From a94b17f5536d93e5eb2b988e10f4d4af6255ee8c Mon Sep 17 00:00:00 2001 From: Immanuel Raj Date: Mon, 13 Jul 2026 19:54:41 +0530 Subject: [PATCH 1/5] Refactor gallery search query building Build the gallery search WHERE/JOIN clauses with $wpdb->prepare() and $wpdb->esc_like() instead of manual string concatenation, and drop the redundant decode of the already-decoded search parameter. No change to search behavior. --- .../controllers/template/rtmedia-filters.php | 28 ++++++++++--------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/app/main/controllers/template/rtmedia-filters.php b/app/main/controllers/template/rtmedia-filters.php index c6b5d569e..7fe5536d7 100644 --- a/app/main/controllers/template/rtmedia-filters.php +++ b/app/main/controllers/template/rtmedia-filters.php @@ -747,13 +747,15 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { if ( function_exists( 'rtmedia_media_search_enabled' ) && rtmedia_media_search_enabled() ) { + global $wpdb; + $raw_search = wp_unslash( filter_input( INPUT_GET, 'search', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ); if ( 'string' !== gettype( $raw_search ) ) { $raw_search = ''; } - $search = sanitize_text_field( urldecode( $raw_search ) ); + $search = sanitize_text_field( $raw_search ); $search_by = sanitize_text_field( wp_unslash( filter_input( INPUT_GET, 'search_by', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) ); $media_type = sanitize_text_field( wp_unslash( filter_input( INPUT_GET, 'media_type', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) ); $rtmedia_current_album = sanitize_text_field( wp_unslash( filter_input( INPUT_GET, 'rtmedia-current-album', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) ); @@ -770,17 +772,17 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { if ( ! empty( $search_by ) ) { if ( ! empty( $rtmedia_current_album ) ) { - $where .= " $table_name.album_id = '" . $rtmedia_current_album . "' AND "; + $where .= $wpdb->prepare( " $table_name.album_id = %s AND ", $rtmedia_current_album ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) { - $where .= " $table_name.media_type = '" . $media_type . "' AND "; + $where .= $wpdb->prepare( " $table_name.media_type = %s AND ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } if ( 'title' === $search_by ) { - $where .= " $table_name.media_title LIKE '%" . $search . "%' "; + $where .= $wpdb->prepare( " $table_name.media_title LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } elseif ( 'description' === $search_by ) { - $where .= " post_table.post_content LIKE '%" . $search . "%'"; + $where .= $wpdb->prepare( " post_table.post_content LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); } elseif ( 'author' === $search_by ) { if ( ! empty( $author_id ) ) { @@ -796,24 +798,24 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { } else { if ( ! empty( $rtmedia_current_album ) ) { - $where .= " $table_name.album_id = '" . $rtmedia_current_album . "' AND "; + $where .= $wpdb->prepare( " $table_name.album_id = %s AND ", $rtmedia_current_album ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) { - $where .= " $table_name.media_type = '" . $media_type . "' AND "; + $where .= $wpdb->prepare( " $table_name.media_type = %s AND ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } $where .= ' ( '; - $where .= " $table_name.media_title LIKE '%" . $search . "%' "; + $where .= $wpdb->prepare( " $table_name.media_title LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared if ( ! empty( $author_id ) ) { $where .= " OR $table_name.media_author IN (" . $author_id . ') '; } if ( ! empty( $member_type ) ) { $where .= " OR $table_name.media_author IN (" . $member_type . ') '; } - $where .= " OR post_table.post_content LIKE '%" . $search . "%'"; + $where .= $wpdb->prepare( " OR post_table.post_content LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); if ( empty( $media_type ) ) { - $where .= " OR $table_name.media_type = '" . $search . "' "; + $where .= $wpdb->prepare( " OR $table_name.media_type = %s ", $search ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } $where .