Add missing escaping of like values

diff --git a/wcfsetup/install/files/lib/system/gridView/filter/I18nTextFilter.class.php b/wcfsetup/install/files/lib/system/gridView/filter/I18nTextFilter.class.php
index 244c8b26c138caa9af58983c192a2e604423fb37..36d78e4f3caabb9c7a586c827d311c25c5f290eb 100644 (file)
--- a/wcfsetup/install/files/lib/system/gridView/filter/I18nTextFilter.class.php
+++ b/wcfsetup/install/files/lib/system/gridView/filter/I18nTextFilter.class.php
@@ -19,9 +19,9 @@ class I18nTextFilter extends TextFilter
     public function applyFilter(DatabaseObjectList $list, string $id, string $value): void
     {
         $list->getConditionBuilder()->add("($id LIKE ? OR $id IN (SELECT languageItem FROM wcf1_language_item WHERE languageID = ? AND languageItemValue LIKE ?))", [
-            '%' . $value . '%',
+            '%' . WCF::getDB()->escapeLikeValue($value) . '%',
             WCF::getLanguage()->languageID,
-            '%' . $value . '%'
+            '%' . WCF::getDB()->escapeLikeValue($value) . '%'
         ]);
     }
 }

diff --git a/wcfsetup/install/files/lib/system/gridView/filter/TextFilter.class.php b/wcfsetup/install/files/lib/system/gridView/filter/TextFilter.class.php
index cb737a538b778e9b7be7f7cdf78c74ba8724cfee..dce79d63fdb6ae26e91658db1d7ef785ec6ebced 100644 (file)
--- a/wcfsetup/install/files/lib/system/gridView/filter/TextFilter.class.php
+++ b/wcfsetup/install/files/lib/system/gridView/filter/TextFilter.class.php
@@ -5,6 +5,7 @@ namespace wcf\system\gridView\filter;
 use wcf\data\DatabaseObjectList;
 use wcf\system\form\builder\field\AbstractFormField;
 use wcf\system\form\builder\field\TextFormField;
+use wcf\system\WCF;
 
 /**
  * Filter for text columns.
@@ -26,7 +27,7 @@ class TextFilter implements IGridViewFilter
     #[\Override]
     public function applyFilter(DatabaseObjectList $list, string $id, string $value): void
     {
-        $list->getConditionBuilder()->add("$id LIKE ?", ['%' . $value . '%']);
+        $list->getConditionBuilder()->add("$id LIKE ?", ['%' . WCF::getDB()->escapeLikeValue($value) . '%']);
     }
 
     #[\Override]