Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 6b7e278

Browse filesBrowse files
ryanborenryanboren
committed
Move some query var sanitization up to parse_query() and make sure the sanitized values are avilable via get_query_var().
git-svn-id: https://develop.svn.wordpress.org/trunk@5002 602fd350-edb4-49c9-b593-d223f7449a82
1 parent aeda207 commit 6b7e278
Copy full SHA for 6b7e278

File tree

Expand file treeCollapse file tree

1 file changed

+68
-92
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

1 file changed

+68
-92
lines changed
Open diff view settings
Collapse file

‎wp-includes/query.php‎

Copy file name to clipboardExpand all lines: wp-includes/query.php
+68-92Lines changed: 68 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -404,14 +404,14 @@ function parse_query ($query) {
404404
if ( !empty($query) || !isset($this->query) ) {
405405
$this->init();
406406
if ( is_array($query) )
407-
$qv = & $query;
407+
$this->query_vars = $query;
408408
else
409-
parse_str($query, $qv);
409+
parse_str($query, $this->query_vars);
410410
$this->query = $query;
411-
$this->query_vars = $qv;
412411
}
413412

414-
$qv = $this->fill_query_vars($qv);
413+
$this->query_vars = $this->fill_query_vars($this->query_vars);
414+
$qv = &$this->query_vars;
415415

416416
if ( ! empty($qv['robots']) ) {
417417
$this->is_robots = true;
@@ -426,71 +426,81 @@ function parse_query ($query) {
426426
return;
427427
}
428428

429-
$qv['m'] = (int) $qv['m'];
430429
$qv['p'] = (int) $qv['p'];
430+
$qv['page_id'] = (int) $qv['page_id'];
431+
$qv['year'] = (int) $qv['year'];
432+
$qv['monthnum'] = (int) $qv['monthnum'];
433+
$qv['day'] = (int) $qv['day'];
434+
$qv['w'] = (int) $qv['w'];
435+
$qv['m'] = (int) $qv['m'];
436+
if ( '' != $qv['hour'] ) $qv['hour'] = (int) $qv['hour'];
437+
if ( '' != $qv['minute'] ) $qv['minute'] = (int) $qv['minute'];
438+
if ( '' != $qv['second'] ) $qv['second'] = (int) $qv['second'];
431439

432440
// Compat. Map subpost to attachment.
433441
if ( '' != $qv['subpost'] )
434442
$qv['attachment'] = $qv['subpost'];
435443
if ( '' != $qv['subpost_id'] )
436444
$qv['attachment_id'] = $qv['subpost_id'];
437445

438-
if ( ('' != $qv['attachment']) || (int) $qv['attachment_id'] ) {
446+
$qv['attachment_id'] = (int) $qv['attachment_id'];
447+
448+
if ( ('' != $qv['attachment']) || !empty($qv['attachment_id']) ) {
439449
$this->is_single = true;
440450
$this->is_attachment = true;
441-
} elseif ('' != $qv['name']) {
451+
} elseif ( '' != $qv['name'] ) {
442452
$this->is_single = true;
443453
} elseif ( $qv['p'] ) {
444454
$this->is_single = true;
445-
} elseif (('' != $qv['hour']) && ('' != $qv['minute']) &&('' != $qv['second']) && ('' != $qv['year']) && ('' != $qv['monthnum']) && ('' != $qv['day'])) {
455+
} elseif ( ('' != $qv['hour']) && ('' != $qv['minute']) &&('' != $qv['second']) && ('' != $qv['year']) && ('' != $qv['monthnum']) && ('' != $qv['day']) ) {
446456
// If year, month, day, hour, minute, and second are set, a single
447457
// post is being queried.
448458
$this->is_single = true;
449-
} elseif ('' != $qv['static'] || '' != $qv['pagename'] || (int) $qv['page_id']) {
459+
} elseif ( '' != $qv['static'] || '' != $qv['pagename'] || !empty($qv['page_id']) ) {
450460
$this->is_page = true;
451461
$this->is_single = false;
452-
} elseif (!empty($qv['s'])) {
462+
} elseif ( !empty($qv['s']) ) {
453463
$this->is_search = true;
454464
} else {
455465
// Look for archive queries. Dates, categories, authors.
456466

457-
if ( (int) $qv['second']) {
467+
if ( '' != $qv['second'] ) {
458468
$this->is_time = true;
459469
$this->is_date = true;
460470
}
461471

