Security hardending. Prevent empty array search. wpsharks/comment-mai…

…l#85
wpsharks · Jun 5, 2015 · 9a7c9a7 · 9a7c9a7
1 parent d1795d3
commit 9a7c9a7
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/comment-mail-pro/includes/classes/sub-actions.php b/comment-mail-pro/includes/classes/sub-actions.php
@@ -208,4 +208,4 @@ protected function manage($request_args)
 			}
 		}
 	}
-}
+}
diff --git a/comment-mail-pro/includes/classes/utils-sub.php b/comment-mail-pro/includes/classes/utils-sub.php
@@ -535,8 +535,10 @@ public function delete_email_user_all($sub_email, array $args = array())
 				$user_ids = $this->email_user_ids($sub_email);
 
 				$sql = "SELECT `ID` FROM `".esc_sql($this->plugin->utils_db->prefix().'subs')."`".
-				       " WHERE `email` = '".esc_sql($sub_email)."' OR `user_id` IN('".implode("','", array_map('esc_sql', $user_ids))."')";
-
+				       " WHERE `email` = '".esc_sql($sub_email)."'".
+				       ($user_ids // Only if we DO have user IDs to search for here.
+				           ? " OR `user_id` IN('".implode("','", array_map('esc_sql', $user_ids))."')"
+						   : '');
 				$sub_ids = array_map('intval', $this->plugin->utils_db->wp->get_col($sql));
 
 				return $this->bulk_delete($sub_ids, $args);
@@ -1278,4 +1280,4 @@ public function nullify_cache(array $sub_ids_or_keys = array())
 			}
 		}
 	}
-}
+}
-Original file line number
+Diff line change
@@ Expand Up / @@ -208,4 +208,4 @@ protected function manage($request_args) @@
     			}
     		}
     	}
-    }
+    }