Skip to content

Commit

Permalink
escape match value for the query
Browse files Browse the repository at this point in the history
i-just committed Nov 20, 2024

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
1 parent 2478858 commit 84be10c
Showing 8 changed files with 11 additions and 8 deletions.
3 changes: 2 additions & 1 deletion src/fields/CalendarEvents.php
Original file line number Diff line number Diff line change
@@ -8,6 +8,7 @@
use craft\feedme\base\FieldInterface;
use craft\feedme\helpers\DataHelper;
use craft\feedme\Plugin;
use craft\helpers\Db;
use craft\helpers\Json;
use Solspace\Calendar\Elements\Event as EventElement;

@@ -124,7 +125,7 @@ public function parseField(): mixed
$criteria['status'] = null;
$criteria['typeId'] = $typeIds;
$criteria['limit'] = $limit;
$criteria[$match] = $dataValue;
$criteria[$match] = Db::escapeParam($dataValue);

Craft::configure($query, $criteria);

2 changes: 1 addition & 1 deletion src/fields/Categories.php
Original file line number Diff line number Diff line change
@@ -145,7 +145,7 @@ public function parseField(): mixed

$criteria['status'] = null;
$criteria['limit'] = $limit;
$criteria[$match] = $dataValue;
$criteria[$match] = Db::escapeParam($dataValue);

Craft::configure($query, $criteria);

2 changes: 1 addition & 1 deletion src/fields/CommerceProducts.php
Original file line number Diff line number Diff line change
@@ -129,7 +129,7 @@ public function parseField(): mixed
$criteria['status'] = null;
$criteria['typeId'] = $typeIds;
$criteria['limit'] = $limit;
$criteria[$match] = $dataValue;
$criteria[$match] = Db::escapeParam($dataValue);

Craft::configure($query, $criteria);

3 changes: 2 additions & 1 deletion src/fields/CommerceVariants.php
Original file line number Diff line number Diff line change
@@ -10,6 +10,7 @@
use craft\feedme\base\FieldInterface;
use craft\feedme\helpers\DataHelper;
use craft\feedme\Plugin;
use craft\helpers\Db;
use craft\helpers\Json;

/**
@@ -128,7 +129,7 @@ public function parseField(): mixed
$criteria['status'] = null;
$criteria['typeId'] = $typeIds;
$criteria['limit'] = $limit;
$criteria[$match] = $dataValue;
$criteria[$match] = Db::escapeParam($dataValue);

Craft::configure($query, $criteria);

3 changes: 2 additions & 1 deletion src/fields/DigitalProducts.php
Original file line number Diff line number Diff line change
@@ -9,6 +9,7 @@
use craft\feedme\base\FieldInterface;
use craft\feedme\helpers\DataHelper;
use craft\feedme\Plugin;
use craft\helpers\Db;
use craft\helpers\Json;

/**
@@ -129,7 +130,7 @@ public function parseField(): mixed
$criteria['status'] = null;
$criteria['typeId'] = $typeIds;
$criteria['limit'] = $limit;
$criteria[$match] = $dataValue;
$criteria[$match] = Db::escapeParam($dataValue);

Craft::configure($query, $criteria);

2 changes: 1 addition & 1 deletion src/fields/Entries.php
Original file line number Diff line number Diff line change
@@ -164,7 +164,7 @@ public function parseField(): mixed

$criteria['status'] = null;
$criteria['limit'] = $limit;
$criteria[$match] = $dataValue;
$criteria[$match] = Db::escapeParam($dataValue);

Craft::configure($query, $criteria);

2 changes: 1 addition & 1 deletion src/fields/Tags.php
Original file line number Diff line number Diff line change
@@ -127,7 +127,7 @@ public function parseField(): mixed
$criteria['status'] = null;
$criteria['groupId'] = $groupId;
$criteria['limit'] = $limit;
$criteria[$match] = $dataValue;
$criteria[$match] = Db::escapeParam($dataValue);

Craft::configure($query, $criteria);

2 changes: 1 addition & 1 deletion src/fields/Users.php
Original file line number Diff line number Diff line change
@@ -152,7 +152,7 @@ public function parseField(): mixed
$ids = [];
$criteria['status'] = null;
$criteria['limit'] = $limit;
$criteria[$match] = $dataValue;
$criteria[$match] = Db::escapeParam($dataValue);

// If the only source for the Users field is "admins" we don't have to bother with this query.
if (!($isAdmin && empty($groupIds) && empty($customSources))) {

0 comments on commit 84be10c

Please sign in to comment.