diff --git a/lib/adodb/drivers/adodb-postgres64.inc.php b/lib/adodb/drivers/adodb-postgres64.inc.php index 290967e7b57..4068bddfdda 100644 --- a/lib/adodb/drivers/adodb-postgres64.inc.php +++ b/lib/adodb/drivers/adodb-postgres64.inc.php @@ -136,7 +136,8 @@ class ADODB_postgres64 extends ADOConnection{ // get the last id - never tested function pg_insert_id($tablename,$fieldname) { - $result=pg_query($this->_connectionID, 'SELECT last_value FROM '. $tablename .'_'. $fieldname .'_seq'); + $sequence = pg_escape_identifier($this->_connectionID, $tablename .'_'. $fieldname .'_seq'); + $result = pg_query($this->_connectionID, 'SELECT last_value FROM '. $sequence); if ($result) { $arr = @pg_fetch_row($result,0); pg_free_result($result); diff --git a/lib/adodb/readme_moodle.txt b/lib/adodb/readme_moodle.txt index be981c8fbe1..75e8c9a3853 100644 --- a/lib/adodb/readme_moodle.txt +++ b/lib/adodb/readme_moodle.txt @@ -23,3 +23,7 @@ Removed: Added: * index.html - prevent directory browsing on misconfigured servers * readme_moodle.txt - this file ;-) + +Changelog: + * MDL-85375: + - Fix SQL injection in pg_insert_id() - https://github.com/ADOdb/ADOdb/commit/11107d6d6e5160b62e05dff8a3a2678cf0e3a426