vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-16 14:50:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix gallery shortcode orderby param for all SQL setups. Sanitize orderby. fixes #6476 for trunk

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@7592 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Mark Jaquith
2008-04-03 03:05:49 +00:00
parent ecc7ec153a
commit ba4dab3cd6
3 changed files with 23 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-includes/media.php
+10 -4
View File
@@ -339,7 +339,14 @@ function gallery_shortcode($attr) {
$output = apply_filters('post_gallery', '', $attr);
if ( $output != '' )
return $output;
// We're trusting author input, so let's at least make sure it looks like a valid orderby statement
if ( isset( $attr['orderby'] ) ) {
$attr['orderby'] = sanitize_sql_orderby( $attr['orderby'] );
if ( !$attr['orderby'] )
unset( $attr['orderby'] );
}
extract(shortcode_atts(array(
'orderby' => 'menu_order ASC, ID ASC',
'id' => $post->ID,
@@ -351,8 +358,7 @@ function gallery_shortcode($attr) {
), $attr));
$id = intval($id);
$orderby = addslashes($orderby);
$attachments = get_children("post_parent=$id&post_type=attachment&post_mime_type=image&orderby=\"{$orderby}\"");
$attachments = get_children("post_parent=$id&post_type=attachment&post_mime_type=image&orderby={$orderby}");
if ( empty($attachments) )
return '';
@@ -426,7 +432,7 @@ function next_image_link() {
function adjacent_image_link($prev = true) {
global $post;
$post = get_post($post);
$attachments = array_values(get_children("post_parent=$post->post_parent&post_type=attachment&post_mime_type=image&orderby=\"menu_order ASC, ID ASC\""));
$attachments = array_values(get_children("post_parent=$post->post_parent&post_type=attachment&post_mime_type=image&orderby=menu_order ASC, ID ASC"));
foreach ( $attachments as $k => $attachment )
if ( $attachment->ID == $post->ID )