Skip to:
Content

BuddyPress.org

Opened 5 years ago

Closed 5 years ago

#8576 closed enhancement (fixed)

Sanitize all possible Sort/Order variables

Reported by: espellcaste Owned by: espellcaste
Priority: normal Milestone: 10.0.0
Component: Core Version:
Severity: normal Keywords: has-patch has-unit-tests commit
Cc:

Description

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This ticket changes that by using the bp_esc_sql_order helper function where possible.

Attachments (1)

8576.diff​ (17.4 KB ) - added by espellcaste 5 years ago.

Download all attachments as: .zip

Change History (3)

@espellcaste
5 years ago

#1 @imath
5 years ago

  • Keywords commit added

Looks good! Thanks for your work on it 👏

#2 @espellcaste
5 years ago

  • Resolution → fixed
  • Status assigned → closed

In 13147:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

Note: See TracTickets for help on using tickets.