WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Sanitize order and orderby in get_bookmarks() 

git-svn-id: http://svn.automattic.com/wordpress/trunk@18345 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan 2011-06-27 15:46:11 +00:00
parent 581402ae2f
commit 2010842d10
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
wp-includes/bookmark.php
View File

@ -213,22 +213,32 @@ function get_bookmarks($args = '') {
$orderby = strtolower($orderby); $orderby = strtolower($orderby);
$length = ''; $length = '';
switch ($orderby) { switch ( $orderby ) {
case 'length': case 'length':
$length = ", CHAR_LENGTH(link_name) AS length"; $length = ", CHAR_LENGTH(link_name) AS length";
break; break;
case 'rand': case 'rand':
$orderby = 'rand()'; $orderby = 'rand()';
break; break;
case 'link_id':
$orderby = "$wpdb->links.link_id";
break;
default: default:
$orderparams = array(); $orderparams = array();
foreach ( explode(',', $orderby) as $ordparam ) foreach ( explode(',', $orderby) as $ordparam ) {
$orderparams[] = 'link_' . trim($ordparam); $ordparam = trim($ordparam);
if ( in_array( $ordparam, array( 'name', 'url', 'visible', 'rating', 'owner', 'updated' ) ) )
$orderparams[] = 'link_' . $ordparam;
}
$orderby = implode(',', $orderparams); $orderby = implode(',', $orderparams);
} }
if ( 'link_id' == $orderby ) if ( empty( $orderby ) )
$orderby = "$wpdb->links.link_id"; $orderby = 'link_name';
$order = strtoupper( $order );
if ( '' !== $order && !in_array( $order, array( 'ASC', 'DESC' ) ) )
$order = 'ASC';
$visible = ''; $visible = '';
if ( $hide_invisible ) if ( $hide_invisible )