From ad106c734df6e1494b099c8b759e1f1136856d5f Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Tue, 27 Oct 2026 19:41:32 +0100 Subject: [PATCH] fix(tags): Escape tagId which is `[0-9]+` only to satisfy static code analysis Signed-off-by: Joas Schilling --- lib/Model/ConversationTagMapper.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/Model/ConversationTagMapper.php b/lib/Model/ConversationTagMapper.php index ca15cef4997..c572901b90a 100644 --- a/lib/Model/ConversationTagMapper.php +++ b/lib/Model/ConversationTagMapper.php @@ -53,7 +53,7 @@ public function clearTagFromAttendees(string $tagId, string $userId): void { // Use quoted string match to avoid false positives (e.g. "1" matching "12") $qb->select('a.id', 'a.tag_ids') ->from('talk_attendees', 'a') - ->where($qb->expr()->like('a.tag_ids', $qb->createNamedParameter('%"' . $tagId . '"%'))) + ->where($qb->expr()->like('a.tag_ids', $qb->createNamedParameter('%"' . $this->db->escapeLikeParameter($tagId) . '"%'))) ->andWhere($qb->expr()->eq('a.actor_type', $qb->createNamedParameter('users'))) ->andWhere($qb->expr()->eq('a.actor_id', $qb->createNamedParameter($userId)));