← All changes
|
includes/utilities/charitable-utility-functions.php
+59
-0
1.8.11.3
→
1.8.13
View file →
| @@ -188,8 +188,39 @@ | ||
| 188 | 188 | return filter_var( $i, FILTER_VALIDATE_EMAIL ); |
| 189 | 189 | } |
| 190 | 190 | |
| 191 | 191 | /** |
| 192 | + * Ensure a sort direction is one of the two values MySQL accepts. | |
| 193 | + * | |
| 194 | + * Sort directions cannot be passed to $wpdb->prepare() as placeholders, so any | |
| 195 | + * value that is interpolated into the ORDER BY clause of a query has to be | |
| 196 | + * validated against a strict whitelist instead. Anything that is not exactly | |
| 197 | + * ASC or DESC (case insensitive) falls back to the given default. | |
| 198 | + * | |
| 199 | + * @since 1.8.12.2 | |
| 200 | + * | |
| 201 | + * @param mixed $order The sort direction received. | |
| 202 | + * @param string $fallback The direction to use when $order is not valid. | |
| 203 | + * @return string Either 'ASC' or 'DESC'. | |
| 204 | + */ | |
| 205 | +function charitable_validate_sort_direction( $order, $fallback = 'DESC' ) { | |
| 206 | + /* | |
| 207 | + * Only strings are considered. Anything else -- null, arrays, objects, | |
| 208 | + * integers -- fails closed to the fallback rather than being coerced, so | |
| 209 | + * there is no path on which caller-supplied bytes are returned. | |
| 210 | + */ | |
| 211 | + $order = is_string( $order ) ? strtoupper( trim( $order ) ) : ''; | |
| 212 | + | |
| 213 | + if ( in_array( $order, array( 'ASC', 'DESC' ), true ) ) { | |
| 214 | + return $order; | |
| 215 | + } | |
| 216 | + | |
| 217 | + $fallback = is_string( $fallback ) ? strtoupper( trim( $fallback ) ) : ''; | |
| 218 | + | |
| 219 | + return 'ASC' === $fallback ? 'ASC' : 'DESC'; | |
| 220 | +} | |
| 221 | + | |
| 222 | +/** | |
| 192 | 223 | * Sanitize any checkbox value. |
| 193 | 224 | * |
| 194 | 225 | * @since 1.5.0 |
| 195 | 226 | * |
| @@ -256,8 +287,36 @@ | ||
| 256 | 287 | function charitable_sanitize_date( $date, $return_format = 'U' ) { |
| 257 | 288 | global $wp_locale; |
| 258 | 289 | |
| 259 | 290 | if ( empty( $date ) || ! $date ) { |
| 291 | + return false; | |
| 292 | + } | |
| 293 | + | |
| 294 | + /* | |
| 295 | + * Handle Y-m-d format dates (like "2027-01-31") directly. Ported from | |
| 296 | + * Charitable Pro (1.8.13): the code below this block assumes a | |
| 297 | + * space-separated, English-or-localized MONTH NAME date ("January 31, | |
| 298 | + * 2027") and mis-parses a bare ISO date into garbage, which is what | |
| 299 | + * charitable/update-campaign and charitable/create-campaign's end_date | |
| 300 | + * input send (validated as ^\d{4}-\d{2}-\d{2}$ before it reaches here). | |
| 301 | + */ | |
| 302 | + if ( preg_match( '/^\d{4}-\d{2}-\d{2}$/', $date ) ) { | |
| 303 | + $date_parts = explode( '-', $date ); | |
| 304 | + | |
| 305 | + if ( 3 === count( $date_parts ) ) { | |
| 306 | + $year = (int) $date_parts[0]; | |
| 307 | + $month = (int) $date_parts[1]; | |
| 308 | + $day = (int) $date_parts[2]; | |
| 309 | + | |
| 310 | + $time = mktime( 0, 0, 0, $month, $day, $year ); | |
| 311 | + | |
| 312 | + if ( 'U' === $return_format ) { | |
| 313 | + return $time; | |
| 314 | + } | |
| 315 | + | |
| 316 | + return date( $return_format, $time ); // phpcs:ignore WordPress.DateTime.RestrictedFunctions.date_date | |
| 317 | + } | |
| 318 | + | |
| 260 | 319 | return false; |
| 261 | 320 | } |
| 262 | 321 | |
| 263 | 322 | // If the month is in english, we need to ensure it's translated if the site is in another language. |