mirror_php/wordpress
1
0
Fork 0
mirror of git://develop.git.wordpress.org/ synced 2025-03-14 17:09:47 +01:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

Options, Meta APIs: Add SQL escaping to query loading 'all options'.

Browse Source 
Escapes the return value of `wp_autoload_values_to_autoload()` for use in the database query loading 'all options'. This is a hardening fix to protect against future changes to the options API which may allow developers to further customize the return value of the `wp_autoload_values_to_autoload` filter.

Follow up to [57920].

Props peterwilsoncc, joemcgill.
Fixes #42441.




git-svn-id: https://develop.svn.wordpress.org/trunk@58380 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Peter Wilson 2024-06-11 02:29:14 +00:00
parent 8cd24bc12c
commit 9955b87bce
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wp-includes/option.php
View File

@ -606,7 +606,7 @@ function wp_load_alloptions( $force_cache = false ) {
if ( ! $alloptions ) {
$suppress = $wpdb->suppress_errors();
$alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE autoload IN ( '" . implode( "', '", wp_autoload_values_to_autoload() ) . "' )" );
$alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE autoload IN ( '" . implode( "', '", esc_sql( wp_autoload_values_to_autoload() ) ) . "' )" );
if ( ! $alloptions_db ) {
$alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options" );