462-
if ( (int) $qv['minute']) {
472+
if ( '' != $qv['minute'] ) {
463473
$this->is_time = true;
464474
$this->is_date = true;
465475
}
466476

467-
if ( (int) $qv['hour']) {
477+
if ( '' != $qv['hour'] ) {
468478
$this->is_time = true;
469479
$this->is_date = true;
470480
}
471481

472-
if ( (int) $qv['day']) {
482+
if ( $qv['day'] ) {
473483
if (! $this->is_date) {
474484
$this->is_day = true;
475485
$this->is_date = true;
476486
}
477487
}
478488

479-
if ( (int) $qv['monthnum']) {
489+
if ( $qv['monthnum'] ) {
480490
if (! $this->is_date) {
481491
$this->is_month = true;
482492
$this->is_date = true;
483493
}
484494
}
485495

486-
if ( (int) $qv['year']) {
496+
if ( $qv['year'] ) {
487497
if (! $this->is_date) {
488498
$this->is_year = true;
489499
$this->is_date = true;
490500
}
491501
}
492502

493-
if ( (int) $qv['m']) {
503+
if ( $qv['m'] ) {
494504
$this->is_date = true;
495505
if (strlen($qv['m']) > 9) {
496506
$this->is_time = true;
@@ -507,7 +517,7 @@ function parse_query ($query) {
507517
$this->is_date = true;
508518
}
509519

510-
if (empty($qv['cat']) || ($qv['cat'] == '0')) {
520+
if ( empty($qv['cat']) || ($qv['cat'] == '0') ) {
511521
$this->is_category = false;
512522
} else {
513523
if (strpos($qv['cat'], '-') !== false) {
@@ -517,52 +527,45 @@ function parse_query ($query) {
517527
}
518528
}
519529

520-
if ('' != $qv['category_name']) {
530+
if ( '' != $qv['category_name'] ) {
521531
$this->is_category = true;
522532
}
523533

524-
if ((empty($qv['author'])) || ($qv['author'] == '0')) {
534+
if ( empty($qv['author']) || ($qv['author'] == '0') ) {
525535
$this->is_author = false;
526536
} else {
527537
$this->is_author = true;
528538
}
529539

530-
if ('' != $qv['author_name']) {
540+
if ( '' != $qv['author_name'] ) {
531541
$this->is_author = true;
532542
}
533543

534-
if ( ($this->is_date || $this->is_author || $this->is_category)) {
544+
if ( ($this->is_date || $this->is_author || $this->is_category) )
535545
$this->is_archive = true;
536-
}
537546
}
538547

539-
if ('' != $qv['feed']) {
548+
if ( '' != $qv['feed'] )
540549
$this->is_feed = true;
541-
}
542550

543-
if ('' != $qv['tb']) {
551+
if ( '' != $qv['tb'] )
544552
$this->is_trackback = true;
545-
}
546553

547-
if ('' != $qv['paged']) {
554+
if ( '' != $qv['paged'] )
548555
$this->is_paged = true;
549-
}
550556

551-
if ('' != $qv['comments_popup']) {
557+
if ( '' != $qv['comments_popup'] )
552558
$this->is_comments_popup = true;
553-
}
554559

555-
//if we're previewing inside the write screen
556-
if ('' != $qv['preview']) {
560+
// if we're previewing inside the write screen
561+
if ('' != $qv['preview'])
557562
$this->is_preview = true;
558-
}
559563

560-
if (strpos($_SERVER['PHP_SELF'], 'wp-admin/') !== false) {
564+
if ( strpos($_SERVER['PHP_SELF'], 'wp-admin/') !== false )
561565
$this->is_admin = true;
562-
}
563566

564567
if ( false !== strpos($qv['feed'], 'comments-') ) {
565-
$this->query_vars['feed'] = $qv['feed'] = str_replace('comments-', '', $qv['feed']);
568+
$qv['feed'] = str_replace('comments-', '', $qv['feed']);
566569
$qv['withcomments'] = 1;
567570
}
568571

@@ -571,15 +574,14 @@ function parse_query ($query) {
571574
if ( $this->is_feed && ( !empty($qv['withcomments']) || ( empty($qv['withoutcomments']) && $this->is_singular ) ) )
572575
$this->is_comment_feed = true;
573576

574-
if ( !( $this->is_singular || $this->is_archive || $this->is_search || $this->is_feed || $this->is_trackback || $this->is_404 || $this->is_admin || $this->is_comments_popup ) ) {
577+
if ( !( $this->is_singular || $this->is_archive || $this->is_search || $this->is_feed || $this->is_trackback || $this->is_404 || $this->is_admin || $this->is_comments_popup ) )
575578
$this->is_home = true;
576-
}
577579

