John Cardinal b1944b7ca3 case 4716 - pick-list search text passed as SQL parameters ...

PickListSqlBuilder put the search text and the tag search text into the SQL
inside quotes with no escaping, reachable by any login (security review F18);
an apostrophe in a search also made the query fail. The builder now writes
@plq / @pltag and PickListFetcher adds them as Npgsql parameters (same %text%
match; wildcards typed by the user still apply).

Changelog: searching selection lists for text with an apostrophe now works.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 12:28:43 -07:00

14 KiB

Raw Blame History

View Raw