From ec73d659f68b8f1e8a18ae775f02c167c8380015 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Thu, 16 May 2024 09:31:25 +0200 Subject: [PATCH] Bug 36875: Prevent SQL injection from additional contents --- Koha/AdditionalContent.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Koha/AdditionalContent.pm b/Koha/AdditionalContent.pm index 3aca46ad875..0ee7afa57bf 100644 --- a/Koha/AdditionalContent.pm +++ b/Koha/AdditionalContent.pm @@ -136,7 +136,7 @@ sub translated_content { my ( $self, $lang ) = @_; my $content = $self->translated_contents->search( { lang => [ 'default', ( $lang ? $lang : () ) ] }, - { ( $lang ? ( order_by => \[ "field(lang, '" . $lang . "', 'default')" ] ) : () ) } + { ( $lang ? ( order_by => \[ "field(lang, " . C4::Context->dbh->quote($lang) . ", 'default')" ] ) : () ) } )->next; return $content; } -- 2.34.1