WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Query: Validate relation in `WP_Date_Query`. 

Props dd32, johnjamesjacoby, martinkrcho, ehtis, paulkevan, peterwilsoncc.

Built from https://develop.svn.wordpress.org/trunk@54530


git-svn-id: http://core.svn.wordpress.org/trunk@54085 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
audrasjb 2022-10-17 11:49:11 +00:00
parent 1b46797366
commit 4396588167
2 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
wp-includes/class-wp-date-query.php
View File

@ -150,8 +150,8 @@ class WP_Date_Query {
return; return;
} }
if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] ) ) { if ( isset( $date_query['relation'] ) ) {
$this->relation = 'OR'; $this->relation = $this->sanitize_relation( $date_query['relation'] );
} else { } else {
$this->relation = 'AND'; $this->relation = 'AND';
} }
@ -220,6 +220,9 @@ class WP_Date_Query {
$this->validate_date_values( $queries ); $this->validate_date_values( $queries );
} }
// Sanitize the relation parameter.
$queries['relation'] = $this->sanitize_relation( $queries['relation'] );
foreach ( $queries as $key => $q ) { foreach ( $queries as $key => $q ) {
if ( ! is_array( $q ) || in_array( $key, $this->time_keys, true ) ) { if ( ! is_array( $q ) || in_array( $key, $this->time_keys, true ) ) {
// This is a first-order query. Trust the values and sanitize when building SQL. // This is a first-order query. Trust the values and sanitize when building SQL.
@ -1041,4 +1044,20 @@ class WP_Date_Query {
return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time ); return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time );
} }
/**
* Sanitizes a 'relation' operator.
*
* @since 6.0.3
*
* @param string $relation Raw relation key from the query argument.
* @return string Sanitized relation ('AND' or 'OR').
*/
public function sanitize_relation( $relation ) {
if ( 'OR' === strtoupper( $relation ) ) {
return 'OR';
} else {
return 'AND';
}
}
} }

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '6.1-RC1-54529'; $wp_version = '6.1-RC1-54530';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.