Fix SQL injection in array pagination filters

2026-06-01 22:37:28 +02:00
parent 4945abfd8e
commit 0f96247bf3
1 changed files with 3 additions and 12 deletions
@@ -510,17 +510,8 @@ trait db_object_t
                        }
                        $temp = [];
                        foreach ( $value as $v ) {
-                            // Determine the type of the field
-                            $type = $fieldTypes[$field] ?? '';
-                            // If the field is an integer, cast the value to an integer
-                            if (!empty($type) && str_contains($type, 'int')) {
-                                $temp[] = "`$field` = $v";
-                            } else {
-                                $temp[] = "`$field` = ?";
-                                $params[] = $v;
-                            }
-                            //$temp[] = "`$field` = ?";
-                            //$params[] = $v;
+                            $temp[] = "`$field` = ?";
+                            $params[] = $v;
                        }
                        $whereClauses[] = '(' . implode(' OR ', $temp) . ')';
                        continue;
@@ -1420,4 +1411,4 @@ trait db_object_t
        $attachment = new attachments();
        return $attachment->get($attachmentId);
    }
-}
+}