justingreerbbi / wordpress-oauth-server

This plugin is a full OAuth 2.0 authorization server/provider for WordPress. The goal of WP OAuth Server is to provide an easy to use authorization method that 3rd party platforms can use to securely authorize users from your WordPress site.
https://wp-oauth.com
98 stars 46 forks source link

Revise wo_ap_et_access_token_for_user #61

Open mrwpress opened 2 years ago

mrwpress commented 2 years ago

function wo_ap_et_access_token_for_user() { global $wpdb;

$current_user = get_current_user_id();
$check        = $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}oauth_access_tokens WHERE user_id ={$current_user}" );

return $check;

}

Needs to be:

function wo_ap_et_access_token_for_user() { global $wpdb;

$current_user = get_current_user_id();
$query        = "SELECT * FROM {$wpdb->prefix}oauth_access_tokens WHERE user_id = %d";
$query        = $wpdb->prepare( $query, $current_user );
return $wpdb->get_row( $query );

}

NOTE: The prepare() method of $wpdb ensures security of the query.

https://developer.wordpress.org/reference/classes/wpdb/prepare/