vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-04-08 06:34:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Use stricter sanitization for meta query clause keys.

Browse Source 
By forcing all clause keys to be strings, we make it possible to use strict
comparison when validating values of 'orderby' as passed to `WP_Query`. This
eliminates situations where the presence of numeric clause keys could result
in an improperly validated 'orderby' value.

Props nikolov.tmw.
Fixes #32937.

git-svn-id: https://develop.svn.wordpress.org/trunk@34090 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Boone Gorges
2015-09-12 21:05:14 +00:00
parent dcbd8c6c3d
commit 4fdfdb6078
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/wp-includes/query.php
View File

@@ -2280,7 +2280,7 @@ class WP_Query {
$allowed_keys = array_merge( $allowed_keys, array_keys( $meta_clauses ) );
}
if ( ! in_array( $orderby, $allowed_keys ) ) {
if ( ! in_array( $orderby, $allowed_keys, true ) ) {
return false;
}