rebased, added changelog myself. enabled auto merge

ps: fixed "Disclosure" typo in your commit message.

Damn, the PR is buggy. should have tested it locally.

Notice: Undefined variable: default_sort_by_options in eventum-3.10.7-18-g9b1e14f15/lib/eventum/class.search.php on line 377

Warning: in_array() expects parameter 2 to be array, null given in eventum-3.10.7-18-g9b1e14f15/lib/eventum/class.search.php on line 377

However, the $sort_by was previously escaped by DB_Helper::escapeString():

• https://github.com/eventum/eventum/blob/v3.10.7/lib/eventum/class.search.php#L367-L372

are you saying the method is not escaping properly?

Also, this fix completely disables searching by custom fields:

• https://github.com/eventum/eventum/blob/v3.10.7/lib/eventum/class.search.php#L369

And resetting the $sort_by = '' will totally crash the application with 500 error because then the SQL is built with order column but not value:

ORDER BY desc, iss_id DESC

• https://github.com/eventum/eventum/blob/v3.10.7/lib/eventum/class.search.php#L378

@noobpk where or how did you obtain what to fill as $sort_by whitelisted values?

ok. there's dropdown for sort_by, let's go with that:

<label>Sort By<br />
  | <select name="sort_by">
  | <option value="last_action_date" >Last Action Date</option>
  | <option value="pri_rank" >Priority</option>
  | <option value="iss_id" >Issue ID</option>
  | <option value="sta_rank" >Status</option>
  | <option value="iss_summary" >Summary</option>
  | </select>
  | </label>

New fix:

• Fix invalid input for advanced search sort_by #1255

so far the injected SQL is not appearing in the query log.

Damn, the PR is buggy. should have tested it locally.

Notice: Undefined variable: default_sort_by_options in eventum-3.10.7-18-g9b1e14f15/lib/eventum/class.search.php on line 377

Warning: in_array() expects parameter 2 to be array, null given in eventum-3.10.7-18-g9b1e14f15/lib/eventum/class.search.php on line 377

ops!! sorry about that. my mistake :((

ops!! sorry about that. my mistake :((

well. the whole thing was untested. see other notes as well. had to re-do the whole fix