security fix

Minervis-GmbH · Nov 27, 2023 · 9026fb3 · 9026fb3
1 parent 5e8044b
commit 9026fb3
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/webservice/soap/classes/class.ilSoapUserAdministration.php b/webservice/soap/classes/class.ilSoapUserAdministration.php
@@ -711,8 +711,7 @@ public function searchUser(
 		          LEFT JOIN usr_pref
 		          ON usr_pref.usr_id = usr_data.usr_id AND usr_pref.keyword = " .
             $ilDB->quote("language", "text") .
-            "'language'
-		          WHERE 1 = 1 " . $query;
+            "  WHERE 1 = 1 " . $query;
 
         if ($active > -1) {
             $query .= " AND active = " . $ilDB->quote($active);
@@ -774,7 +773,7 @@ private function buildSearchQuery(array $a_keyfields, string $queryOperator, arr
             $field_query = array();
             foreach ($a_keyvalues as $keyvalue) {
                 if (strlen($keyvalue) >= 3) {
-                    $field_query [] = $keyfield . " like '%" . $keyvalue . "%'";
+                    $field_query [] = $ilDB->like($ilDB->quoteIdentifier($keyfield), 'text', '%' . $keyvalue . "%");
                 }
             }
             if (count($field_query)) {