From bb95e4fe9e8779ea37562cc02f908f50e0eca752 Mon Sep 17 00:00:00 2001 From: Peter Wilson Date: Tue, 11 Jun 2024 02:31:13 +0000 Subject: [PATCH] Options, Meta APIs: Add SQL escaping to query loading 'all options'. Escapes the return value of `wp_autoload_values_to_autoload()` for use in the database query loading 'all options'. This is a hardening fix to protect against future changes to the options API which may allow developers to further customize the return value of the `wp_autoload_values_to_autoload` filter. Follow up to [57920]. Props peterwilsoncc, joemcgill. Fixes #42441. Built from https://develop.svn.wordpress.org/trunk@58380 git-svn-id: http://core.svn.wordpress.org/trunk@57829 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/option.php | 2 +- wp-includes/version.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/wp-includes/option.php b/wp-includes/option.php index 7cdf6ca4f6..c454e1119d 100644 --- a/wp-includes/option.php +++ b/wp-includes/option.php @@ -606,7 +606,7 @@ function wp_load_alloptions( $force_cache = false ) { if ( ! $alloptions ) { $suppress = $wpdb->suppress_errors(); - $alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE autoload IN ( '" . implode( "', '", wp_autoload_values_to_autoload() ) . "' )" ); + $alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE autoload IN ( '" . implode( "', '", esc_sql( wp_autoload_values_to_autoload() ) ) . "' )" ); if ( ! $alloptions_db ) { $alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options" ); diff --git a/wp-includes/version.php b/wp-includes/version.php index b843cf6c04..9056ceff05 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -16,7 +16,7 @@ * * @global string $wp_version */ -$wp_version = '6.6-beta1-58379'; +$wp_version = '6.6-beta1-58380'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.