[wp-trac] [WordPress Trac] #56311: Week query variable is not being sanitized correctly

[WordPress Trac]

#56311: Week query variable is not being sanitized correctly
---------------------------+------------------------------
 Reporter:  domainsupport  |       Owner:  audrasjb
     Type:  defect (bug)   |      Status:  assigned
 Priority:  normal         |   Milestone:  Awaiting Review
Component:  Query          |     Version:
 Severity:  normal         |  Resolution:
 Keywords:                 |     Focuses:
---------------------------+------------------------------

Comment (by domainsupport):

 Actually I've just seen that the `$_GET` keys don't all match the
 `$date_query` keys so actually that wouldn't work. I suggest replacing
 lines 387 -> 391 of `/wp-includes/class-wp-date-query.php` with this
 instead ... ?

 {{{#!php
 <?php
                 $date_variable_keys = array(
                         'month' => 'monthnum',
                         'week' => 'w',
                         'day' => 'day',
                         'hour' => 'hour',
                         'minute' => 'minute',
                         'second' => 'second'
                 );

                 // Concatenate and throw a notice for each invalid value.
                 foreach ( $min_max_checks as $key => $check ) {
                         if (
                                 ( isset($date_variable_keys[$key]) && !
 isset($_GET[$date_variable_keys[$key]]) ) ||
                                 ! array_key_exists( $key, $date_query )
                         ) {
                                 continue;
                         }
 }}}

 If that's acceptable I can produce a patch ... ?

 Thanks,

 Oliver

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/56311#comment:8>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform