From 07a58bdb3337412255c8fd621b70683872ba7477 Mon Sep 17 00:00:00 2001 From: meirzamoodle Date: Tue, 20 May 2025 09:48:29 +0700 Subject: [PATCH] MDL-85375 libraries: Escaping a query parameter on pg_insert_id() --- lib/adodb/drivers/adodb-postgres64.inc.php | 3 ++- lib/adodb/readme_moodle.txt | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/lib/adodb/drivers/adodb-postgres64.inc.php b/lib/adodb/drivers/adodb-postgres64.inc.php index b1d161d7ced..5cbe77ed2a5 100644 --- a/lib/adodb/drivers/adodb-postgres64.inc.php +++ b/lib/adodb/drivers/adodb-postgres64.inc.php @@ -138,7 +138,8 @@ class ADODB_postgres64 extends ADOConnection{ // get the last id - never tested function pg_insert_id($tablename,$fieldname) { - $result=pg_query($this->_connectionID, 'SELECT last_value FROM '. $tablename .'_'. $fieldname .'_seq'); + $sequence = pg_escape_identifier($this->_connectionID, $tablename .'_'. $fieldname .'_seq'); + $result = pg_query($this->_connectionID, 'SELECT last_value FROM '. $sequence); if ($result) { $arr = @pg_fetch_row($result,0); pg_free_result($result); diff --git a/lib/adodb/readme_moodle.txt b/lib/adodb/readme_moodle.txt index e8b1ad92754..89580e01215 100644 --- a/lib/adodb/readme_moodle.txt +++ b/lib/adodb/readme_moodle.txt @@ -20,3 +20,7 @@ Removed: Added: * index.html - prevent directory browsing on misconfigured servers * readme_moodle.txt - this file ;-) + +Changelog: + * MDL-85375: + - Fix SQL injection in pg_insert_id() - https://github.com/ADOdb/ADOdb/commit/11107d6d6e5160b62e05dff8a3a2678cf0e3a426