1 files changed, 20 insertions, 16 deletions
diff --git a/engine/lib/annotations.php b/engine/lib/annotations.php
index 3b5be89b3..0507cba09 100644
--- a/engine/lib/annotations.php
+++ b/engine/lib/annotations.php
@@ -98,15 +98,15 @@
 		function delete() 
 		{ 
 			return delete_annotation($this->id); 
-		}
-	
-		// SYSTEM LOG INTERFACE ////////////////////////////////////////////////////////////
-
-		/**
-		 * For a given ID, return the object associated with it.
-		 * This is used by the river functionality primarily.
-		 * This is useful for checking access permissions etc on objects.
-		 */
+		}
+	
+		// SYSTEM LOG INTERFACE ////////////////////////////////////////////////////////////
+
+		/**
+		 * For a given ID, return the object associated with it.
+		 * This is used by the river functionality primarily.
+		 * This is useful for checking access permissions etc on objects.
+		 */
 		public function getObjectFromID($id) { return get_annotation($id); }
 	}
 	
@@ -226,25 +226,29 @@
 	 * @param int $offset
 	 * @param string $order_by
 	 */
-	function get_annotations($entity_guid = 0, $entity_type = "", $entity_subtype = "", $name = "", $value = "", $owner_guid = 0, $limit = 10, $offset = 0, $order_by = "a.time_created desc")
+	function get_annotations($entity_guid = 0, $entity_type = "", $entity_subtype = "", $name = "", $value = "", $owner_guid = 0, $limit = 10, $offset = 0, $order_by = "asc")
 	{
 		global $CONFIG;
 		
 		$entity_guid = (int)$entity_guid;
 		$entity_type = sanitise_string($entity_type);
-		$entity_subtype = get_subtype_id($entity_type, $entity_subtype);
+		$entity_subtype = get_subtype_id($entity_type, $entity_subtype);
 		if ($name)
-		{
-			$name = get_metastring_id($name);
+		{
+			$name = get_metastring_id($name);
 		
 			if ($name === false)
-				$name = 0;
+				$name = 0;
 		}
 		if ($value != "") $value = get_metastring_id($value);
 		$owner_guid = (int)$owner_guid;
 		$limit = (int)$limit;
 		$offset = (int)$offset;
-		$order_by = sanitise_string($order_by);
+		if($order_by == 'asc')
+		    $order_by = "a.time_created asc";
+		    
+		if($order_by == 'desc')
+		    $order_by = "a.time_created desc";
 		
 		$where = array();
 		
@@ -270,7 +274,7 @@
 		foreach ($where as $w)
 			$query .= " $w and ";
 		$query .= get_access_sql_suffix("a"); // Add access controls
-		$query .= " order by $order_by limit $offset,$limit"; // Add order and limit
+		$query .= " order by $order_by limit $offset,$limit"; // Add order and limit
 		return get_data($query, "row_to_elggannotation");
 		
 	}