Changeset 7025 for branches/1.7/bp-core/bp-core-filters.php

Timestamp:

05/08/2013 08:31:14 PM (12 years ago)

Author:

boonebgorges

Message:

Improved sanitization in the Core component database methods

All constructed IN clauses for integer values are now run through
wp_parse_id_list().

Fixes #4992 for the 1.7 branch

Props johnjamesjacoby, DJPaul

File:

• branches/1.7/bp-core/bp-core-filters.php (modified) (1 diff)

branches/1.7/bp-core/bp-core-filters.php

@@ -131 +131 @@
         return $comments;
 
-    $user_ids = implode( ',', $user_ids );
+    $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
 
     if ( !$userdata = $wpdb->get_results( "SELECT ID as user_id, user_login, user_nicename FROM {$wpdb->users} WHERE ID IN ({$user_ids})" ) )