sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

In get_site_by_path(), avoid passing $paths through prepare(). If a path contains a %, we end up with problems. see #27003.

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@27439 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin 2014-03-06 18:17:32 +00:00
parent 15533d1d1f
commit ff3c96208a
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/wp-includes/ms-load.php
View File

@ -350,8 +350,9 @@ function get_site_by_path( $domain, $path, $segments = null ) {
if ( count( $paths ) > 1 ) {
$paths = "'" . implode( "', '", $wpdb->_escape( $paths ) ) . "'";
$site = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->blogs
WHERE domain = %s AND path IN ($paths) ORDER BY CHAR_LENGTH(path) DESC LIMIT 1", $domain ) );
$sql = $wpdb->prepare( "SELECT * FROM $wpdb->blogs WHERE domain = %s", $domain );
$sql .= " AND path IN ($paths) ORDER BY CHAR_LENGTH(path) DESC LIMIT 1";
$site = $wpdb->get_row( $sql );
} else {
$site = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->blogs WHERE domain = %s and path = %s", $domain, $paths[0] ) );
}