diff --git a/plugins/tps/birzha/components/Offers.php b/plugins/tps/birzha/components/Offers.php index 9d57ebddd..4f6deb80d 100644 --- a/plugins/tps/birzha/components/Offers.php +++ b/plugins/tps/birzha/components/Offers.php @@ -9,6 +9,11 @@ use DB; class Offers extends ComponentBase { + /* + * sort order parametr in a url string + */ + public $sortParam = ''; + public function componentDetails() { return [ @@ -66,7 +71,16 @@ class Offers extends ComponentBase } protected function loadOffers() { - $sortOrder = $this->property('sortOrder'); + $sortOrderParam = strtolower(\Input::get('sort_order')); + + // protect from sql injection + if($sortOrderParam != 'asc' && $sortOrderParam != 'desc') { + $sortOrder = $this->property('sortOrder'); + } else { + $sortOrder = $sortOrderParam; + $this->sortParam = $sortOrderParam; + } + $cSlug = $this->property('categorySlug'); $perPage = $this->property('perPage'); $productSlug = $this->property('productSlug'); diff --git a/plugins/tps/birzha/components/offers/default.htm b/plugins/tps/birzha/components/offers/default.htm index 73eaf7b4c..869d715ba 100644 --- a/plugins/tps/birzha/components/offers/default.htm +++ b/plugins/tps/birzha/components/offers/default.htm @@ -59,13 +59,13 @@ {% if offers.total > offers.perPage %}