WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Clean up some edge cases in `sanitize_sql_orderby()`. Merge of [32164] to the 3.9 branch. 

Props vortfu, dd32.


Built from https://develop.svn.wordpress.org/branches/3.9@32190


git-svn-id: http://core.svn.wordpress.org/branches/3.9@32163 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Gary Pendergast 2015-04-20 12:36:14 +00:00
parent ff692384e0
commit 27c4e15959
1 changed files with 12 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
wp-includes/formatting.php
View File

@ -1178,22 +1178,24 @@ function sanitize_title_with_dashes( $title, $raw_title = '', $context = 'displa
} }
/** /**
* Ensures a string is a valid SQL order by clause. * Ensures a string is a valid SQL 'order by' clause.
* *
* Accepts one or more columns, with or without ASC/DESC, and also accepts * Accepts one or more columns, with or without a sort order (ASC / DESC).
* RAND(). * e.g. 'column_1', 'column_1, column_2', 'column_1 ASC, column_2 DESC' etc.
*
* Also accepts 'RAND()'.
* *
* @since 2.5.1 * @since 2.5.1
* *
* @param string $orderby Order by string to be checked. * @param string $orderby Order by clause to be validated.
* @return string|bool Returns the order by clause if it is a match, false otherwise. * @return string|bool Returns $orderby if valid, false otherwise.
*/ */
function sanitize_sql_orderby( $orderby ) { function sanitize_sql_orderby( $orderby ) {
preg_match('/^\s*([a-z0-9_]+(\s+(ASC|DESC))?(\s*,\s*|\s*$))+|^\s*RAND\(\s*\)\s*$/i', $orderby, $obmatches); if ( preg_match( '/^\s*(([a-z0-9_]+|`[a-z0-9_]+`)(\s+(ASC|DESC))?\s*(,\s*(?=[a-z0-9_`])|$))+$/i', $orderby ) || preg_match( '/^\s*RAND\(\s*\)\s*$/i', $orderby ) ) {
if ( !$obmatches )
return false;
return $orderby; return $orderby;
} }
return false;
}
/** /**
* Sanitizes an HTML classname to ensure it only contains valid characters. * Sanitizes an HTML classname to ensure it only contains valid characters.