[8.x] Harden OrderBys (#798)

Author: duncanmcclean

composer.json

@@ -45,7 +45,7 @@
         "pixelfear/composer-dist-plugin": "^0.1.5",
         "spatie/ignition": "^1.15",
         "spatie/invade": "^2.1",
-        "statamic/cms": "^5.41",
+        "statamic/cms": "^5.73.18",
         "stillat/proteus": "^4.0"
     },
     "require-dev": {

src/Fieldtypes/BaseFieldtype.php

@@ -15,6 +15,7 @@
 use Statamic\Facades\Search;
 use Statamic\Fieldtypes\Relationship;
 use Statamic\Http\Requests\FilteredRequest;
+use Statamic\Query\OrderBy;
 use Statamic\Query\Scopes\Filter;
 use Statamic\Search\Index;
 use Statamic\Search\QueryBuilder as SearchQueryBuilder;
@@ -184,7 +185,7 @@ public function getIndexItems($request)
     private function applyOrderingToIndexQuery(Builder|SearchQueryBuilder $query, FilteredRequest $request): void
     {
         $query->when(method_exists($query, 'getQuery') && $query->getQuery()->orders, function ($query) use ($request) {
-            if ($orderBy = $request->input('sort')) {
+            if ($orderBy = OrderBy::column($request->input('sort'))) {
                 // The stack selector always uses `title` as the default sort column, but
                 // the "title field" for the model might be a different column, so we need to convert it.
                 $sortColumn = $orderBy === 'title' ? $this->resource()->titleField() : $orderBy;

src/GraphQL/ResourceIndexQuery.php

@@ -8,6 +8,7 @@
 use Statamic\GraphQL\Queries\Concerns\FiltersQuery;
 use Statamic\GraphQL\Queries\Query;
 use Statamic\GraphQL\Types\JsonArgument;
+use Statamic\Query\OrderBy;
 use StatamicRadPack\Runway\Resource;
 
 class ResourceIndexQuery extends Query
@@ -73,7 +74,9 @@ protected function sortQuery($query, $sorts): void
                 [$sort, $order] = explode(' ', (string) $sort);
             }
 
-            $query = $query->orderBy($sort, $order);
+            if ($sort = OrderBy::column($sort)) {
+                $query = $query->orderBy($sort, $order);
+            }
         }
     }
 }

src/Http/Controllers/CP/ResourceListingController.php

@@ -7,6 +7,7 @@
 use Statamic\Http\Controllers\CP\CpController;
 use Statamic\Http\Requests\FilteredRequest;
 use Statamic\Query\Builder as BaseStatamicBuilder;
+use Statamic\Query\OrderBy;
 use Statamic\Query\Scopes\Filters\Concerns\QueriesFilters;
 use StatamicRadPack\Runway\Http\Resources\CP\Models;
 use StatamicRadPack\Runway\Resource;
@@ -31,11 +32,13 @@ public function index(FilteredRequest $request, Resource $resource)
 
         $query = $this->applySearch($resource, $query, $searchQuery);
 
-        $query->when(method_exists($query, 'getQuery') && $query->getQuery()->orders, function ($query) use ($request, $resource) {
-            if ($request->input('sort')) {
-                $query->reorder($resource->model()->getColumnForField($request->input('sort')), $request->input('order'));
+        $sortColumn = OrderBy::column($request->input('sort'), $resource->orderBy());
+
+        $query->when(method_exists($query, 'getQuery') && $query->getQuery()->orders, function ($query) use ($request, $resource, $sortColumn) {
+            if ($request->input('sort') && $sortColumn) {
+                $query->reorder($resource->model()->getColumnForField($sortColumn), $request->input('order'));
             }
-        }, fn ($query) => $query->orderBy($resource->model()->getColumnForField($request->input('sort', $resource->orderBy())), $request->input('order', $resource->orderByDirection())));
+        }, fn ($query) => $query->orderBy($resource->model()->getColumnForField($sortColumn), $request->input('order', $resource->orderByDirection())));
 
         $activeFilterBadges = $this->queryFilters($query, $request->filters, [
             'resource' => $resource->handle(),

src/Tags/RunwayTag.php

@@ -7,6 +7,7 @@
 use Illuminate\Support\Str;
 use Statamic\Extensions\Pagination\LengthAwarePaginator;
 use Statamic\Facades\Blink;
+use Statamic\Query\OrderBy;
 use Statamic\Tags\Tags;
 use StatamicRadPack\Runway\Exceptions\ResourceNotFound;
 use StatamicRadPack\Runway\Resource;
@@ -122,7 +123,9 @@ protected function query(): Builder
                 $sortDirection = 'asc';
             }
 
-            $query->orderBy($this->resource->model()->getColumnForField($sortColumn), $sortDirection);
+            if ($sortColumn = OrderBy::column($sortColumn)) {
+                $query->orderBy($this->resource->model()->getColumnForField($sortColumn), $sortDirection);
+            }
         }
 
         return $query;