Changeset 7025 for branches/1.7/bp-core/bp-core-functions.php

Timestamp:

05/08/2013 08:31:14 PM (12 years ago)

Author:

boonebgorges

Message:

Improved sanitization in the Core component database methods

All constructed IN clauses for integer values are now run through
wp_parse_id_list().

Fixes #4992 for the 1.7 branch

Props johnjamesjacoby, DJPaul

File:

• branches/1.7/bp-core/bp-core-functions.php (modified) (1 diff)

branches/1.7/bp-core/bp-core-functions.php

@@ -142 +142 @@
         // from the current blog
         $posts_table_name = bp_is_multiblog_mode() ? $wpdb->posts : $wpdb->get_blog_prefix( bp_get_root_blog_id() ) . 'posts';
-        $page_ids_sql     = implode( ',', (array) $page_ids );
+        $page_ids_sql     = implode( ',', wp_parse_id_list( $page_ids ) );
         $page_names       = $wpdb->get_results( "SELECT ID, post_name, post_parent, post_title FROM {$posts_table_name} WHERE ID IN ({$page_ids_sql}) AND post_status = 'publish' " );