← All changes | classes/class-query.php +12 -27 4.2.1 → 3.8.0 View file →

		@@ -10,10 +10,8 @@
10	10	/**
11	11	* Class - Query
12	12	*/
13	13	class Query {
14		- const ALLOWED_FIELDS = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'created', 'summary', 'connector', 'context', 'action', 'ip' );
15		-
16	14	/**
17	15	* Hold the number of records found
18	16	*
19	17	* @var int
		@@ -59,9 +57,10 @@
59	57	if ( ! empty( $args['search'] ) ) {
60	58	$field = ! empty( $args['search_field'] ) ? $args['search_field'] : 'summary';
61	59
62	60	// Sanitize field.
63		- if ( in_array( $field, self::ALLOWED_FIELDS, true ) ) {
	61	+ $allowed_fields = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'created', 'summary', 'connector', 'context', 'action', 'ip' );
	62	+ if ( in_array( $field, $allowed_fields, true ) ) {
64	63	$where .= $wpdb->prepare( " AND $wpdb->stream.{$field} LIKE %s", "%{$args['search']}%" ); // @codingStandardsIgnoreLine can't prepare column name
65	64	}
66	65	}
67	66
		@@ -179,29 +178,24 @@
179	178
180	179	/**
181	180	* PARSE ORDER PARAMS
182	181	*/
	182	+ $order = esc_sql( $args['order'] );
	183	+ $orderby = esc_sql( $args['orderby'] );
183	184	$orderable = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'summary', 'created', 'connector', 'context', 'action' );
184	185
185		- // Default to sorting by record ID.
186		- $orderby = "$wpdb->stream.ID";
187		-
188		- if ( in_array( $args['orderby'], $orderable, true ) ) {
189		- $orderby = sprintf( '%s.%s', $wpdb->stream, $args['orderby'] );
190		- } elseif ( 'meta_value_num' === $args['orderby'] && ! empty( $args['meta_key'] ) ) {
	186	+ if ( in_array( $orderby, $orderable, true ) ) {
	187	+ $orderby = sprintf( '%s.%s', $wpdb->stream, $orderby );
	188	+ } elseif ( 'meta_value_num' === $orderby && ! empty( $args['meta_key'] ) ) {
191	189	$orderby = "CAST($wpdb->streammeta.meta_value AS SIGNED)";
192		- } elseif ( 'meta_value' === $args['orderby'] && ! empty( $args['meta_key'] ) ) {
	190	+ } elseif ( 'meta_value' === $orderby && ! empty( $args['meta_key'] ) ) {
193	191	$orderby = "$wpdb->streammeta.meta_value";
	192	+ } else {
	193	+ $orderby = "$wpdb->stream.ID";
194	194	}
195	195
196		- // Show the recent records first by default.
197		- $order = 'DESC';
198		- if ( 'ASC' === strtoupper( $args['order'] ) ) {
199		- $order = 'ASC';
200		- }
	196	+ $orderby = "ORDER BY {$orderby} {$order}";
201	197
202		- $orderby = sprintf( 'ORDER BY %s %s', $orderby, $order );
203		-
204	198	/**
205	199	* PARSE FIELDS PARAMETER
206	200	*/
207	201	$fields = (array) $args['fields'];
		@@ -206,11 +200,8 @@
206	200	*/
207	201	$fields = (array) $args['fields'];
208	202	$selects = array();
209	203
210		- // Column names cannot be passed through $wpdb->prepare(), so restrict
211		- // the selectable fields to a known allowlist to prevent SQL injection
212		- // via the `fields` argument.
213	204	if ( ! empty( $fields ) ) {
214	205	foreach ( $fields as $field ) {
215	206	// We'll query the meta table later.
216	207	if ( 'meta' === $field ) {
		@@ -216,17 +207,11 @@
216	207	if ( 'meta' === $field ) {
217	208	continue;
218	209	}
219	210
220		- if ( ! in_array( $field, self::ALLOWED_FIELDS, true ) ) {
221		- continue;
222		- }
223		-
224	211	$selects[] = sprintf( "$wpdb->stream.%s", $field );
225	212	}
226		- }
227		-
228		- if ( empty( $selects ) ) {
	213	+ } else {
229	214	$selects[] = "$wpdb->stream.*";
230	215	}
231	216
232	217	$select = implode( ', ', $selects );