From 3b7f2aa473107ab6bc79dd1baa6b169f1b64ffda Mon Sep 17 00:00:00 2001 From: meirzamoodle Date: Tue, 20 May 2025 09:48:29 +0700 Subject: [PATCH] MDL-85375 libraries: Escaping a query parameter on pg_insert_id() --- lib/adodb/drivers/adodb-postgres64.inc.php | 3 ++- lib/adodb/readme_moodle.txt | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/lib/adodb/drivers/adodb-postgres64.inc.php b/lib/adodb/drivers/adodb-postgres64.inc.php index 290967e7b57..4068bddfdda 100644 --- a/lib/adodb/drivers/adodb-postgres64.inc.php +++ b/lib/adodb/drivers/adodb-postgres64.inc.php @@ -136,7 +136,8 @@ class ADODB_postgres64 extends ADOConnection{ // get the last id - never tested function pg_insert_id($tablename,$fieldname) { - $result=pg_query($this->_connectionID, 'SELECT last_value FROM '. $tablename .'_'. $fieldname .'_seq'); + $sequence = pg_escape_identifier($this->_connectionID, $tablename .'_'. $fieldname .'_seq'); + $result = pg_query($this->_connectionID, 'SELECT last_value FROM '. $sequence); if ($result) { $arr = @pg_fetch_row($result,0); pg_free_result($result); diff --git a/lib/adodb/readme_moodle.txt b/lib/adodb/readme_moodle.txt index be981c8fbe1..75e8c9a3853 100644 --- a/lib/adodb/readme_moodle.txt +++ b/lib/adodb/readme_moodle.txt @@ -23,3 +23,7 @@ Removed: Added: * index.html - prevent directory browsing on misconfigured servers * readme_moodle.txt - this file ;-) + +Changelog: + * MDL-85375: + - Fix SQL injection in pg_insert_id() - https://github.com/ADOdb/ADOdb/commit/11107d6d6e5160b62e05dff8a3a2678cf0e3a426