Only allow sort fields that match the current object alias.

Backport 37ce6df to 1.3 Fixes #3803
cakephp · May 1, 2013 · f2c9639 · f2c9639
1 parent 2eab53d
commit f2c9639
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/cake/libs/controller/controller.php b/cake/libs/controller/controller.php
@@ -1134,10 +1134,11 @@ function paginate($object = null, $scope = array(), $whitelist = array()) {
 			}
 			$value = $options['order'][$key];
 			unset($options['order'][$key]);
+			$correctAlias = ($alias == $object->alias);
 
-			if ($object->hasField($field)) {
+			if ($correctAlias && $object->hasField($field)) {
 				$options['order'][$object->alias . '.' . $field] = $value;
-			} elseif ($object->hasField($key, true)) {
+			} elseif ($correctAlias && $object->hasField($key, true)) {
 				$options['order'][$field] = $value;
 			} elseif (isset($object->{$alias}) && $object->{$alias}->hasField($field)) {
 				$options['order'][$alias . '.' . $field] = $value;