Changeset 7027

Timestamp:

05/08/2013 09:01:04 PM (13 years ago)

Author:

boonebgorges

Message:

Improved sanitization for Friends component database methods

• All integer lists for IN clauses are run through wp_parse_id_list()
• Search terms now escaped in the correct order

Fixes #4993 for the 1.7 branch

Props johnjamesjacoby

File:

• branches/1.7/bp-friends/bp-friends-classes.php (modified) (6 diffs)

branches/1.7/bp-friends/bp-friends-classes.php

@@ -145 +145 @@
                         $user_id = bp_loggedin_user_id();
 
-                $filter = like_escape( $wpdb->escape( $filter ) );
+                $filter = esc_sql( like_escape( $filter ) );
 
                 if ( !empty( $limit ) && !empty( $page ) )
@@ -154 +154 @@
 
                 // Get all the user ids for the current user's friends.
-                $fids = implode( ',', $friend_ids );
+                $fids = implode( ',', wp_parse_id_list( $friend_ids ) );
 
                 if ( empty( $fids ) )
@@ -199 +199 @@
                 global $wpdb;
 
+                $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
+
                 return $wpdb->get_results( $wpdb->prepare( "SELECT meta_value as last_activity, user_id FROM {$wpdb->usermeta} WHERE meta_key = %s AND user_id IN ( {$user_ids} ) ORDER BY meta_value DESC", bp_get_user_meta_key( 'last_activity' ) ) );
         }
@@ -223 +225 @@
                 global $wpdb, $bp;
 
-                $filter = like_escape( $wpdb->escape( $filter ) );
+                $filter = esc_sql( like_escape( $filter ) );
 
                 $usermeta_table = $wpdb->base_prefix . 'usermeta';
@@ -249 +251 @@
                 global $wpdb, $bp;
 
-                $filter = like_escape( $wpdb->escape( $filter ) );
+                $filter = esc_sql( like_escape( $filter ) );
 
                 $usermeta_table = $wpdb->prefix . 'usermeta';
@@ -274 +276 @@
                 if ( !bp_is_active( 'xprofile' ) )
                         return false;
+
+                $user_ids = implode( ',', wp_parse_id_list( $user_ids ) );
 
                 return $wpdb->get_results( $wpdb->prepare( "SELECT user_id FROM {$bp->profile->table_name_data} pd, {$bp->profile->table_name_fields} pf WHERE pf.id = pd.field_id AND pf.name = %s AND pd.user_id IN ( {$user_ids} ) ORDER BY pd.value ASC", bp_xprofile_fullname_field_name() ) );