From 78a8c266905851869f46b58dbadaf4471626cec8 Mon Sep 17 00:00:00 2001
From: Cody Robibero <cody@robibe.ro>
Date: Fri, 25 Mar 2022 08:49:46 -0600
Subject: [PATCH] Don't allow unknown sort-by

---
 .../Data/SqliteItemRepository.cs              | 67 ++++++++++++++++++-
 1 file changed, 64 insertions(+), 3 deletions(-)

diff --git a/Emby.Server.Implementations/Data/SqliteItemRepository.cs b/Emby.Server.Implementations/Data/SqliteItemRepository.cs
index 85fa79cba..5729a70ac 100644
--- a/Emby.Server.Implementations/Data/SqliteItemRepository.cs
+++ b/Emby.Server.Implementations/Data/SqliteItemRepository.cs
@@ -3029,7 +3029,7 @@ namespace Emby.Server.Implementations.Data
 
             if (string.Equals(name, ItemSortBy.PlayCount, StringComparison.OrdinalIgnoreCase))
             {
-                return "PlayCount";
+                return ItemSortBy.PlayCount;
             }
 
             if (string.Equals(name, ItemSortBy.IsFavoriteOrLiked, StringComparison.OrdinalIgnoreCase))
@@ -3039,7 +3039,7 @@ namespace Emby.Server.Implementations.Data
 
             if (string.Equals(name, ItemSortBy.IsFolder, StringComparison.OrdinalIgnoreCase))
             {
-                return "IsFolder";
+                return ItemSortBy.IsFolder;
             }
 
             if (string.Equals(name, ItemSortBy.IsPlayed, StringComparison.OrdinalIgnoreCase))
@@ -3087,7 +3087,68 @@ namespace Emby.Server.Implementations.Data
                 return "SeriesName";
             }
 
-            return name;
+            if (string.Equals(name, ItemSortBy.AiredEpisodeOrder, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.AiredEpisodeOrder;
+            }
+
+            if (string.Equals(name, ItemSortBy.Album, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.Album;
+            }
+
+            if (string.Equals(name, ItemSortBy.DateCreated, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.DateCreated;
+            }
+
+            if (string.Equals(name, ItemSortBy.PremiereDate, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.PremiereDate;
+            }
+
+            if (string.Equals(name, ItemSortBy.StartDate, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.StartDate;
+            }
+
+            if (string.Equals(name, ItemSortBy.Name, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.Name;
+            }
+
+            if (string.Equals(name, ItemSortBy.CommunityRating, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.CommunityRating;
+            }
+
+            if (string.Equals(name, ItemSortBy.ProductionYear, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.ProductionYear;
+            }
+
+            if (string.Equals(name, ItemSortBy.CriticRating, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.CriticRating;
+            }
+
+            if (string.Equals(name, ItemSortBy.VideoBitRate, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.VideoBitRate;
+            }
+
+            if (string.Equals(name, ItemSortBy.ParentIndexNumber, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.ParentIndexNumber;
+            }
+
+            if (string.Equals(name, ItemSortBy.IndexNumber, StringComparison.OrdinalIgnoreCase))
+            {
+                return ItemSortBy.IndexNumber;
+            }
+
+            // Unknown SortBy, just sort by the SortName.
+            return ItemSortBy.SortName;
         }
 
         public List<Guid> GetItemIdsList(InternalItemsQuery query)