From dc5fea504b195cf1e36f9a129d1f77ce7c91de13 Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@owncloud.com>
Date: Sun, 3 Jul 2016 16:54:41 +0200
Subject: [PATCH] [master] Use paramterized parameter for
\OC\SystemTag\SystemTagManager
$nameSearchPattern was passed in and directly appended to the SQL query. Luckily the code path isn't reached anywhere in Nextcloud or the included apps.
---
lib/private/SystemTag/SystemTagManager.php | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/lib/private/SystemTag/SystemTagManager.php b/lib/private/SystemTag/SystemTagManager.php
index 2b0ef03e471..3e32582025f 100644
--- a/lib/private/SystemTag/SystemTagManager.php
+++ b/lib/private/SystemTag/SystemTagManager.php
@@ -140,10 +140,7 @@ class SystemTagManager implements ISystemTagManager {
if (!empty($nameSearchPattern)) {
$query->andWhere(
- $query->expr()->like(
- 'name',
- $query->expr()->literal('%' . $this->connection->escapeLikeParameter($nameSearchPattern). '%')
- )
+ $query->expr()->like('name', $query->createNamedParameter('%' . $this->connection->escapeLikeParameter($nameSearchPattern) . '%'))
);
}
--
GitLab