Changeset 15013

Timestamp:

07/28/2026 04:04:37 PM (21 hours ago)

Author:

obenland

Message:

Login: Sanitize the per_page query argument in the pending registrations list table.

File:

• sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/admin/class-user-registrations-list-table.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/themes/pub/wporg-login/admin/class-user-registrations-list-table.php

@@ -292 +292 @@
                 }
 
-                $per_page     = $_GET['per_page'] ?? $this->get_items_per_page( 'users_per_page', 100 );
+                // Bounds match core's users_per_page screen option, see set_screen_options().
+                $per_page = isset( $_GET['per_page'] )
+                        ? min( 999, max( 1, absint( $_GET['per_page'] ) ) )
+                        : $this->get_items_per_page( 'users_per_page', 100 );
+
                 $current_page = $this->get_pagenum();
 
                 $join_where = $this->get_join_where_sql();
 
-                $per_page_offset = ($current_page-1) * $per_page;
+                $per_page_offset = ( $current_page - 1 ) * $per_page;
+
+                // Prepared separately; $join_where already contains prepared LIKE patterns.
+                $limit = $wpdb->prepare( 'LIMIT %d, %d', $per_page_offset, $per_page );
 
                 $this->items = $wpdb->get_results(
@@ -304 +311 @@
                         $join_where
                         ORDER BY {$sort_column} {$sort_order}
-                        LIMIT {$per_page_offset}, {$per_page}"
+                        $limit"
                 );