{"action":"created","issue":{"url":"https://api.github.com/repos/concrete5/concrete5-5.7.0/issues/1993","labels_url":"https://api.github.com/repos/concrete5/concrete5-5.7.0/issues/1993/labels{/name}","comments_url":"https://api.github.com/repos/concrete5/concrete5-5.7.0/issues/1993/comments","events_url":"https://api.github.com/repos/concrete5/concrete5-5.7.0/issues/1993/events","html_url":"https://github.com/concrete5/concrete5-5.7.0/pull/1993","id":58387853,"number":1993,"title":"More options for ItemList sorting","user":{"login":"EC-Joe","id":1292766,"avatar_url":"https://avatars.githubusercontent.com/u/1292766?v=3","gravatar_id":"","url":"https://api.github.com/users/EC-Joe","html_url":"https://github.com/EC-Joe","followers_url":"https://api.github.com/users/EC-Joe/followers","following_url":"https://api.github.com/users/EC-Joe/following{/other_user}","gists_url":"https://api.github.com/users/EC-Joe/gists{/gist_id}","starred_url":"https://api.github.com/users/EC-Joe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EC-Joe/subscriptions","organizations_url":"https://api.github.com/users/EC-Joe/orgs","repos_url":"https://api.github.com/users/EC-Joe/repos","events_url":"https://api.github.com/users/EC-Joe/events{/privacy}","received_events_url":"https://api.github.com/users/EC-Joe/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-20T17:57:49Z","updated_at":"2015-02-20T18:36:50Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/concrete5/concrete5-5.7.0/pulls/1993","html_url":"https://github.com/concrete5/concrete5-5.7.0/pull/1993","diff_url":"https://github.com/concrete5/concrete5-5.7.0/pull/1993.diff","patch_url":"https://github.com/concrete5/concrete5-5.7.0/pull/1993.patch"},"body":"Attempts to allow the existing sortBy to do less restrictive query building for developers and adds a new sanitizedSortBy function to accommodate user input in the Database ItemList\r\n\r\nThis is in response to the previous pull request #1771.\r\n\r\nI didn't to a ton of extensive testing on this. Mostly it should be ok but i'm not sure if the 'rand()' string is actually being passed as user input or if that's parsed out somewhere else. Notice that I removed that exception to the rule with the thought that if someone wanted to leverage that they would use the `sortBy` instead of the `sanitizedSortBy` function. Obviously if that's user input though we'll need to add it back into the sanitizedSortBy checks.\r\n\r\nGive it a good read through and let me know if there's any feedback."},"comment":{"url":"https://api.github.com/repos/concrete5/concrete5-5.7.0/issues/comments/75294529","html_url":"https://github.com/concrete5/concrete5-5.7.0/pull/1993#issuecomment-75294529","issue_url":"https://api.github.com/repos/concrete5/concrete5-5.7.0/issues/1993","id":75294529,"user":{"login":"EC-Joe","id":1292766,"avatar_url":"https://avatars.githubusercontent.com/u/1292766?v=3","gravatar_id":"","url":"https://api.github.com/users/EC-Joe","html_url":"https://github.com/EC-Joe","followers_url":"https://api.github.com/users/EC-Joe/followers","following_url":"https://api.github.com/users/EC-Joe/following{/other_user}","gists_url":"https://api.github.com/users/EC-Joe/gists{/gist_id}","starred_url":"https://api.github.com/users/EC-Joe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EC-Joe/subscriptions","organizations_url":"https://api.github.com/users/EC-Joe/orgs","repos_url":"https://api.github.com/users/EC-Joe/repos","events_url":"https://api.github.com/users/EC-Joe/events{/privacy}","received_events_url":"https://api.github.com/users/EC-Joe/received_events","type":"User","site_admin":false},"created_at":"2015-02-20T18:36:50Z","updated_at":"2015-02-20T18:36:50Z","body":">Nice, so if I'm looking at this right, it's just making sure that any sorting that happens through user-provided input – automatic sorting based on keys, etc... – gets run through sanitizedSortyBy – but if you're just writing a query yourself as a developer, you can just sortBy() and it'll just pass through exactly what you want ? (e.g. $this->sortBy('rand()') ?\r\n\r\nExactly my intentions."}}