Data masking: files with url encoded names not showing #840073

stopfstedt · Nov 18, 2024 · c49ed5a · c49ed5a
1 parent a497a39
commit c49ed5a
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/classes/files_mask.php b/classes/files_mask.php
@@ -33,12 +33,12 @@ protected function replace_filename(\stdClass $rec, string $newfilename): void {
             $sql = "UPDATE {oublog_posts}
                        SET message = REPLACE(message, ?, ?)
                      WHERE id = ?";
-            $DB->execute($sql, [$rec->filename, $newfilename, $rec->itemid]);
+            $DB->execute($sql, [rawurlencode($rec->filename), rawurlencode($newfilename), $rec->itemid]);
             // Update edits.
             $sql = "UPDATE {oublog_edits}
                        SET oldmessage = REPLACE(oldmessage, ?, ?)
                      WHERE postid = ?";
-            $DB->execute($sql, [$rec->filename, $newfilename, $rec->itemid]);
+            $DB->execute($sql, [rawurlencode($rec->filename), rawurlencode($newfilename), $rec->itemid]);
         }
     }
 }