Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Sanitize order and orderby in get_bookmarks() 

git-svn-id: http://svn.automattic.com/wordpress/trunk@18345 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan 2011-06-27 15:46:11 +00:00
parent 581402ae2f
commit 2010842d10
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
wp-includes/bookmark.php
View File

@ -213,22 +213,32 @@ function get_bookmarks($args = '') {
$orderby = strtolower($orderby);
$length = '';
switch ($orderby) {
switch ( $orderby ) {
case 'length':
$length = ", CHAR_LENGTH(link_name) AS length";
break;
case 'rand':
$orderby = 'rand()';
break;
case 'link_id':
$orderby = "$wpdb->links.link_id";
break;
default:
$orderparams = array();
foreach ( explode(',', $orderby) as $ordparam )
$orderparams[] = 'link_' . trim($ordparam);
foreach ( explode(',', $orderby) as $ordparam ) {
$ordparam = trim($ordparam);
if ( in_array( $ordparam, array( 'name', 'url', 'visible', 'rating', 'owner', 'updated' ) ) )
$orderparams[] = 'link_' . $ordparam;
}
$orderby = implode(',', $orderparams);
}
if ( 'link_id' == $orderby )
$orderby = "$wpdb->links.link_id";
if ( empty( $orderby ) )
$orderby = 'link_name';
$order = strtoupper( $order );
if ( '' !== $order && !in_array( $order, array( 'ASC', 'DESC' ) ) )
$order = 'ASC';
$visible = '';
if ( $hide_invisible )