diff options
| author | Lukas Reschke <lukas@statuscode.ch> | 2017-03-15 22:46:40 +0100 |
|---|---|---|
| committer | Lukas Reschke <lukas@statuscode.ch> | 2017-03-15 22:46:40 +0100 |
| commit | 085891a15d1ee7761d3a90df3fd0242249dcea18 (patch) | |
| tree | 32ccf8e4ae2078cb236b81755c50d4965c5426e1 /lib/private/User | |
| parent | 93c9a06761eed2e4e842914d062ae02e8ecc73b3 (diff) | |
| download | nextcloud-server-085891a15d1ee7761d3a90df3fd0242249dcea18.tar.gz nextcloud-server-085891a15d1ee7761d3a90df3fd0242249dcea18.zip | |
Escape like parameters in database user backend
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
Diffstat (limited to 'lib/private/User')
| -rw-r--r-- | lib/private/User/Database.php | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/lib/private/User/Database.php b/lib/private/User/Database.php index a281572ad55..b1795d27e93 100644 --- a/lib/private/User/Database.php +++ b/lib/private/User/Database.php @@ -68,6 +68,9 @@ class Database extends Backend implements IUserBackend { /** @var EventDispatcher */ private $eventDispatcher; + /** @var \OCP\IDBConnection */ + private $connection; + /** * \OC\User\Database constructor. * @@ -76,6 +79,7 @@ class Database extends Backend implements IUserBackend { public function __construct($eventDispatcher = null) { $this->cache = new CappedMemoryCache(); $this->eventDispatcher = $eventDispatcher ? $eventDispatcher : \OC::$server->getEventDispatcher(); + $this->connection = \OC::$server->getDatabaseConnection(); } /** @@ -185,8 +189,8 @@ class Database extends Backend implements IUserBackend { $parameters = []; $searchLike = ''; if ($search !== '') { - $parameters[] = '%' . $search . '%'; - $parameters[] = '%' . $search . '%'; + $parameters[] = '%' . $this->connection->escapeLikeParameter($search) . '%'; + $parameters[] = '%' . $this->connection->escapeLikeParameter($search) . '%'; $searchLike = ' WHERE LOWER(`displayname`) LIKE LOWER(?) OR ' . 'LOWER(`uid`) LIKE LOWER(?)'; } @@ -275,7 +279,7 @@ class Database extends Backend implements IUserBackend { $parameters = []; $searchLike = ''; if ($search !== '') { - $parameters[] = '%' . $search . '%'; + $parameters[] = '%' . $this->connection->escapeLikeParameter($search) . '%'; $searchLike = ' WHERE LOWER(`uid`) LIKE LOWER(?)'; } |