| @@ -1505,9 +1505,9 @@ | ||
| 1505 | 1505 | * |
| 1506 | 1506 | * @return void |
| 1507 | 1507 | * @throws Exception |
| 1508 | 1508 | * @since 4.3.2.8 |
| 1509 | - * @version 1.0.0 | |
| 1509 | + * @version 1.0.2 | |
| 1510 | 1510 | */ |
| 1511 | 1511 | public static function handle_params_query_list_orders( PostFilter &$post_filter, array $param = array() ) { |
| 1512 | 1512 | $post_db = PostDB::getInstance(); |
| 1513 | 1513 | $user_of_order = absint( $param['author'] ?? 0 ); |
| @@ -1516,9 +1516,9 @@ | ||
| 1516 | 1516 | $month = $param['m'] ?? ''; |
| 1517 | 1517 | $limit = $param['posts_per_page'] ?? 20; |
| 1518 | 1518 | $paged = $param['paged'] ?? 1; |
| 1519 | 1519 | $refund_request_status = sanitize_key( (string) ( $param['refund_request_status'] ?? '' ) ); |
| 1520 | - $order_by = $param['orderby'] ?? 'date'; | |
| 1520 | + $order_by = $param['orderby'] ?? 'menu_order'; | |
| 1521 | 1521 | if ( empty( $order_by ) ) { |
| 1522 | 1522 | $order_by = 'ID'; |
| 1523 | 1523 | } else { |
| 1524 | 1524 | switch ( $order_by ) { |
| @@ -1524,10 +1524,20 @@ | ||
| 1524 | 1524 | switch ( $order_by ) { |
| 1525 | 1525 | case 'date': |
| 1526 | 1526 | $order_by = 'post_date'; |
| 1527 | 1527 | break; |
| 1528 | - case 'title': | |
| 1529 | - $order_by = 'ID'; | |
| 1528 | + default: | |
| 1529 | + $allowed_key = array( | |
| 1530 | + 'ID', | |
| 1531 | + 'post_title', | |
| 1532 | + 'post_author', | |
| 1533 | + 'post_status', | |
| 1534 | + 'order_total', | |
| 1535 | + 'menu_order' | |
| 1536 | + ); | |
| 1537 | + if ( ! in_array( $order_by, $allowed_key ) ) { | |
| 1538 | + $order_by = 'ID'; | |
| 1539 | + } | |
| 1530 | 1540 | break; |
| 1531 | 1541 | } |
| 1532 | 1542 | } |
| 1533 | 1543 | |
| @@ -1535,10 +1545,9 @@ | ||
| 1535 | 1545 | // End convert params |
| 1536 | 1546 | |
| 1537 | 1547 | if ( $order_by === 'order_total' ) { |
| 1538 | 1548 | $post_filter->join[] = "INNER JOIN {$post_db->tb_postmeta} pm2 ON p.ID = pm2.post_id AND pm2.meta_key = '_order_total'"; |
| 1539 | - $post_filter->where[] = 'AND CAST(pm2.meta_value AS UNSIGNED)'; | |
| 1540 | - $post_filter->order_by = 'pm2.meta_value'; | |
| 1549 | + $post_filter->order_by = 'CAST(pm2.meta_value AS DECIMAL(10,2))'; | |
| 1541 | 1550 | } else { |
| 1542 | 1551 | $post_filter->order_by = $order_by; |
| 1543 | 1552 | } |
| 1544 | 1553 | |
| @@ -1570,12 +1579,18 @@ | ||
| 1570 | 1579 | } |
| 1571 | 1580 | |
| 1572 | 1581 | if ( ! empty( $month ) ) { |
| 1573 | 1582 | $year = substr( $month, 0, 4 ); |
| 1574 | - $post_filter->where[] = "AND YEAR(p.post_date) = $year"; | |
| 1583 | + $post_filter->where[] = $post_db->wpdb->prepare( | |
| 1584 | + 'AND YEAR(p.post_date) = %s', | |
| 1585 | + $year | |
| 1586 | + ); | |
| 1575 | 1587 | if ( strlen( $month ) > 5 ) { |
| 1576 | 1588 | $mon = substr( $month, 4, 2 ); |
| 1577 | - $post_filter->where[] = "AND MONTH(p.post_date) = $mon"; | |
| 1589 | + $post_filter->where[] = $post_db->wpdb->prepare( | |
| 1590 | + 'AND MONTH(p.post_date) = %s', | |
| 1591 | + $mon | |
| 1592 | + ); | |
| 1578 | 1593 | } |
| 1579 | 1594 | } |
| 1580 | 1595 | |
| 1581 | 1596 | $post_filter->order = $order; |
