diff --git a/lib/adodb/drivers/adodb-postgres64.inc.php b/lib/adodb/drivers/adodb-postgres64.inc.php index b1d161d7ced..5cbe77ed2a5 100644 --- a/lib/adodb/drivers/adodb-postgres64.inc.php +++ b/lib/adodb/drivers/adodb-postgres64.inc.php @@ -138,7 +138,8 @@ class ADODB_postgres64 extends ADOConnection{ // get the last id - never tested function pg_insert_id($tablename,$fieldname) { - $result=pg_query($this->_connectionID, 'SELECT last_value FROM '. $tablename .'_'. $fieldname .'_seq'); + $sequence = pg_escape_identifier($this->_connectionID, $tablename .'_'. $fieldname .'_seq'); + $result = pg_query($this->_connectionID, 'SELECT last_value FROM '. $sequence); if ($result) { $arr = @pg_fetch_row($result,0); pg_free_result($result); diff --git a/lib/adodb/readme_moodle.txt b/lib/adodb/readme_moodle.txt index e8b1ad92754..89580e01215 100644 --- a/lib/adodb/readme_moodle.txt +++ b/lib/adodb/readme_moodle.txt @@ -20,3 +20,7 @@ Removed: Added: * index.html - prevent directory browsing on misconfigured servers * readme_moodle.txt - this file ;-) + +Changelog: + * MDL-85375: + - Fix SQL injection in pg_insert_id() - https://github.com/ADOdb/ADOdb/commit/11107d6d6e5160b62e05dff8a3a2678cf0e3a426