id_list( $exclude ) );
             $sql['where_exclude'] = "AND u.ID NOT IN ({$exclude})";
         }
@@ -813 +814 @@
         } else {
             if ( !empty( $include ) ) {
-                if ( is_array( $include ) ) {
-                    $uids = $wpdb->escape( implode( ',', (array) $include ) );
-                } else {
-                    $uids = $wpdb->escape( $include );
-                }
-
-                if ( !empty( $uids ) ) {
-                    $sql['where_users'] = "AND u.ID IN ({$uids})";
-                }
+                $include = implode( ',',  wp_parse_id_list( $include ) );
+                $sql['where_users'] = "AND u.ID IN ({$include})";
             } elseif ( !empty( $user_id ) && bp_is_active( 'friends' ) ) {
                 $friend_ids = friends_get_friend_user_ids( $user_id );
-                $friend_ids = $wpdb->escape( implode( ',', (array) $friend_ids ) );
 
                 if ( !empty( $friend_ids ) ) {
+                    $friend_ids = implode( ',', wp_parse_id_list( $friend_ids ) );
                     $sql['where_friends'] = "AND u.ID IN ({$friend_ids})";
 
@@ -912 +906 @@
             }
 
-            $user_ids = $wpdb->escape( join( ',', (array) $user_ids ) );
-
             // Add additional data to the returned results
             $paged_users = BP_Core_User::get_user_extras( $paged_users, $user_ids, $type );
@@ -958 +950 @@
 
         if ( !empty( $exclude ) ) {
-            $exclude     = wp_parse_id_list( $r['exclude'] );
-            $exclude     = $wpdb->escape( implode( ',', $exclude ) );
+            $exclude     = implode( ',', wp_parse_id_list( $r['exclude'] ) );
             $exclude_sql = " AND u.id NOT IN ({$exclude})";
         } else {
@@ -980 +971 @@
         $user_ids = array();
         foreach ( (array) $paged_users as $user )
-            $user_ids[] = $user->id;
-
-        $user_ids = $wpdb->escape( join( ',', (array) $user_ids ) );
+            $user_ids[] = (int) $user->id;
 
         // Add additional data to the returned results
@@ -1010 +999 @@
             $pag_sql = $wpdb->prepare( " LIMIT %d, %d", intval( ( $page - 1 ) * $limit), intval( $limit ) );
 
+        $user_ids   = implode( ',', wp_parse_id_list( $user_ids ) );
         $status_sql = bp_core_get_status_sql();
 
-        $total_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT COUNT(DISTINCT ID) FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ( " . $wpdb->escape( $user_ids ) . " ) " );
-        $paged_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT DISTINCT ID as id, user_registered, user_nicename, user_login, user_email FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ( " . $wpdb->escape( $user_ids ) . " ) {$pag_sql}" );
+        $total_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT COUNT(DISTINCT ID) FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ({$user_ids})" );
+        $paged_users_sql = apply_filters( 'bp_core_get_specific_users_count_sql', "SELECT DISTINCT ID as id, user_registered, user_nicename, user_login, user_email FROM {$wpdb->users} WHERE {$status_sql} AND ID IN ({$user_ids}) {$pag_sql}" );
 
         $total_users = $wpdb->get_var( $total_users_sql );
@@ -1068 +1058 @@
             $user_ids[] = $user->id;
 
-        $user_ids = $wpdb->escape( join( ',', (array) $user_ids ) );
-
         // Add additional data to the returned results
         if ( $populate_extras )
@@ -1095 +1083 @@
         if ( empty( $user_ids ) )
             return $paged_users;
+
+        // Sanitize user IDs
+        $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
 
         // Fetch the user's full name

branches/1.7/bp-core/bp-core-filters.php

@@ -131 +131 @@
         return $comments;
 
-    $user_ids = implode( ',', $user_ids );
+    $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
 
     if ( !$userdata = $wpdb->get_results( "SELECT ID as user_id, user_login, user_nicename FROM {$wpdb->users} WHERE ID IN ({$user_ids})" ) )

branches/1.7/bp-core/bp-core-functions.php

@@ -142 +142 @@
         // from the current blog
         $posts_table_name = bp_is_multiblog_mode() ? $wpdb->posts : $wpdb->get_blog_prefix( bp_get_root_blog_id() ) . 'posts';
-        $page_ids_sql     = implode( ',', (array) $page_ids );
+        $page_ids_sql     = implode( ',', wp_parse_id_list( $page_ids ) );
         $page_names       = $wpdb->get_results( "SELECT ID, post_name, post_parent, post_title FROM {$posts_table_name} WHERE ID IN ({$page_ids_sql}) AND post_status = 'publish' " );