diff options
| author | Daniel Calviño Sánchez <danxuliu@gmail.com> | 2018-03-14 21:53:14 +0100 |
|---|---|---|
| committer | Daniel Calviño Sánchez <danxuliu@gmail.com> | 2018-03-14 23:31:42 +0100 |
| commit | 0b96a71a68f10b23258c0090cc80b279d0d2f1aa (patch) | |
| tree | 6846fa38a8968f03974600a8abb6f935672dc792 /lib/private | |
| parent | 3cae27614932d3cb0780018551b14a4139f980fd (diff) | |
| download | nextcloud-server-0b96a71a68f10b23258c0090cc80b279d0d2f1aa.tar.gz nextcloud-server-0b96a71a68f10b23258c0090cc80b279d0d2f1aa.zip | |
Fix configuration values matched in user searches
Due to a misplaced closing parenthesis the condition of the left join
clause was just "userid = uid"; the other conditions were passed as
additional parameters to "leftJoin", and thus they were ignored.
Therefore, the result set contained every preference of each user
instead of only the email, so the "WHERE configvalue LIKE XXX" matched
any configuration value of the user.
Besides the closing parenthesis this commit also fixes the literal
values. Although "Literal" objects represent literal values they must be
created through "IExpressionBuilder::literal()" to be properly quoted;
otherwise it is just a plain string, which is treated as a column name.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Diffstat (limited to 'lib/private')
| -rw-r--r-- | lib/private/User/Database.php | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/private/User/Database.php b/lib/private/User/Database.php index 6e44c902286..8dad3ef5fcd 100644 --- a/lib/private/User/Database.php +++ b/lib/private/User/Database.php @@ -203,9 +203,9 @@ class Database extends Backend implements IUserBackend { $query->select('uid', 'displayname') ->from('users', 'u') ->leftJoin('u', 'preferences', 'p', $query->expr()->andX( - $query->expr()->eq('userid', 'uid')), - $query->expr()->eq('appid', new Literal('settings')), - $query->expr()->eq('configkey', new Literal('email')) + $query->expr()->eq('userid', 'uid'), + $query->expr()->eq('appid', $query->expr()->literal('settings')), + $query->expr()->eq('configkey', $query->expr()->literal('email'))) ) // sqlite doesn't like re-using a single named parameter here ->where($query->expr()->iLike('uid', $query->createPositionalParameter('%' . $connection->escapeLikeParameter($search) . '%'))) |