| @@ -571,12 +571,21 @@ | ||
| 571 | 571 | * @return array |
| 572 | 572 | */ |
| 573 | 573 | public static function agent_autocomplete( $filters ) { |
| 574 | 574 | |
| 575 | + // Whitelisted map of accepted sort_by values to actual DB columns - only | |
| 576 | + // the two options offered in the sort-by dropdown are valid here. | |
| 577 | + $sortable_columns = array( | |
| 578 | + 'name' => 'name', | |
| 579 | + 'workload' => 'workload', | |
| 580 | + ); | |
| 581 | + $orderby = isset( $sortable_columns[ $filters['sort_by'] ] ) ? | |
| 582 | + $sortable_columns[ $filters['sort_by'] ] : 'name'; | |
| 583 | + | |
| 575 | 584 | $args = array( |
| 576 | 585 | 'search' => $filters['term'], |
| 577 | 586 | 'items_per_page' => 25, |
| 578 | - 'orderby' => $filters['sort_by'], | |
| 587 | + 'orderby' => $orderby, | |
| 579 | 588 | 'order' => 'ASC', |
| 580 | 589 | 'meta_query' => array( |
| 581 | 590 | 'relation' => 'AND', |
| 582 | 591 | array( |
