Merge pull request #9607 from yashodha/update-year

[civicrm-core.git] / CRM / Core / Page / AJAX.php

diff --git a/CRM/Core/Page/AJAX.php b/CRM/Core/Page/AJAX.php
index d99e2b19ac564afa141716d2cf68c6bb0fd69284..8d6add8e283105d8cfedc8199769e9e88d1ecfc0 100644 (file)
--- a/CRM/Core/Page/AJAX.php
+++ b/CRM/Core/Page/AJAX.php
@@ -3,7 +3,7 @@
  +--------------------------------------------------------------------+
  | CiviCRM version 4.7                                                |
  +--------------------------------------------------------------------+
- | Copyright CiviCRM LLC (c) 2004-2016                                |
+ | Copyright CiviCRM LLC (c) 2004-2017                                |
  +--------------------------------------------------------------------+
  | This file is a part of CiviCRM.                                    |
  |                                                                    |
@@ -28,7 +28,7 @@
 /**
  *
  * @package CRM
- * @copyright CiviCRM LLC (c) 2004-2016
+ * @copyright CiviCRM LLC (c) 2004-2017
  * $Id$
  *
  */
@@ -220,9 +220,11 @@ class CRM_Core_Page_AJAX {
     );
 
     $sortMapper = array();
-    foreach ($_GET['columns'] as $key => $value) {
-      $sortMapper[$key] = CRM_Utils_Type::escape($value['data'], 'MysqlColumnName');
-    };
+    if (isset($_GET['columns'])) {
+      foreach ($_GET['columns'] as $key => $value) {
+        $sortMapper[$key] = CRM_Utils_Type::validate($value['data'], 'MysqlColumnNameOrAlias');
+      };
+    }
 
     $offset = isset($_GET['start']) ? CRM_Utils_Type::validate($_GET['start'], 'Integer') : $defaultOffset;
     $rowCount = isset($_GET['length']) ? CRM_Utils_Type::validate($_GET['length'], 'Integer') : $defaultRowCount;
@@ -231,7 +233,7 @@ class CRM_Core_Page_AJAX {
     $sortOrder = isset($_GET['order'][0]['dir']) ? CRM_Utils_Type::validate($_GET['order'][0]['dir'], 'MysqlOrderByDirection') : $defaultsortOrder;
 
     if ($sort) {
-      $params['sortBy'] = "`{$sort}` {$sortOrder}";
+      $params['sortBy'] = "{$sort} {$sortOrder}";
 
       $params['_raw_values']['sort'][0] = $sort;
       $params['_raw_values']['order'][0] = $sortOrder;