= ' ) '; @@ -822,12 +824,12 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { // Reset data for album's media. if ( '' !== $search && ! empty( $rtmedia_current_album ) ) { - $where .= " AND $table_name.album_id = '" . $rtmedia_current_album . "' "; + $where .= $wpdb->prepare( " AND $table_name.album_id = %s ", $rtmedia_current_album ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } // Reset data for particular media type. if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) { - $where .= " AND $table_name.media_type = '" . $media_type . "' "; + $where .= $wpdb->prepare( " AND $table_name.media_type = %s ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } } // End if. } // End if. @@ -872,7 +874,7 @@ function rtmedia_search_fillter_join_query( $join, $table_name ) { $request_url = explode( '/', $request_uri ); if ( ! empty( $search_by ) && 'attribute' === $search_by && ! in_array( 'attribute', $request_url, true ) ) { $join .= " INNER JOIN $posts_table ON ( $posts_table.ID = $table_name.media_id AND $posts_table.post_type = '$media_type' ) - INNER JOIN $terms_table ON ( $terms_table.slug IN ('" . $search . "') ) + INNER JOIN $terms_table ON ( $terms_table.slug IN (" . $wpdb->prepare( '%s', $search ) . ") ) INNER JOIN $term_taxonomy_table ON ( $term_taxonomy_table.term_id = $terms_table.term_id ) INNER JOIN $term_relationships_table ON ( $term_relationships_table.term_taxonomy_id = $term_taxonomy_table.term_taxonomy_id AND $term_relationships_table.object_id = $posts_table.ID ) "; } From 26c20bb542cea14c8e2c8ee1eea16be79ec9fd81 Mon Sep 17 00:00:00 2001 From: Aashish Sharma Date: Wed, 15 Jul 2026 18:04:02 +0530 Subject: [PATCH 2/5] fix: improve album ID handling in search query for better SQL preparation --- app/main/controllers/template/rtmedia-filters.php | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/app/main/controllers/template/rtmedia-filters.php b/app/main/controllers/template/rtmedia-filters.php index 7fe5536d7..a5c5f1851 100644 --- a/app/main/controllers/template/rtmedia-filters.php +++ b/app/main/controllers/template/rtmedia-filters.php @@ -772,7 +772,7 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { if ( ! empty( $search_by ) ) { if ( ! empty( $rtmedia_current_album ) ) { - $where .= $wpdb->prepare( " $table_name.album_id = %s AND ", $rtmedia_current_album ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " $table_name.album_id = %d AND ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) { @@ -798,7 +798,7 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { } else { if ( ! empty( $rtmedia_current_album ) ) { - $where .= $wpdb->prepare( " $table_name.album_id = %s AND ", $rtmedia_current_album ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " $table_name.album_id = %d AND ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) { @@ -824,7 +824,7 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { // Reset data for album's media. if ( '' !== $search && ! empty( $rtmedia_current_album ) ) { - $where .= $wpdb->prepare( " AND $table_name.album_id = %s ", $rtmedia_current_album ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " AND $table_name.album_id = %d ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } // Reset data for particular media type. @@ -873,10 +873,13 @@ function rtmedia_search_fillter_join_query( $join, $table_name ) { $request_uri = rtm_get_server_var( 'REQUEST_URI', 'FILTER_SANITIZE_URL' ); $request_url = explode( '/', $request_uri ); if ( ! empty( $search_by ) && 'attribute' === $search_by && ! in_array( 'attribute', $request_url, true ) ) { - $join .= " INNER JOIN $posts_table ON ( $posts_table.ID = $table_name.media_id AND $posts_table.post_type = '$media_type' ) - INNER JOIN $terms_table ON ( $terms_table.slug IN (" . $wpdb->prepare( '%s', $search ) . ") ) + $join .