Merge pull request #1 from silverstripe-security/pulls/2.1/ss-2018-016

[SS-2018-016] Group table name is escaped to prevent possibility of SQL injection
silverstripe · Jul 24, 2018 · bf2c81d · bf2c81d
2 parents 7e1c2eb + 4b6804e
commit bf2c81d
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/Extensions/GroupSubsites.php b/src/Extensions/GroupSubsites.php
@@ -47,7 +47,7 @@ public function requireDefaultRecords()
         }
         // Migration for Group.SubsiteID data from when Groups only had a single subsite
         $schema = DataObject::getSchema();
-        $groupTable = $schema->tableName(Group::class);
+        $groupTable = Convert::raw2sql($schema->tableName(Group::class));
         $groupFields = DB::field_list($groupTable);
 
         // Detection of SubsiteID field is the trigger for old-style-subsiteID migration