Changeset 7049

Timestamp:

05/09/2013 02:13:14 PM (11 years ago)

Author:

boonebgorges

Message:

Improved sanitization in Activity component database methods

• All integer array parms are filtered through wp_parse_id_list()
• Standardized LIKE clause processing

Fixes #4995 for the 1.7 branch

Props DJPaul, johnjamesjacoby

File:

• branches/1.7/bp-activity/bp-activity-classes.php (modified) (5 diffs)

branches/1.7/bp-activity/bp-activity-classes.php

@@ -171 +171 @@
         if ( $search_terms ) {
             $search_terms = $wpdb->escape( $search_terms );
-            $where_conditions['search_sql'] = "a.content LIKE '%%" . like_escape( $search_terms ) . "%%'";
+            $where_conditions['search_sql'] = "a.content LIKE '%%" . esc_sql( like_escape( $search_terms ) ) . "%%'";
         }
 
@@ -239 +239 @@
 
         // Get the fullnames of users so we don't have to query in the loop
-        $activity_user_ids = array();
-        if ( bp_is_active( 'xprofile' ) && $activities ) {
-            foreach ( (array) $activities as $activity ) {
-                if ( (int) $activity->user_id )
-                    $activity_user_ids[] = $activity->user_id;
-            }
-
-            $activity_user_ids = implode( ',', array_unique( (array) $activity_user_ids ) );
-            if ( !empty( $activity_user_ids ) ) {
+        if ( bp_is_active( 'xprofile' ) && !empty( $activities ) ) {
+            $activity_user_ids = wp_list_pluck( $activities, 'user_id' );
+            $activity_user_ids = implode( ',', wp_parse_id_list( $activity_user_ids ) );
+
+            if ( !empty( $activity_user_ids ) ) {               
                 if ( $names = $wpdb->get_results( "SELECT user_id, value AS user_fullname FROM {$bp->profile->table_name_data} WHERE field_id = 1 AND user_id IN ({$activity_user_ids})" ) ) {
                     foreach ( (array) $names as $name )
@@ -320 +316 @@
 
         if ( !empty( $item_id ) )
-            $where_args[] = $wpdb->prepare( "item_id = %s", $item_id );
+            $where_args[] = $wpdb->prepare( "item_id = %d", $item_id );
 
         if ( !empty( $secondary_item_id ) )
-            $where_args[] = $wpdb->prepare( "secondary_item_id = %s", $secondary_item_id );
+            $where_args[] = $wpdb->prepare( "secondary_item_id = %d", $secondary_item_id );
 
         if ( !empty( $action ) )
@@ -385 +381 @@
 
         if ( !empty( $item_id ) )
-            $where_args[] = $wpdb->prepare( "item_id = %s", $item_id );
+            $where_args[] = $wpdb->prepare( "item_id = %d", $item_id );
 
         if ( !empty( $secondary_item_id ) )
-            $where_args[] = $wpdb->prepare( "secondary_item_id = %s", $secondary_item_id );
+            $where_args[] = $wpdb->prepare( "secondary_item_id = %d", $secondary_item_id );
 
         if ( !empty( $date_recorded ) )
@@ -417 +413 @@
     }
 
-    function delete_activity_item_comments( $activity_ids ) {
+    function delete_activity_item_comments( $activity_ids = array() ) {
         global $bp, $wpdb;
 
-        if ( is_array( $activity_ids ) )
-            $activity_ids = implode ( ',', array_map( 'absint', $activity_ids ) );
-        else
-            $activity_ids = implode ( ',', array_map( 'absint', explode ( ',', $activity_ids ) ) );
+        $activity_ids = implode( ',', wp_parse_id_list( $activity_ids ) );
 
         return $wpdb->query( "DELETE FROM {$bp->activity->table_name} WHERE type = 'activity_comment' AND item_id IN ({$activity_ids})" );
     }
 
-    function delete_activity_meta_entries( $activity_ids ) {
+    function delete_activity_meta_entries( $activity_ids = array() ) {
         global $bp, $wpdb;
 
-        if ( is_array( $activity_ids ) )
-            $activity_ids = implode ( ',', array_map( 'absint', $activity_ids ) );
-        else
-            $activity_ids = implode ( ',', array_map( 'absint', explode ( ',', $activity_ids ) ) );
+        $activity_ids = implode( ',', wp_parse_id_list( $activity_ids ) );
 
         return $wpdb->query( "DELETE FROM {$bp->activity->table_name_meta} WHERE activity_id IN ({$activity_ids})" );