diff options
Diffstat (limited to 'src/wp-includes/date.php')
| -rw-r--r-- | src/wp-includes/date.php | 23 |
1 files changed, 21 insertions, 2 deletions
diff --git a/src/wp-includes/date.php b/src/wp-includes/date.php index 96a784e58d..c6b3e65432 100644 --- a/src/wp-includes/date.php +++ b/src/wp-includes/date.php @@ -151,8 +151,8 @@ class WP_Date_Query { * 'comment_date', 'comment_date_gmt'. */ public function __construct( $date_query, $default_column = 'post_date' ) { - if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] ) ) { - $this->relation = 'OR'; + if ( isset( $date_query['relation'] ) ) { + $this->relation = $this->sanitize_relation( $date_query['relation'] ); } else { $this->relation = 'AND'; } @@ -232,6 +232,9 @@ class WP_Date_Query { $this->validate_date_values( $queries ); } + // Sanitize the relation parameter. + $queries['relation'] = $this->sanitize_relation( $queries['relation'] ); + foreach ( $queries as $key => $q ) { if ( ! is_array( $q ) || in_array( $key, $this->time_keys, true ) ) { // This is a first-order query. Trust the values and sanitize when building SQL. @@ -1017,4 +1020,20 @@ class WP_Date_Query { return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time ); } + + /** + * Sanitizes a 'relation' operator. + * + * @since 6.0.3 + * + * @param string $relation Raw relation key from the query argument. + * @return string Sanitized relation ('AND' or 'OR'). + */ + public function sanitize_relation( $relation ) { + if ( 'OR' === strtoupper( $relation ) ) { + return 'OR'; + } else { + return 'AND'; + } + } } |