Merge branch 'develop' into release/3.16.2

impress-org · Sep 25, 2024 · 48006af · 48006af
2 parents cabf5a3 + f343437
commit 48006af
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/includes/donors/class-give-donors-query.php b/includes/donors/class-give-donors-query.php
@@ -481,14 +481,19 @@ private function get_order_query() {
 
 		// Create query.
 		foreach ( $ordersby as $orderby => $order ) {
+            /**
+             * @unreleased Prevent SQL Injection by not using the user defined order value directly in the query.
+             */
+            $sanitizedOrder = $order === 'ASC' ? 'ASC' : 'DESC';
+
 			switch ( $table_columns[ $orderby ] ) {
 				case '%d':
 				case '%f':
-					$query[] = "{$this->table_name}.{$orderby}+0 {$order}";
+					$query[] = "{$this->table_name}.{$orderby}+0 {$sanitizedOrder}";
 					break;
 
 				default:
-					$query[] = "{$this->table_name}.{$orderby} {$order}";
+					$query[] = "{$this->table_name}.{$orderby} {$sanitizedOrder}";
 			}
 		}