From 42646e67b39a2d7dc17ffe6fa7bfcbf7ff075fcf Mon Sep 17 00:00:00 2001 From: Boone Gorges Date: Fri, 17 Oct 2014 01:19:03 +0000 Subject: [PATCH] Use table aliases for columns in SQL generated by WP_Date_Query. The use of non-aliased column names (eg 'post_date' instead of 'wp_posts.post_date') in WP_Date_Query causes SQL notices and other failures when queries involve table joins, such as date_query combined with tax_query or meta_query. This changeset modifies WP_Date_Query::validate_column() to add the table alias when it can be detected from the column name (ie, in the case of core columns). A side effect of this change is that it is now possible to use WP_Date_Query to build WHERE clauses across multiple tables, though there is currently no core support for the automatic generation of the necessary JOIN clauses. See Props ew_holmes, wonderboymusic, neoxx, Viper007Bond, boonebgorges. Fixes #25775. git-svn-id: https://develop.svn.wordpress.org/trunk@29933 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/date.php | 58 +++++++++++++++++++----- tests/phpunit/tests/date/query.php | 60 ++++++++++++++++++++++--- tests/phpunit/tests/query/dateQuery.php | 44 ++++++++++++++++-- 3 files changed, 140 insertions(+), 22 deletions(-) diff --git a/src/wp-includes/date.php b/src/wp-includes/date.php index 426b24dba2..2634f2a7a0 100644 --- a/src/wp-includes/date.php +++ b/src/wp-includes/date.php @@ -435,6 +435,11 @@ class WP_Date_Query { /** * Validates a column name parameter. * + * Column names without a table prefix (like 'post_date') are checked against a whitelist of + * known tables, and then, if found, have a table prefix (such as 'wp_posts.') prepended. + * Prefixed column names (such as 'wp_posts.post_date') bypass this whitelist check, + * and are only sanitized to remove illegal characters. + * * @since 3.7.0 * @access public * @@ -442,22 +447,53 @@ class WP_Date_Query { * @return string A validated column name value. */ public function validate_column( $column ) { + global $wpdb; + $valid_columns = array( 'post_date', 'post_date_gmt', 'post_modified', 'post_modified_gmt', 'comment_date', 'comment_date_gmt' ); - /** - * Filter the list of valid date query columns. - * - * @since 3.7.0 - * - * @param array $valid_columns An array of valid date query columns. Defaults are 'post_date', 'post_date_gmt', - * 'post_modified', 'post_modified_gmt', 'comment_date', 'comment_date_gmt' - */ - if ( ! in_array( $column, apply_filters( 'date_query_valid_columns', $valid_columns ) ) ) - $column = 'post_date'; - return $column; + // Attempt to detect a table prefix. + if ( false === strpos( $column, '.' ) ) { + /** + * Filter the list of valid date query columns. + * + * @since 3.7.0 + * + * @param array $valid_columns An array of valid date query columns. Defaults + * are 'post_date', 'post_date_gmt', 'post_modified', + * 'post_modified_gmt', 'comment_date', 'comment_date_gmt' + */ + if ( ! in_array( $column, apply_filters( 'date_query_valid_columns', $valid_columns ) ) ) { + $column = 'post_date'; + } + + $known_columns = array( + $wpdb->posts => array( + 'post_date', + 'post_date_gmt', + 'post_modified', + 'post_modified_gmt', + ), + $wpdb->comments => array( + 'comment_date', + 'comment_date_gmt', + ), + ); + + // If it's a known column name, add the appropriate table prefix. + foreach ( $known_columns as $table_name => $table_columns ) { + if ( in_array( $column, $table_columns ) ) { + $column = $table_name . '.' . $column; + break; + } + } + + } + + // Remove unsafe characters. + return preg_replace( '/[^a-zA-Z0-9_$\.]/', '', $column ); } /** diff --git a/tests/phpunit/tests/date/query.php b/tests/phpunit/tests/date/query.php index 84bda07d7e..aa9197d3ac 100644 --- a/tests/phpunit/tests/date/query.php +++ b/tests/phpunit/tests/date/query.php @@ -201,48 +201,87 @@ class Tests_WP_Date_Query extends WP_UnitTestCase { } public function test_validate_column_post_date() { + global $wpdb; $q = new WP_Date_Query( array() ); - $this->assertSame( 'post_date', $q->validate_column( 'post_date' ) ); + $this->assertSame( $wpdb->posts . '.post_date', $q->validate_column( 'post_date' ) ); } public function test_validate_column_post_date_gmt() { + global $wpdb; $q = new WP_Date_Query( array() ); - $this->assertSame( 'post_date_gmt', $q->validate_column( 'post_date_gmt' ) ); + $this->assertSame( $wpdb->posts . '.post_date_gmt', $q->validate_column( 'post_date_gmt' ) ); } public function test_validate_column_post_modified() { + global $wpdb; $q = new WP_Date_Query( array() ); - $this->assertSame( 'post_modified', $q->validate_column( 'post_modified' ) ); + $this->assertSame( $wpdb->posts . '.post_modified', $q->validate_column( 'post_modified' ) ); } public function