No injections

This commit is contained in:
Roeland Jago Douma 2015-03-30 20:07:12 +02:00
parent b0aa17b13f
commit 0bf06d6691
1 changed files with 7 additions and 3 deletions

View File

@ -1167,7 +1167,8 @@ class Share extends \OC\Share\Constants {
$qb->select('`uid_owner`')
->from('`*PREFIX*share`')
->where($qb->expr()->eq('`id`', $shareId));
->where('`id` = :shareId')
->setParameter(':shareId', $shareId);
$result = $qb->execute();
$result = $result->fetch();
@ -1215,8 +1216,11 @@ class Share extends \OC\Share\Constants {
$qb = $connection->createQueryBuilder();
$qb->update('`*PREFIX*share`')
->set('`share_with`', is_null($password) ? 'NULL' : $qb->expr()->literal(\OC::$server->getHasher()->hash($password)))
->where($qb->expr()->eq('`id`', $shareId));
->set('`share_with`', ':pass')
->where('`id` = :shareId')
->setParameter(':pass', is_null($password) ? 'NULL' : $qb->expr()->literal(\OC::$server->getHasher()->hash($password)))
->setParameter(':shareId', $shareId);
$qb->execute();
return true;