= $wpdb->prepare( + " INNER JOIN $posts_table ON ( $posts_table.ID = $table_name.media_id AND $posts_table.post_type = '$media_type' ) + INNER JOIN $terms_table ON ( $terms_table.slug IN (%s) ) INNER JOIN $term_taxonomy_table ON ( $term_taxonomy_table.term_id = $terms_table.term_id ) - INNER JOIN $term_relationships_table ON ( $term_relationships_table.term_taxonomy_id = $term_taxonomy_table.term_taxonomy_id AND $term_relationships_table.object_id = $posts_table.ID ) "; + INNER JOIN $term_relationships_table ON ( $term_relationships_table.term_taxonomy_id = $term_taxonomy_table.term_taxonomy_id AND $term_relationships_table.object_id = $posts_table.ID ) ", + $search + ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } } } From 519550625ed630b2b53f0bb9dc4f76c4cfe1d29e Mon Sep 17 00:00:00 2001 From: Aashish Sharma Date: Wed, 15 Jul 2026 18:44:26 +0530 Subject: [PATCH 3/5] fix: enhance search query handling by improving type checks and SQL joins --- app/main/controllers/template/rtmedia-filters.php | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/app/main/controllers/template/rtmedia-filters.php b/app/main/controllers/template/rtmedia-filters.php index a5c5f1851..0c6d21b81 100644 --- a/app/main/controllers/template/rtmedia-filters.php +++ b/app/main/controllers/template/rtmedia-filters.php @@ -751,7 +751,7 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { $raw_search = wp_unslash( filter_input( INPUT_GET, 'search', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ); - if ( 'string' !== gettype( $raw_search ) ) { + if ( ! is_string( $raw_search ) ) { $raw_search = ''; } @@ -874,10 +874,11 @@ function rtmedia_search_fillter_join_query( $join, $table_name ) { $request_url = explode( '/', $request_uri ); if ( ! empty( $search_by ) && 'attribute' === $search_by && ! in_array( 'attribute', $request_url, true ) ) { $join .= $wpdb->prepare( - " INNER JOIN $posts_table ON ( $posts_table.ID = $table_name.media_id AND $posts_table.post_type = '$media_type' ) - INNER JOIN $terms_table ON ( $terms_table.slug IN (%s) ) + " INNER JOIN $posts_table ON ( $posts_table.ID = $table_name.media_id AND $posts_table.post_type = %s ) + INNER JOIN $terms_table ON ( $terms_table.slug = %s ) INNER JOIN $term_taxonomy_table ON ( $term_taxonomy_table.term_id = $terms_table.term_id ) INNER JOIN $term_relationships_table ON ( $term_relationships_table.term_taxonomy_id = $term_taxonomy_table.term_taxonomy_id AND $term_relationships_table.object_id = $posts_table.ID ) ", + $media_type, $search ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared } From 09c5a8a2151cf333e73c16a14f9f0b4e9395518a Mon Sep 17 00:00:00 2001 From: Aashish Sharma Date: Wed, 15 Jul 2026 19:01:06 +0530 Subject: [PATCH 4/5] fix: improve search query handling by ensuring user IDs and member types are sanitized --- app/main/controllers/template/rtmedia-filters.php | 3 +++ app/main/controllers/template/rtmedia-functions.php | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/app/main/controllers/template/rtmedia-filters.php b/app/main/controllers/template/rtmedia-filters.php index 0c6d21b81..4943ff5c1 100644 --- a/app/main/controllers/template/rtmedia-filters.php +++ b/app/main/controllers/template/rtmedia-filters.php @@ -764,6 +764,9 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { $author_id = rtm_select_user( $search ); $member_type = rtm_fetch_user_by_member_type( $search ); + $author_id = implode( ',', array_map( 'absint', array_filter( explode( ',', $author_id ) ) ) ); + $member_type = implode( ',', array_map( 'absint', array_filter( explode( ',', $member_type ) ) ) ); + if ( ! empty( $rtmedia_current_album ) ) { $where = ''; } diff --git a/app/main/controllers/template/rtmedia-functions.php b/app/main/controllers/template/rtmedia-functions.php index c25fe32c1..8642ef2a2 100644 --- a/app/main/controllers/template/rtmedia-functions.php +++ b/app/main/controllers/template/rtmedia-functions.php @@ -4324,7 +4324,7 @@ function rtm_select_user( $user ) { } } - $user_id = implode( ',', $user_ids ); + $user_id = implode( ',', array_map( 'absint', $user_ids ) ); return $user_id; } @@ -4357,7 +4357,7 @@ function rtm_fetch_user_by_member_type( $type ) { array_push( $member_id, bp_get_member_user_id() ); } } - $member_id = implode( ',', $member_id ); + $member_id = implode( ',', array_map( 'absint', $member_id ) ); } return $member_id; From b7d7a9f3e9065eb556ded8fa89dcf4a8d3cba961 