mirror of
git://develop.git.wordpress.org/
synced 2025-03-15 01:19:51 +01:00
Options, Meta APIs: Add SQL escaping to query loading 'all options'.
Escapes the return value of `wp_autoload_values_to_autoload()` for use in the database query loading 'all options'. This is a hardening fix to protect against future changes to the options API which may allow developers to further customize the return value of the `wp_autoload_values_to_autoload` filter. Follow up to [57920]. Props peterwilsoncc, joemcgill. Fixes #42441. git-svn-id: https://develop.svn.wordpress.org/trunk@58380 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
parent
8cd24bc12c
commit
9955b87bce
@ -606,7 +606,7 @@ function wp_load_alloptions( $force_cache = false ) {
|
||||
|
||||
if ( ! $alloptions ) {
|
||||
$suppress = $wpdb->suppress_errors();
|
||||
$alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE autoload IN ( '" . implode( "', '", wp_autoload_values_to_autoload() ) . "' )" );
|
||||
$alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE autoload IN ( '" . implode( "', '", esc_sql( wp_autoload_values_to_autoload() ) ) . "' )" );
|
||||
|
||||
if ( ! $alloptions_db ) {
|
||||
$alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options" );
|
||||
|
Loading…
x
Reference in New Issue
Block a user