Stats: cast post IDs to integers when building the post views query - #51049
Conversation
On Simple sites the post-views path built its SQL IN (...) list from the caller-supplied post IDs after passing them through esc_sql(), which does not constrain a value to an integer. Cast each post ID with absint() at both the query-building sink (jetpack-stats) and the quick-edit AJAX source (jetpack-stats-admin) so only integers are used.
|
Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.
Interested in more tips and information?
|
|
Thank you for your PR! When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:
This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖 Follow this PR Review Process:
If you have questions about anything, reach out in #jetpack-developers for guidance! |
Code Coverage SummaryThis PR did not change code coverage! That could be good or bad, depending on the situation. Everything covered before, and still is? Great! Nothing was covered before? Not so great. 🤷 |
Proposed changes
absint()before they are used in the post views query — in both thejetpack-statsquery builder and thejetpack-stats-adminquick-edit handler.Does this pull request change what data or activity we track or use?
No.
Testing instructions
jp test php packages/statsandjp test php packages/stats-admin— all tests pass.