Mon Sep 17 00:00:00 2001 From: Aashish Sharma Date: Wed, 15 Jul 2026 19:23:55 +0530 Subject: [PATCH 5/5] fix: improve search query handling by clarifying SQL preparation comments for trusted identifiers --- .../controllers/template/rtmedia-filters.php | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/app/main/controllers/template/rtmedia-filters.php b/app/main/controllers/template/rtmedia-filters.php index 4943ff5c1..75151d361 100644 --- a/app/main/controllers/template/rtmedia-filters.php +++ b/app/main/controllers/template/rtmedia-filters.php @@ -775,15 +775,15 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { if ( ! empty( $search_by ) ) { if ( ! empty( $rtmedia_current_album ) ) { - $where .= $wpdb->prepare( " $table_name.album_id = %d AND ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " $table_name.album_id = %d AND ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input. } if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) { - $where .= $wpdb->prepare( " $table_name.media_type = %s AND ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " $table_name.media_type = %s AND ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input. } if ( 'title' === $search_by ) { - $where .= $wpdb->prepare( " $table_name.media_title LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " $table_name.media_title LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input. } elseif ( 'description' === $search_by ) { $where .= $wpdb->prepare( " post_table.post_content LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); @@ -801,14 +801,14 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { } else { if ( ! empty( $rtmedia_current_album ) ) { - $where .= $wpdb->prepare( " $table_name.album_id = %d AND ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " $table_name.album_id = %d AND ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input. } if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) { - $where .= $wpdb->prepare( " $table_name.media_type = %s AND ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " $table_name.media_type = %s AND ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input. } $where .= ' ( '; - $where .= $wpdb->prepare( " $table_name.media_title LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " $table_name.media_title LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input. if ( ! empty( $author_id ) ) { $where .= " OR $table_name.media_author IN (" . $author_id . ') '; } @@ -818,7 +818,7 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { $where .= $wpdb->prepare( " OR post_table.post_content LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); if ( empty( $media_type ) ) { - $where .= $wpdb->prepare( " OR $table_name.media_type = %s ", $search ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " OR $table_name.media_type = %s ", $search ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input. } $where .= ' ) '; @@ -827,12 +827,12 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) { // Reset data for album's media. if ( '' !== $search && ! empty( $rtmedia_current_album ) ) { - $where .= $wpdb->prepare( " AND $table_name.album_id = %d ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " AND $table_name.album_id = %d ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input. } // Reset data for particular media type. if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) { - $where .= $wpdb->prepare( " AND $table_name.media_type = %s ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + $where .= $wpdb->prepare( " AND $table_name.media_type = %s ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input. } } // End if. } // End if. @@ -883,7 +883,7 @@ function rtmedia_search_fillter_join_query( $join, $table_name ) { INNER JOIN $term_relationships_table ON ( $term_relationships_table.term_taxonomy_id = $term_taxonomy_table.term_taxonomy_id AND $term_relationships_table.object_id = $posts_table.ID ) ", $media_type, $search - ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared + ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input. } } }