sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Sanitize order and orderby in get_bookmarks() 

git-svn-id: https://develop.svn.wordpress.org/trunk@18345 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren 2011-06-27 15:46:11 +00:00
parent bb7af108f5
commit 7a9c81cdb1
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
wp-includes/bookmark.php
View File

@ -213,22 +213,32 @@ function get_bookmarks($args = '') {
$orderby = strtolower($orderby);
$length = '';
switch ($orderby) {
switch ( $orderby ) {
case 'length':
$length = ", CHAR_LENGTH(link_name) AS length";
break;
case 'rand':
$orderby = 'rand()';
break;
case 'link_id':
$orderby = "$wpdb->links.link_id";
break;
default:
$orderparams = array();
foreach ( explode(',', $orderby) as $ordparam )
$orderparams[] = 'link_' . trim($ordparam);
foreach ( explode(',', $orderby) as $ordparam ) {
$ordparam = trim($ordparam);
if ( in_array( $ordparam, array( 'name', 'url', 'visible', 'rating', 'owner', 'updated' ) ) )
$orderparams[] = 'link_' . $ordparam;
}
$orderby = implode(',', $orderparams);
}
if ( 'link_id' == $orderby )
$orderby = "$wpdb->links.link_id";
if ( empty( $orderby ) )
$orderby = 'link_name';
$order = strtoupper( $order );
if ( '' !== $order && !in_array( $order, array( 'ASC', 'DESC' ) ) )
$order = 'ASC';
$visible = '';
if ( $hide_invisible )