Changeset 7026

Timestamp:

05/08/2013 08:59:47 PM (11 years ago)

Author:

boonebgorges

Message:

Improved sanitization for Friends component database methods

• All integer lists for IN clauses are run through wp_parse_id_list()
• Search terms now escaped in the correct order

Also adds unit tests for touched methods

Fixes #4993

Props johnjamesjacoby

Location:

trunk

Files:

• bp-friends/bp-friends-classes.php (modified) (6 diffs)
• tests/testcases/friends (added)
• tests/testcases/friends/class-bp-friends-friendship.php (added)

trunk/bp-friends/bp-friends-classes.php

@@ -145 +145 @@
             $user_id = bp_loggedin_user_id();
 
-        $filter = like_escape( $wpdb->escape( $filter ) );
+        $filter = esc_sql( like_escape( $filter ) );
 
         if ( !empty( $limit ) && !empty( $page ) )
@@ -154 +154 @@
 
         // Get all the user ids for the current user's friends.
-        $fids = implode( ',', $friend_ids );
+        $fids = implode( ',', wp_parse_id_list( $friend_ids ) );
 
         if ( empty( $fids ) )
@@ -199 +199 @@
         global $wpdb;
 
+        $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
+
         return $wpdb->get_results( $wpdb->prepare( "SELECT meta_value as last_activity, user_id FROM {$wpdb->usermeta} WHERE meta_key = %s AND user_id IN ( {$user_ids} ) ORDER BY meta_value DESC", bp_get_user_meta_key( 'last_activity' ) ) );
     }
@@ -223 +225 @@
         global $wpdb, $bp;
 
-        $filter = like_escape( $wpdb->escape( $filter ) );
+        $filter = esc_sql( like_escape( $filter ) );
 
         $usermeta_table = $wpdb->base_prefix . 'usermeta';
@@ -249 +251 @@
         global $wpdb, $bp;
 
-        $filter = like_escape( $wpdb->escape( $filter ) );
+        $filter = esc_sql( like_escape( $filter ) );
 
         $usermeta_table = $wpdb->prefix . 'usermeta';
@@ -274 +276 @@
         if ( !bp_is_active( 'xprofile' ) )
             return false;
+
+        $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
 
         return $wpdb->get_results( $wpdb->prepare( "SELECT user_id FROM {$bp->profile->table_name_data} pd, {$bp->profile->table_name_fields} pf WHERE pf.id = pd.field_id AND pf.name = %s AND pd.user_id IN ( {$user_ids} ) ORDER BY pd.value ASC", bp_xprofile_fullname_field_name() ) );