diff --git a/projects/plugins/jetpack/changelog/update-infinite-scroll-added-checks-to-validate-input b/projects/plugins/jetpack/changelog/update-infinite-scroll-added-checks-to-validate-input new file mode 100644 index 0000000000000..2e67749a78c15 --- /dev/null +++ b/projects/plugins/jetpack/changelog/update-infinite-scroll-added-checks-to-validate-input @@ -0,0 +1,4 @@ +Significance: minor +Type: other + +Infinite-scroll: Added isset checks to validate input data diff --git a/projects/plugins/jetpack/modules/infinite-scroll/infinity.php b/projects/plugins/jetpack/modules/infinite-scroll/infinity.php index 52929d303b48d..f56fdd98231c4 100644 --- a/projects/plugins/jetpack/modules/infinite-scroll/infinity.php +++ b/projects/plugins/jetpack/modules/infinite-scroll/infinity.php @@ -753,11 +753,12 @@ public function query_time_filter( $where, $query ) { $sort_field = self::get_query_sort_field( $query ); - if ( 'post_date' !== $sort_field || 'DESC' !== $_REQUEST['query_args']['order'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated -- no changes made to the site. + if ( 'post_date' !== $sort_field || + ! isset( $_REQUEST['query_args']['order'] ) || 'DESC' !== $_REQUEST['query_args']['order'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- no changes made to the site. return $where; } - $query_before = sanitize_text_field( wp_unslash( $_REQUEST['query_before'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated -- no changes made to the site. + $query_before = isset( $_REQUEST['query_before'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['query_before'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- no changes made to the site. if ( empty( $query_before ) ) { return $where; @@ -771,6 +772,8 @@ public function query_time_filter( $where, $query ) { * will always return results prior to (descending sort) * or before (ascending sort) the last post date. * + * @deprecated $$next-version$$ + * * @module infinite-scroll * * @param string $clause SQL Date query. @@ -778,9 +781,9 @@ public function query_time_filter( $where, $query ) { * @param string $operator @deprecated Query operator. * @param string $last_post_date @deprecated Last Post Date timestamp. */ - $operator = 'ASC' === $_REQUEST['query_args']['order'] ? '>' : '<'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated -- no changes to the site. - $last_post_date = sanitize_text_field( wp_unslash( $_REQUEST['last_post_date'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotValidated -- no changes to the site. - $where .= apply_filters( 'infinite_scroll_posts_where', $clause, $query, $operator, $last_post_date ); + $operator = '<'; + $last_post_date = isset( $_REQUEST['last_post_date'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['last_post_date'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- no changes to the site + $where .= apply_filters_deprecated( 'infinite_scroll_posts_where', array( $clause, $query, $operator, $last_post_date ), '$$next-version$$', '' ); } return $where;