Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-12-22 17:18:32 +01:00
Code Issues Projects Releases Wiki Activity

Options, Meta APIs: Add SQL escaping to query loading 'all options'.

Browse Source 
Escapes the return value of `wp_autoload_values_to_autoload()` for use in the database query loading 'all options'. This is a hardening fix to protect against future changes to the options API which may allow developers to further customize the return value of the `wp_autoload_values_to_autoload` filter.

Follow up to [57920].

Props peterwilsoncc, joemcgill.
Fixes #42441.



Built from https://develop.svn.wordpress.org/trunk@58380


git-svn-id: http://core.svn.wordpress.org/trunk@57829 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Peter Wilson 2024-06-11 02:31:13 +00:00
parent fb00a36d1f
commit bb95e4fe9e
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
wp-includes/option.php
View File

@ -606,7 +606,7 @@ function wp_load_alloptions( $force_cache = false ) {
if ( ! $alloptions ) {
$suppress = $wpdb->suppress_errors();
$alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE autoload IN ( '" . implode( "', '", wp_autoload_values_to_autoload() ) . "' )" );
$alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE autoload IN ( '" . implode( "', '", esc_sql( wp_autoload_values_to_autoload() ) ) . "' )" );
if ( ! $alloptions_db ) {
$alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options" );

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
*
* @global string $wp_version
*/
$wp_version = '6.6-beta1-58379';
$wp_version = '6.6-beta1-58380';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.