578580
// Correct is_* for page_on_front and page_for_posts
579581
if ( $this->is_home && ( empty($this->query) || $qv['preview'] == 'true' ) && 'page' == get_option('show_on_front') && get_option('page_on_front') ) {
580582
$this->is_page = true;
581583
$this->is_home = false;
582-
$this->query_vars['page_id'] = get_option('page_on_front');
584+
$qv['page_id'] = get_option('page_on_front');
583585
}
584586

585587
if ( '' != $qv['pagename'] ) {
@@ -596,8 +598,7 @@ function parse_query ($query) {
596598
}
597599
}
598600

599-
if ( '' != $qv['page_id'] && 0 != intval($qv['page_id']) ) {
600-
$this->query_vars['page_id'] = intval($qv['page_id']);
601+
if ( $qv['page_id'] ) {
601602
if ( 'page' == get_option('show_on_front') && $qv['page_id'] == get_option('page_for_posts') ) {
602603
$this->is_page = false;
603604
$this->is_home = true;
@@ -611,9 +612,8 @@ function parse_query ($query) {
611612
$this->is_singular = $this->is_single || $this->is_page || $this->is_attachment;
612613
// Done correcting is_* for page_on_front and page_for_posts
613614

614-
if ( !empty($query) ) {
615+
if ( !empty($query) )
615616
do_action_ref_array('parse_query', array(&$this));
616-
}
617617
}
618618

619619
function set_404() {
@@ -704,7 +704,7 @@ function &get_posts() {
704704
$wp_posts_post_date_field = "post_date"; // "DATE_ADD(post_date, INTERVAL '$add_hours:$add_minutes' HOUR_MINUTE)";
705705

706706
// If a month is specified in the querystring, load that month
707-
if ( (int) $q['m'] ) {
707+
if ( $q['m'] ) {
708708
$q['m'] = '' . preg_replace('|[^0-9]|', '', $q['m']);
709709
$where .= ' AND YEAR(post_date)=' . substr($q['m'], 0, 4);
710710
if (strlen($q['m'])>5)
@@ -719,41 +719,23 @@ function &get_posts() {
719719
$where .= ' AND SECOND(post_date)=' . substr($q['m'], 12, 2);
720720
}
721721

722-
if ( (int) $q['hour'] ) {
723-
$q['hour'] = '' . intval($q['hour']);
722+
if ( '' != $q['hour'] )
724723
$where .= " AND HOUR(post_date)='" . $q['hour'] . "'";
725-
}
726724

727-
if ( (int) $q['minute'] ) {
728-
$q['minute'] = '' . intval($q['minute']);
725+
if ( '' != $q['minute'] )
729726
$where .= " AND MINUTE(post_date)='" . $q['minute'] . "'";
730-
}
731727

732-
if ( (int) $q['second'] ) {
733-
$q['second'] = '' . intval($q['second']);
728+
if ( '' != $q['second'] )
734729
$where .= " AND SECOND(post_date)='" . $q['second'] . "'";
735-
}
736730

737-
if ( (int) $q['year'] ) {
738-
$q['year'] = '' . intval($q['year']);
731+
if ( $q['year'] )
739732
$where .= " AND YEAR(post_date)='" . $q['year'] . "'";
740-
}
741733

742-
if ( (int) $q['monthnum'] ) {
743-
$q['monthnum'] = '' . intval($q['monthnum']);
734+
if ( $q['monthnum'] )
744735
$where .= " AND MONTH(post_date)='" . $q['monthnum'] . "'";
745-
}
746736

747-
if ( (int) $q['day'] ) {
748-
$q['day'] = '' . intval($q['day']);
737+
if ( $q['day'] )
749738
$where .= " AND DAYOFMONTH(post_date)='" . $q['day'] . "'";
750-
}
751-
752-
// Compat. Map subpost to attachment.
753-
if ( '' != $q['subpost'] )
754-
$q['attachment'] = $q['subpost'];
755-
if ( '' != $q['subpost_id'] )
756-
$q['attachment_id'] = $q['subpost_id'];
757739

758740
if ('' != $q['name']) {
759741
$q['name'] = sanitize_title($q['name']);
@@ -784,34 +766,29 @@ function &get_posts() {
784766
$where .= " AND post_name = '" . $q['attachment'] . "'";
785767
}
786768

