← All changes | classes/class-query.php +3 -13 trunk → 4.0.2 View file →

		@@ -10,10 +10,8 @@
10	10	/**
11	11	* Class - Query
12	12	*/
13	13	class Query {
14		- const ALLOWED_FIELDS = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'created', 'summary', 'connector', 'context', 'action', 'ip' );
15		-
16	14	/**
17	15	* Hold the number of records found
18	16	*
19	17	* @var int
		@@ -59,9 +57,10 @@
59	57	if ( ! empty( $args['search'] ) ) {
60	58	$field = ! empty( $args['search_field'] ) ? $args['search_field'] : 'summary';
61	59
62	60	// Sanitize field.
63		- if ( in_array( $field, self::ALLOWED_FIELDS, true ) ) {
	61	+ $allowed_fields = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'created', 'summary', 'connector', 'context', 'action', 'ip' );
	62	+ if ( in_array( $field, $allowed_fields, true ) ) {
64	63	$where .= $wpdb->prepare( " AND $wpdb->stream.{$field} LIKE %s", "%{$args['search']}%" ); // @codingStandardsIgnoreLine can't prepare column name
65	64	}
66	65	}
67	66
		@@ -206,11 +205,8 @@
206	205	*/
207	206	$fields = (array) $args['fields'];
208	207	$selects = array();
209	208
210		- // Column names cannot be passed through $wpdb->prepare(), so restrict
211		- // the selectable fields to a known allowlist to prevent SQL injection
212		- // via the `fields` argument.
213	209	if ( ! empty( $fields ) ) {
214	210	foreach ( $fields as $field ) {
215	211	// We'll query the meta table later.
216	212	if ( 'meta' === $field ) {
		@@ -216,17 +212,11 @@
216	212	if ( 'meta' === $field ) {
217	213	continue;
218	214	}
219	215
220		- if ( ! in_array( $field, self::ALLOWED_FIELDS, true ) ) {
221		- continue;
222		- }
223		-
224	216	$selects[] = sprintf( "$wpdb->stream.%s", $field );
225	217	}
226		- }
227		-
228		- if ( empty( $selects ) ) {
	218	+ } else {
229	219	$selects[] = "$wpdb->stream.*";
230	220	}
231	221
232	222	$select = implode( ', ', $selects );