From 80343ec28259b629d812175f9e1da5d954b4a1d7 Mon Sep 17 00:00:00 2001
From: wpdev <webdemo2080@gmail.com>
Date: Mon, 28 Sep 2026 00:31:10 +0800
Subject: [PATCH] fix(2meet-data-optimizer): drop router query vars a caller
 passed in
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- pre_get_posts clears wpdo_post_clauses / _sort / _copy_route / _count_sql
  before anything else: new WP_Query( array( … ) ) could preset them
- posts_orderby whitelists the copy route's direction
- Found in the 2.4 security review (Low L2; not reachable from URLs)
- Verify: PostQueryRouterCopyTest (1 new); integration 604, unit 704, phpcs 0
- PR: PR-132
---
 .../query/class-tmdo-post-query-router.php    |  7 ++++-
 tests/integration/PostQueryRouterCopyTest.php | 26 +++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/includes/query/class-tmdo-post-query-router.php b/includes/query/class-tmdo-post-query-router.php
index 7e82377..9692c72 100644
--- a/includes/query/class-tmdo-post-query-router.php
+++ b/includes/query/class-tmdo-post-query-router.php
@@ -138,6 +138,11 @@ class TMDO_Post_Query_Router {
 	 * @return void
 	 */
 	public function pre_get_posts( \WP_Query $query ): void {
+		// The router's query vars are its own: drop any a caller passed in.
+		foreach ( array( self::QUERY_VAR, self::SORT_VAR, self::COPY_VAR, self::COUNT_VAR ) as $var ) {
+			$query->set( $var, '' );
+		}
+
 		// Mode gate: only run when post mode is reads_from_flat.
 		if ( ! self::is_router_active() ) {
 			return;
@@ -389,7 +394,7 @@ class TMDO_Post_Query_Router {
 		if ( empty( $copy ) ) {
 			return $orderby;
 		}
-		return '`' . self::table_alias( $copy['post_type'], $copy['group'] ) . '`.`post_date` ' . $copy['order'];
+		return '`' . self::table_alias( $copy['post_type'], $copy['group'] ) . '`.`post_date` ' . ( 'ASC' === $copy['order'] ? 'ASC' : 'DESC' );
 	}
 
 	/**
diff --git a/tests/integration/PostQueryRouterCopyTest.php b/tests/integration/PostQueryRouterCopyTest.php
index ccfc1b5..07b11c6 100644
--- a/tests/integration/PostQueryRouterCopyTest.php
+++ b/tests/integration/PostQueryRouterCopyTest.php
@@ -107,6 +107,32 @@ class PostQueryRouterCopyTest extends TestCase {
 		$this->assertStringEndsWith( "`post_date` DESC, FIELD({$wpdb->posts}.ID,5,9) DESC, ({$wpdb->posts}.ID IN (3,4)) DESC, " . self::ALIAS . '.`post_id` DESC LIMIT 0, 10', $sql );
 	}
 
+	/**
+	 * The router's query vars are its own: values a caller passed in
+	 * (new WP_Query( array( 'wpdo_post_copy_route' => … ) )) are dropped
+	 * (2.4 security review L2).
+	 */
+	public function test_query_vars_passed_by_a_caller_are_dropped(): void {
+		$query = new WP_Query();
+		foreach ( array(
+			'post_type'             => 'rc_item',
+			'orderby'               => 'title',
+			'wpdo_post_copy_route'  => array( 'post_type' => 'rc_item', 'group' => 'rc_core', 'statuses' => array( 'publish' ), 'order' => 'DESC, (SELECT 1)' ),
+			'wpdo_post_sort'        => array( 'post_type' => 'rc_item', 'group' => 'rc_core', 'column' => 'rc_price', 'order' => 'ASC' ),
+			'wpdo_post_clauses'     => array( 'rc_item' => array() ),
+			'wpdo_post_count_sql'   => 'SELECT 1',
+		) as $k => $v ) {
+			$query->set( $k, $v );
+		}
+		$router = new TMDO_Post_Query_Router();
+		$router->pre_get_posts( $query );
+
+		foreach ( array( 'wpdo_post_copy_route', 'wpdo_post_sort', 'wpdo_post_clauses', 'wpdo_post_count_sql' ) as $var ) {
+			$this->assertEmpty( $query->get( $var ), $var );
+		}
+		$this->assertSame( 'wp_posts.post_title ASC', $router->posts_orderby( 'wp_posts.post_title ASC', $query ) );
+	}
+
 	public function test_copy_route_keeps_group_by_with_another_join(): void {
 		global $wpdb;
 		$sql = $this->request( " LEFT JOIN wp_term_relationships ON ({$wpdb->posts}.ID = wp_term_relationships.object_id)" );