787-
if ( (int) $q['w'] ) {
788-
$q['w'] = ''.intval($q['w']);
769+
if ( $q['w'] )
789770
$where .= " AND WEEK(post_date, 1)='" . $q['w'] . "'";
790-
}
791771

792772
if ( intval($q['comments_popup']) )
793773
$q['p'] = intval($q['comments_popup']);
794774

795-
// If a attachment is requested by number, let it supercede any post number.
796-
if ( ($q['attachment_id'] != '') && (intval($q['attachment_id']) != 0) )
797-
$q['p'] = (int) $q['attachment_id'];
775+
// If an attachment is requested by number, let it supercede any post number.
776+
if ( $q['attachment_id'] )
777+
$q['p'] = $q['attachment_id'];
798778

799779
// If a post number is specified, load that post
800-
if (($q['p'] != '') && intval($q['p']) != 0) {
801-
$q['p'] = (int) $q['p'];
780+
if ( $q['p'] )
802781
$where = ' AND ID = ' . $q['p'];
803-
}
804782

805-
if (($q['page_id'] != '') && (intval($q['page_id']) != 0)) {
806-
$q['page_id'] = intval($q['page_id']);
783+
if ( $q['page_id'] ) {
807784
if ( ('page' != get_option('show_on_front') ) || ( $q['page_id'] != get_option('page_for_posts') ) ) {
808785
$q['p'] = $q['page_id'];
809-
$where = ' AND ID = '.$q['page_id'];
786+
$where = ' AND ID = ' . $q['page_id'];
810787
}
811788
}
812789

813790
// If a search pattern is specified, load the posts that match
814-
if (!empty($q['s'])) {
791+
if ( !empty($q['s']) ) {
815792
// added slashes screw with quote grouping when done early, so done later
816793
$q['s'] = stripslashes($q['s']);
817794
if ($q['sentence']) {
@@ -838,10 +815,10 @@ function &get_posts() {
838815

839816
// Category stuff
840817

841-
if ((empty($q['cat'])) || ($q['cat'] == '0') ||
818+
if ( empty($q['cat']) || ($q['cat'] == '0') ||
842819
// Bypass cat checks if fetching specific posts
843-
( $this->is_single || $this->is_page )) {
844-
$whichcat='';
820+
$this->is_singular ) {
821+
$whichcat = '';
845822
} else {
846823
$q['cat'] = ''.urldecode($q['cat']).'';
847824
$q['cat'] = addslashes_gpc($q['cat']);
@@ -878,7 +855,7 @@ function &get_posts() {
878855
}
879856

880857
// Category stuff for nice URLs
881-
if ('' != $q['category_name']) {
858+
if ( '' != $q['category_name'] ) {
882859
$reqcat = get_category_by_path($q['category_name']);
883860
$q['category_name'] = str_replace('%2F', '/', urlencode(urldecode($q['category_name'])));
884861
$cat_paths = '/' . trim($q['category_name'], '/');
@@ -913,7 +890,7 @@ function &get_posts() {
913890

914891
// Author/user stuff
915892

916-
if ((empty($q['author'])) || ($q['author'] == '0')) {
893+
if ( empty($q['author']) || ($q['author'] == '0') ) {
917894
$whichauthor='';
918895
} else {
919896
$q['author'] = ''.urldecode($q['author']).'';
@@ -953,12 +930,11 @@ function &get_posts() {
953930

954931
$where .= $search.$whichcat.$whichauthor;
955932

956-
if ((empty($q['order'])) || ((strtoupper($q['order']) != 'ASC') && (strtoupper($q['order']) != 'DESC'))) {
957-
$q['order']='DESC';
958-
}
933+
if ( empty($q['order']) || ((strtoupper($q['order']) != 'ASC') && (strtoupper($q['order']) != 'DESC')) )
934+
$q['order'] = 'DESC';
959935

960936
// Order by
961-
if (empty($q['orderby'])) {
937+
if ( empty($q['orderby']) ) {
962938
$q['orderby'] = 'post_date '.$q['order'];
963939
} else {
964940
// Used to filter values
@@ -1014,7 +990,7 @@ function &get_posts() {
1014990
$join = apply_filters('posts_join', $join);
1015991

1016992
// Paging
1017-
if (empty($q['nopaging']) && !$this->is_singular) {
993+
if ( empty($q['nopaging']) && !$this->is_singular ) {
1018994
$page = abs(intval($q['paged']));
1019995
if (empty($page)) {
1020996
$page = 1;

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.