test_validate_column_post_modified_gmt() { + global $wpdb; $q = new WP_Date_Query( array() ); - $this->assertSame( 'post_modified_gmt', $q->validate_column( 'post_modified_gmt' ) ); + $this->assertSame( $wpdb->posts . '.post_modified_gmt', $q->validate_column( 'post_modified_gmt' ) ); } public function test_validate_column_comment_date() { + global $wpdb; $q = new WP_Date_Query( array() ); - $this->assertSame( 'comment_date', $q->validate_column( 'comment_date' ) ); + $this->assertSame( $wpdb->comments . '.comment_date', $q->validate_column( 'comment_date' ) ); } public function test_validate_column_comment_date_gmt() { + global $wpdb; $q = new WP_Date_Query( array() ); - $this->assertSame( 'comment_date_gmt', $q->validate_column( 'comment_date_gmt' ) ); + $this->assertSame( $wpdb->comments . '.comment_date_gmt', $q->validate_column( 'comment_date_gmt' ) ); } public function test_validate_column_invalid() { + global $wpdb; $q = new WP_Date_Query( array() ); - $this->assertSame( 'post_date', $q->validate_column( 'foo' ) ); + $this->assertSame( $wpdb->posts . '.post_date', $q->validate_column( 'foo' ) ); + } + + /** + * @ticket 25775 + */ + public function test_validate_column_with_date_query_valid_columns_filter() { + $q = new WP_Date_Query( array() ); + + add_filter( 'date_query_valid_columns', array( $this, 'date_query_valid_columns_callback' ) ); + + $this->assertSame( 'my_custom_column', $q->validate_column( 'my_custom_column' ) ); + + remove_filter( 'date_query_valid_columns', array( $this, 'date_query_valid_columns_callback' ) ); + } + + /** + * @ticket 25775 + */ + public function test_validate_column_prefixed_column_name() { + $q = new WP_Date_Query( array() ); + + $this->assertSame( 'foo.bar', $q->validate_column( 'foo.bar' ) ); + } + + /** + * @ticket 25775 + */ + public function test_validate_column_prefixed_column_name_with_illegal_characters() { + $q = new WP_Date_Query( array() ); + + $this->assertSame( 'foo.bar', $q->validate_column( 'f"\'oo\/.b;:()ar' ) ); } public function test_build_value_value_null() { + global $wpdb; $q = new WP_Date_Query( array() ); $this->assertFalse( $q->build_value( 'foo', null ) ); @@ -902,4 +941,11 @@ class Tests_WP_Date_Query extends WP_UnitTestCase { $this->assertFalse( @$this->q->validate_date_values( array( 'dayofyear' => $day_of_year ) ) ); } } + + /** Helpers **********************************************************/ + + public function date_query_valid_columns_callback( $columns ) { + $columns[] = 'my_custom_column'; + return $columns; + } } diff --git a/tests/phpunit/tests/query/dateQuery.php b/tests/phpunit/tests/query/dateQuery.php index 9654c839bd..676d860ce9 100644 --- a/tests/phpunit/tests/query/dateQuery.php +++ b/tests/phpunit/tests/query/dateQuery.php @@ -610,6 +610,8 @@ class Tests_Query_DateQuery extends WP_UnitTestCase { } public function test_date_params_monthnum_m_duplicate() { + global $wpdb; + $this->create_posts(); $posts = $this->_get_query_result( array( @@ -629,11 +631,13 @@ class Tests_Query_DateQuery extends WP_UnitTestCase { $this->assertEquals( $expected_dates, wp_list_pluck( $posts, 'post_date' ) ); - $this->assertContains( "MONTH( post_date ) = 5", $this->q->request ); - $this->assertNotContains( "MONTH( post_date ) = 9", $this->q->request ); + $this->assertContains( "MONTH( $wpdb->posts.post_date ) = 5", $this->q->request ); + $this->assertNotContains( "MONTH( $wpdb->posts.post_date ) = 9", $this->q->request ); } public function test_date_params_week_w_duplicate() { + global $wpdb; + $this->create_posts(); $posts = $this->_get_query_result( array( @@ -652,8 +656,40 @@ class Tests_Query_DateQuery extends WP_UnitTestCase { $this->assertEquals( $expected_dates, wp_list_pluck( $posts, 'post_date' ) ); - $this->assertContains( "WEEK( post_date, 1 ) = 21", $this->q->request ); - $this->assertNotContains( "WEEK( post_date, 1 ) = 22", $this->q->request ); + $this->assertContains( "WEEK( $wpdb->posts.post_date, 1 ) = 21", $this->q->request ); + $this->assertNotContains( "WEEK( $wpdb->posts.post_date, 1 ) = 22", $this->q->request ); + } + + /** + * @ticket 25775 + */ + public function test_date_query_with_taxonomy_join() { + $p1 = $this->factory->post->create( array( + 'post_date' => '2013-04-27 01:01:01', + ) ); + $p2 = $this->factory->post->create( array( + 'post_date' => '2013-03-21 01:01:01', + ) ); + + register_taxonomy( 'foo', 'post' ); + wp_set_object_terms( $p1, 'bar', 'foo' ); + + $posts = $this->_get_query_result( array( + 'date_query' => array( + 'year' => 2013, + ), + 'tax_query' => array( + array( + 'taxonomy' => 'foo', + 'terms' => array( 'bar' ), + 'field' => 'name', + ), + ), + ) ); + + _unregister_taxonomy( 'foo' ); + + $this->assertEquals( array( $p1 ), wp_list_pluck( $posts, 'ID' ) ); } /**