From fa7ac2f8f8339028c05bec2b01967ef9abbe3132 Mon Sep 17 00:00:00 2001 From: Seamus Lee Date: Mon, 29 Apr 2019 08:32:58 +1000 Subject: [PATCH] Also escape subtype to fix POC#2 found by Patrick --- CRM/Core/BAO/CustomField.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CRM/Core/BAO/CustomField.php b/CRM/Core/BAO/CustomField.php index 71e597832d..02b9519e67 100644 --- a/CRM/Core/BAO/CustomField.php +++ b/CRM/Core/BAO/CustomField.php @@ -599,7 +599,7 @@ class CRM_Core_BAO_CustomField extends CRM_Core_DAO_CustomField { if (!empty($customDataSubType)) { $subtypeClause = array(); foreach ($customDataSubType as $subtype) { - $subtype = CRM_Core_DAO::VALUE_SEPARATOR . $subtype . CRM_Core_DAO::VALUE_SEPARATOR; + $subtype = CRM_Core_DAO::VALUE_SEPARATOR . CRM_Utils_Type::escape($subtype, 'String') . CRM_Core_DAO::VALUE_SEPARATOR; $subtypeClause[] = "$cgTable.extends_entity_column_value LIKE '%{$subtype}%'"; } if (!$onlySubType) { -- 2.25.1