Fix security/core#51 by paramatising the Event Type part of the wuere clause

diff --git a/CRM/Event/Page/ManageEvent.php b/CRM/Event/Page/ManageEvent.php
index afc523e0347e41242ce1d240ae740f5f52f7a6f5..ae0f92942855302c7bf18c2a2a1800291ec929ba 100644 (file)
--- a/CRM/Event/Page/ManageEvent.php
+++ b/CRM/Event/Page/ManageEvent.php
@@ -517,7 +517,8 @@ ORDER BY start_date desc
       if (is_array($value)) {
         $type = implode(',', $value);
       }
-      $clauses[] = "event_type_id IN ({$type})";
+      $clauses[] = "event_type_id IN (%2)";
+      $params[2] = [$type, 'String'];
     }
 
     $eventsByDates = $this->get('eventsByDates');