Changeset 7042

Timestamp:

05/09/2013 01:20:07 PM (11 years ago)

Author:

boonebgorges

Message:

Improved sanitization in Blogs component database methods

• All integer array params are sanitized with wp_parse_id_list()
• Standardized treatment for LIKE clauses

Fixes #4994

Props DJPaul, johnjamesjacoby

Location:

trunk

Files:

• bp-blogs/bp-blogs-classes.php (modified) (5 diffs)
• tests/testcases/blogs (added)
• tests/testcases/blogs/class-bp-blogs-blog.php (added)

trunk/bp-blogs/bp-blogs-classes.php

@@ -110 +110 @@
 
         if ( !empty( $search_terms ) ) {
-            $filter = like_escape( $wpdb->escape( $search_terms ) );
+            $filter = esc_sql( like_escape( $search_terms ) );
             $paged_blogs = $wpdb->get_results( "SELECT b.blog_id, b.user_id as admin_user_id, u.user_email as admin_user_email, wb.domain, wb.path, bm.meta_value as last_activity, bm2.meta_value as name FROM {$bp->blogs->table_name} b, {$bp->blogs->table_name_blogmeta} bm, {$bp->blogs->table_name_blogmeta} bm2, {$wpdb->base_prefix}blogs wb, {$wpdb->users} u WHERE b.blog_id = wb.blog_id AND b.user_id = u.ID AND b.blog_id = bm.blog_id AND b.blog_id = bm2.blog_id AND wb.archived = '0' AND wb.spam = 0 AND wb.mature = 0 AND wb.deleted = 0 {$hidden_sql} AND bm.meta_key = 'last_activity' AND bm2.meta_key = 'name' AND bm2.meta_value LIKE '%%$filter%%' {$user_sql} GROUP BY b.blog_id {$order_sql} {$pag_sql}" );
             $total_blogs = $wpdb->get_var( "SELECT COUNT(DISTINCT b.blog_id) FROM {$bp->blogs->table_name} b, {$wpdb->base_prefix}blogs wb, {$bp->blogs->table_name_blogmeta} bm, {$bp->blogs->table_name_blogmeta} bm2 WHERE b.blog_id = wb.blog_id AND bm.blog_id = b.blog_id AND bm2.blog_id = b.blog_id AND wb.archived = '0' AND wb.spam = 0 AND wb.mature = 0 AND wb.deleted = 0 {$hidden_sql} AND bm.meta_key = 'name' AND bm2.meta_key = 'description' AND ( bm.meta_value LIKE '%%$filter%%' || bm2.meta_value LIKE '%%$filter%%' ) {$user_sql}" );
@@ -120 +120 @@
         $blog_ids = array();
         foreach ( (array) $paged_blogs as $blog ) {
-            $blog_ids[] = $blog->blog_id;
-        }
-
-        $blog_ids = $wpdb->escape( join( ',', (array) $blog_ids ) );
+            $blog_ids[] = (int) $blog->blog_id;
+        }
+
         $paged_blogs = BP_Blogs_Blog::get_blog_extras( $paged_blogs, $blog_ids, $type );
 
@@ -212 +211 @@
         global $wpdb, $bp;
 
-        $filter = like_escape( $wpdb->escape( $filter ) );
-
+        $filter = esc_sql( like_escape( $filter ) );
+
+        $hidden_sql = '';
         if ( !bp_current_user_can( 'bp_moderate' ) )
             $hidden_sql = "AND wb.public = 1";
@@ -242 +242 @@
         global $bp, $wpdb;
 
-        $letter = like_escape( $wpdb->escape( $letter ) );
-
+        $letter = esc_sql( like_escape( $letter ) );
+
+        $hidden_sql = '';
         if ( !bp_current_user_can( 'bp_moderate' ) )
             $hidden_sql = "AND wb.public = 1";
@@ -261 +262 @@
         if ( empty( $blog_ids ) )
             return $paged_blogs;
+
+        $blog_ids = implode( ',', wp_parse_id_list( $blog_ids ) );
 
         for ( $i = 0, $count = count( $paged_blogs ); $i < $count; ++$i ) {