mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[stable9] Use paramterized parameter for \OC\SystemTag\SystemTagManager 

$nameSearchPattern was passed in and directly appended to the SQL query. Luckily the code path isn't reached anywhere in Nextcloud or the included apps.
This commit is contained in:
Lukas Reschke 2016-07-03 16:50:28 +02:00
parent 531e69947f
commit ce70ea3501
No known key found for this signature in database
GPG Key ID: 9AB0ADB949B6898C
1 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/private/systemtag/systemtagmanager.php
View File

@ -124,10 +124,7 @@ class SystemTagManager implements ISystemTagManager {
if (!empty($nameSearchPattern)) {
$query->andWhere(
$query->expr()->like(
'name',
$query->expr()->literal('%' . $this->connection->escapeLikeParameter($nameSearchPattern). '%')
)
$query->expr()->like('name', $query->createNamedParameter('%' . $this->connection->escapeLikeParameter($nameSearchPattern) . '%'))
);
}