From ec73d659f68b8f1e8a18ae775f02c167c8380015 Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 16 May 2024 09:31:25 +0200
Subject: [PATCH] Bug 36875: Prevent SQL injection from additional contents

---
 Koha/AdditionalContent.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Koha/AdditionalContent.pm b/Koha/AdditionalContent.pm
index 3aca46ad875..0ee7afa57bf 100644
--- a/Koha/AdditionalContent.pm
+++ b/Koha/AdditionalContent.pm
@@ -136,7 +136,7 @@ sub translated_content {
     my ( $self, $lang ) = @_;
     my $content = $self->translated_contents->search(
         { lang => [ 'default', ( $lang ? $lang : () ) ] },
-        { ( $lang ? ( order_by => \[ "field(lang, '" . $lang . "', 'default')" ] ) : () ) }
+        { ( $lang ? ( order_by => \[ "field(lang, " . C4::Context->dbh->quote($lang) . ", 'default')" ] ) : () ) }
     )->next;
     return $content;
 }
-- 
2.34.1