mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[master] Use paramterized parameter for \OC\SystemTag\SystemTagManager 

$nameSearchPattern was passed in and directly appended to the SQL query. Luckily the code path isn't reached anywhere in Nextcloud or the included apps.
This commit is contained in:
Lukas Reschke 2016-07-03 16:54:41 +02:00
parent 5b4cea4b36
commit dc5fea504b
1 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/private/SystemTag/SystemTagManager.php
View File

@ -140,10 +140,7 @@ class SystemTagManager implements ISystemTagManager {
if (!empty($nameSearchPattern)) {
$query->andWhere(
$query->expr()->like(
'name',
$query->expr()->literal('%' . $this->connection->escapeLikeParameter($nameSearchPattern). '%')
)
$query->expr()->like('name', $query->createNamedParameter('%' . $this->connection->escapeLikeParameter($nameSearchPattern) . '%'))
);
}