diff options
| -rw-r--r-- | app/models/principal.rb | 8 | ||||
| -rw-r--r-- | app/models/project.rb | 2 | ||||
| -rw-r--r-- | lib/redmine/database.rb | 4 |
3 files changed, 8 insertions, 6 deletions
diff --git a/app/models/principal.rb b/app/models/principal.rb index 82c17b472..495d55669 100644 --- a/app/models/principal.rb +++ b/app/models/principal.rb @@ -72,16 +72,16 @@ class Principal < ActiveRecord::Base where({}) else pattern = "%#{sanitize_sql_like q}%" - sql = +"LOWER(#{table_name}.login) LIKE LOWER(:p)" - sql << " OR #{table_name}.id IN (SELECT user_id FROM #{EmailAddress.table_name} WHERE LOWER(address) LIKE LOWER(:p))" - params = {:p => pattern} + sql = +"LOWER(#{table_name}.login) LIKE LOWER(:p) ESCAPE :s" + sql << " OR #{table_name}.id IN (SELECT user_id FROM #{EmailAddress.table_name} WHERE LOWER(address) LIKE LOWER(:p) ESCAPE :s)" + params = {:p => pattern, :s => '\\'} tokens = q.split(/\s+/).reject(&:blank?).map {|token| "%#{sanitize_sql_like token}%"} if tokens.present? sql << ' OR (' sql << tokens.map.with_index do |token, index| params[:"token_#{index}"] = token - "(LOWER(#{table_name}.firstname) LIKE LOWER(:token_#{index}) OR LOWER(#{table_name}.lastname) LIKE LOWER(:token_#{index}))" + "(LOWER(#{table_name}.firstname) LIKE LOWER(:token_#{index}) ESCAPE :s OR LOWER(#{table_name}.lastname) LIKE LOWER(:token_#{index}) ESCAPE :s)" end.join(' AND ') sql << ')' end diff --git a/app/models/project.rb b/app/models/project.rb index c99badb72..429189fc3 100644 --- a/app/models/project.rb +++ b/app/models/project.rb @@ -108,7 +108,7 @@ class Project < ActiveRecord::Base scope :like, (lambda do |arg| if arg.present? pattern = "%#{sanitize_sql_like arg.to_s.strip}%" - where("LOWER(identifier) LIKE LOWER(:p) OR LOWER(name) LIKE LOWER(:p)", :p => pattern) + where("LOWER(identifier) LIKE LOWER(:p) ESCAPE :s OR LOWER(name) LIKE LOWER(:p) ESCAPE :s", :p => pattern, :s => '\\') end end) scope :sorted, lambda {order(:lft)} diff --git a/lib/redmine/database.rb b/lib/redmine/database.rb index 2d84ff35e..ecc200143 100644 --- a/lib/redmine/database.rb +++ b/lib/redmine/database.rb @@ -71,8 +71,10 @@ module Redmine else "#{left} #{neg}ILIKE #{right}" end - else + elsif mysql? "#{left} #{neg}LIKE #{right}" + else + "#{left} #{neg}LIKE #{right} ESCAPE '\\'" end end |