Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove hardcoded reference to posts table #21

Open
paulvanbuuren opened this issue May 20, 2021 · 0 comments
Open

Remove hardcoded reference to posts table #21

paulvanbuuren opened this issue May 20, 2021 · 0 comments

Comments

@paulvanbuuren
Copy link

in od/includes/hooks-setup.php, line 69 and od/includes/utils.php, line 82 an attempt is made to select a record from table 'od_posts'. This table would not exist in standard WordPress installations, as it implies that the WP installation uses 'od_' as a table prefix. Using a fixed table prefix is bad for security and using a hardcoded table name makes the theme inflexible.

Suggested fix:
replace
$oPost = $wpdb->get_row("SELECT post_name FROM od_posts WHERE post_name = '".$sPageSlug."'");
with
$oPost = $wpdb->get_row( "SELECT post_name FROM $wpdb->posts WHERE post_name = '" . sanitize_title( $sPageSlug ) . "'" );

paulvanbuuren added a commit to paulvanbuuren/isoc2017-wp that referenced this issue May 20, 2021
@paulvanbuuren paulvanbuuren changed the title Remove hardcode table references Remove hardcoded reference to posts table May 20, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant