Merge pull request #26409 from owncloud/stable9-36d6f3ba8b7b7db8f4d8b2a70504fd184a30cc50

[stable9] Escape special characters (#25429)

6 files changed, 8 insertions, 8 deletions

diff --git a/apps/dav/lib/connector/sabre/custompropertiesbackend.php b/apps/dav/lib/connector/sabre/custompropertiesbackend.php
index 5946c9910d4..9c0136bece4 100644
--- a/apps/dav/lib/connector/sabre/custompropertiesbackend.php
+++ b/apps/dav/lib/connector/sabre/custompropertiesbackend.php
@@ -327,7 +327,7 @@ class CustomPropertiesBackend implements BackendInterface {
 
 		$result = $this->connection->executeQuery(
 			$sql,
-			array($this->user, rtrim($path, '/') . '/%', $requestedProperties),
+			array($this->user, $this->connection->escapeLikeParameter(rtrim($path, '/')) . '/%', $requestedProperties),
 			array(null, null, \Doctrine\DBAL\Connection::PARAM_STR_ARRAY)
 		);
 
diff --git a/apps/user_ldap/lib/access.php b/apps/user_ldap/lib/access.php
index dd4aeee3b24..0e9342afce7 100644
--- a/apps/user_ldap/lib/access.php
+++ b/apps/user_ldap/lib/access.php
@@ -621,7 +621,7 @@ class Access extends LDAPUtility implements user\IUserTools {
 	 * "Developers"
 	 */
 	private function _createAltInternalOwnCloudNameForGroups($name) {
-		$usedNames = $this->groupMapper->getNamesBySearch($name.'_%');
+		$usedNames = $this->groupMapper->getNamesBySearch($name, "", '_%');
 		if(!($usedNames) || count($usedNames) === 0) {
 			$lastNo = 1; //will become name_2
 		} else {
diff --git a/apps/user_ldap/lib/mapping/abstractmapping.php b/apps/user_ldap/lib/mapping/abstractmapping.php
index 1c896a9bbf4..d260e57e9b2 100644
--- a/apps/user_ldap/lib/mapping/abstractmapping.php
+++ b/apps/user_ldap/lib/mapping/abstractmapping.php
@@ -140,14 +140,14 @@ abstract class AbstractMapping {
 	 * @param string $search
 	 * @return string[]
 	 */
-	public function getNamesBySearch($search) {
+	public function getNamesBySearch($search, $prefixMatch = "", $postfixMatch = "") {
 		$query = $this->dbc->prepare('
 			SELECT `owncloud_name`
 			FROM `'. $this->getTableName() .'`
 			WHERE `owncloud_name` LIKE ?
 		');
 
-		$res = $query->execute(array($search));
+		$res = $query->execute(array($prefixMatch.$this->dbc->escapeLikeParameter($search).$postfixMatch));
 		$names = array();
 		if($res !== false) {
 			while($row = $query->fetch()) {
diff --git a/apps/user_ldap/tests/mapping/abstractmappingtest.php b/apps/user_ldap/tests/mapping/abstractmappingtest.php
index c6427be516b..6582e5c3014 100644
--- a/apps/user_ldap/tests/mapping/abstractmappingtest.php
+++ b/apps/user_ldap/tests/mapping/abstractmappingtest.php
@@ -162,7 +162,7 @@ abstract class AbstractMappingTest extends \Test\TestCase {
 	public function testSearch() {
 		list($mapper,) = $this->initTest();
 
-		$names = $mapper->getNamesBySearch('%oo%');
+		$names = $mapper->getNamesBySearch('oo', '%', '%');
 		$this->assertTrue(is_array($names));
 		$this->assertSame(2, count($names));
 		$this->assertTrue(in_array('Foobar', $names));
diff --git a/lib/private/group/database.php b/lib/private/group/database.php
index 9ea0bbb8242..503c29b99c0 100644
--- a/lib/private/group/database.php
+++ b/lib/private/group/database.php
@@ -294,7 +294,7 @@ class OC_Group_Database extends OC_Group_Backend {
 		$parameters = [$gid];
 		$searchLike = '';
 		if ($search !== '') {
-			$parameters[] = '%' . $search . '%';
+			$parameters[] = '%' . $this->dbConn->escapeLikeParameter($search) . '%';
 			$searchLike = ' AND `uid` LIKE ?';
 		}
 
@@ -320,7 +320,7 @@ class OC_Group_Database extends OC_Group_Backend {
 		$parameters = [$gid];
 		$searchLike = '';
 		if ($search !== '') {
-			$parameters[] = '%' . $search . '%';
+			$parameters[] = '%' . $this->dbConn->escapeLikeParameter($search) . '%';
 			$searchLike = ' AND `uid` LIKE ?';
 		}
 
diff --git a/lib/private/repair/repairlegacystorages.php b/lib/private/repair/repairlegacystorages.php
index ee189110a87..1442a3d1a7a 100644
--- a/lib/private/repair/repairlegacystorages.php
+++ b/lib/private/repair/repairlegacystorages.php
@@ -170,7 +170,7 @@ class RepairLegacyStorages extends BasicEmitter {
 		$sql = 'SELECT `id`, `numeric_id` FROM `*PREFIX*storages`'
 			. ' WHERE `id` LIKE ?'
 			. ' ORDER BY `id`';
-		$result = $this->connection->executeQuery($sql, array($dataDirId . '%'));
+		$result = $this->connection->executeQuery($sql, array($this->connection->escapeLikeParameter($dataDirId) . '%'));
 
 		while ($row = $result->fetch()) {
 			$currentId = $row['id'];