Changeset 2891193

Timestamp:

03/31/2023 11:18:58 AM (3 years ago)

Author:

supportcandy

Message:

esc_sql in parse user filters

File:

• supportcandy/trunk/includes/class-wpsc-functions.php (modified) (8 diffs)

supportcandy/trunk/includes/class-wpsc-functions.php

@@ -134 +134 @@
          */
         public static function parse_user_filters( $class, $filters ) {
+
+            global $wpdb;
 
             // Invalid filter.
@@ -180 +182 @@
                             break;
                         }
-                        $filter_str[] = $slug . ' ' . $compare . ' \'' . $val . '\'';
+                        $filter_str[] = $slug . ' ' . $compare . ' \'' . esc_sql( $val ) . '\'';
                         break;
 
                     case 'BETWEEN':
-                        $filter_str[] = $slug . ' BETWEEN \'' . $val[0] . '\' AND \'' . $val[1] . '\'';
+                        $filter_str[] = $slug . ' BETWEEN \'' . esc_sql( $val[0] ) . '\' AND \'' . esc_sql( $val[1] ) . '\'';
                         break;
 
@@ -193 +195 @@
                             foreach ( $val as $match ) {
 
-                                $rlike[] = $slug . ' RLIKE \'(^|[|])' . $match . '($|[|])\'';
+                                $rlike[] = $slug . ' RLIKE \'(^|[|])' . esc_sql( $match ) . '($|[|])\'';
                             }
                             $filter_str[] = '( ' . implode( ' OR ', $rlike ) . ' )';
@@ -199 +201 @@
                         } else {
 
-                            $filter_str[] = $slug . ' IN ( \'' . implode( '\', \'', $val ) . '\' )';
+                            $filter_str[] = $slug . ' IN ( \'' . implode( '\', \'', esc_sql( $val ) ) . '\' )';
                         }
                         break;
@@ -209 +211 @@
                             foreach ( $val as $match ) {
 
-                                $rlike[] = $slug . ' NOT RLIKE \'(^|[|])' . $match . '($|[|])\'';
+                                $rlike[] = $slug . ' NOT RLIKE \'(^|[|])' . esc_sql( $match ) . '($|[|])\'';
                             }
                             $filter_str[] = '( ' . implode( ' OR ', $rlike ) . ' )';
@@ -215 +217 @@
                         } else {
 
-                            $filter_str[] = $slug . ' NOT IN ( \'' . implode( '\', \'', $val ) . '\' )';
+                            $filter_str[] = $slug . ' NOT IN ( \'' . implode( '\', \'', esc_sql( $val ) ) . '\' )';
                         }
                         break;
@@ -228 +230 @@
 
                     case 'LIKE':
-                        $filter_str[] = $slug . ' ' . $compare . ' \'%' . $val . '%\'';
+                        $filter_str[] = $slug . ' ' . $compare . ' \'%' . esc_sql( $wpdb->esc_like( $val ) ) . '%\'';
                         break;
                 }
@@ -253 +255 @@
             }
 
-            $order = isset( $filter['order'] ) && $filter['order'] ?
+            $order = isset( $filter['order'] ) && $filter['order'] && in_array( $filter['order'], array( 'ASC', 'DESC' ) ) ?
                 $filter['order'] : 'ASC';