From 9f4404e80d26607d53e23a666f5a22b29b471fe7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Mudr=C3=A1k?= <david@moodle.com>
Date: Tue, 9 Feb 2021 15:29:11 +0100
Subject: [PATCH] MDL-70804 mnet: Use proper DML method to get records from the
 table

This improves the code and avoids the risk of SQL injection through the
malicious XML-RPC request from the MNet peer.
---
 auth/mnet/auth.php | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/auth/mnet/auth.php b/auth/mnet/auth.php
index 27cf5d708a8..d12ef16dd3c 100644
--- a/auth/mnet/auth.php
+++ b/auth/mnet/auth.php
@@ -710,9 +710,7 @@ class auth_plugin_mnet extends auth_plugin_base {
 
         foreach($superArray as $subArray) {
             $subArray = array_values($subArray);
-            $instring = "('".implode("', '",$subArray)."')";
-            $query = "select id, session_id, username from {mnet_session} where username in $instring";
-            $results = $DB->get_records_sql($query);
+            $results = $DB->get_records_list('mnet_session', 'username', $subArray, '', 'id, session_id, username');
 
             if ($results == false) {
                 // We seem to have a username that breaks our query: