From dc5fea504b195cf1e36f9a129d1f77ce7c91de13 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Sun, 3 Jul 2016 16:54:41 +0200 Subject: [PATCH] [master] Use paramterized parameter for \OC\SystemTag\SystemTagManager $nameSearchPattern was passed in and directly appended to the SQL query. Luckily the code path isn't reached anywhere in Nextcloud or the included apps. --- lib/private/SystemTag/SystemTagManager.php | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/lib/private/SystemTag/SystemTagManager.php b/lib/private/SystemTag/SystemTagManager.php index 2b0ef03e47..3e32582025 100644 --- a/lib/private/SystemTag/SystemTagManager.php +++ b/lib/private/SystemTag/SystemTagManager.php @@ -140,10 +140,7 @@ class SystemTagManager implements ISystemTagManager { if (!empty($nameSearchPattern)) { $query->andWhere( - $query->expr()->like( - 'name', - $query->expr()->literal('%' . $this->connection->escapeLikeParameter($nameSearchPattern). '%') - ) + $query->expr()->like('name', $query->createNamedParameter('%' . $this->connection->escapeLikeParameter($nameSearchPattern) . '%')) ); }