From e0acc24f9d15e8e1329b7902def12a043bef40da Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Tue, 27 Oct 2026 19:41:32 +0100 Subject: [PATCH] fix(tags): Escape tagId which is `[0-9]+` only to satisfy static code analysis Signed-off-by: Joas Schilling --- lib/Model/ConversationTagMapper.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/Model/ConversationTagMapper.php b/lib/Model/ConversationTagMapper.php index ca15cef4997..c572901b90a 100644 --- a/lib/Model/ConversationTagMapper.php +++ b/lib/Model/ConversationTagMapper.php @@ -53,7 +53,7 @@ public function clearTagFromAttendees(string $tagId, string $userId): void { // Use quoted string match to avoid false positives (e.g. "1" matching "12") $qb->select('a.id', 'a.tag_ids') ->from('talk_attendees', 'a') - ->where($qb->expr()->like('a.tag_ids', $qb->createNamedParameter('%"' . $tagId . '"%'))) + ->where($qb->expr()->like('a.tag_ids', $qb->createNamedParameter('%"' . $this->db->escapeLikeParameter($tagId) . '"%'))) ->andWhere($qb->expr()->eq('a.actor_type', $qb->createNamedParameter('users'))) ->andWhere($qb->expr()->eq('a.actor_id', $qb->createNamedParameter($userId)));