sanitize all short code attributes

gigpress.php

@@ -404,6 +404,16 @@ function gigpress_prepare( $show, $scope = 'public' ) {
 }
 
 
+function gigpress_sanitize_sort($sort_value, $default = false, $safe_values = array('asc', 'desc')) {
+    if (!in_array($sort_value, $safe_values, true)) {
+        // DEBUG
+        debug_log('hui, seems, to have an SQL injection attempt here? "'. $sort_value . '"');
+        return $default;
+    }
+    return $sort_value;
+}
+
+
 function gigpress_related_link( $postid, $format) {
 
 	if ( $postid == 0 ) return;

output/gigpress_related.php

@@ -17,6 +17,8 @@ function gigpress_show_related($args = array(), $content = '') {
 			'sort' => 'asc'
 		), $args));
 
+		$sort = gigpress_sanitize_sort($sort, $default = 'asc');
+
 		// Date conditionals based on scope
 		switch($scope) {
 			case 'upcoming':

output/gigpress_shows.php

@@ -44,6 +44,8 @@ function gigpress_shows( $filter = null, $content = null ) {
 		), $filter )
 	);
 
+	$sort = gigpress_sanitize_sort($sort);
+
 	$total_artists = $wpdb->get_var( "SELECT count(*) from " . GIGPRESS_ARTISTS );
 
 	// Date conditionals and sorting based on scope
@@ -347,6 +349,8 @@ function gigpress_menu( $options = null ) {
 		'sort'       => 'desc',
 	), $options ) );
 
+	$sort = gigpress_sanitize_sort($sort, $default='desc');
+
 	$base .= ( strpos( $base, '?' ) === false ) ? '?' : '&';
 
 	// Date conditionals based on scope