From 987d414ac6f29a7098951462548f54da87557bb2 Mon Sep 17 00:00:00 2001
From: jmarta <marta.jankovics@dpc.hu>
Date: Tue, 1 Aug 2023 12:50:16 +0200
Subject: [PATCH] FINERACT-1724: fix sql injection pattern check

---
 .../infrastructure/security/utils/SQLCommandCondition.java      | 2 +-
 .../infrastructure/security/utils/SQLInjectionValidator.java    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLCommandCondition.java b/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLCommandCondition.java
index 4f78ddc4a..0047a6b24 100644
--- a/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLCommandCondition.java
+++ b/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLCommandCondition.java
@@ -20,5 +20,5 @@ package org.apache.fineract.infrastructure.security.utils;
 
 public interface SQLCommandCondition {
 
-    boolean checkCondition(String command, String sql);
+    boolean checkCondition(String sql, String command);
 }
diff --git a/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java b/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
index ec8dd9701..75ebcb027 100644
--- a/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
+++ b/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
@@ -144,7 +144,7 @@ public final class SQLInjectionValidator {
 
     private static void validateSQLCommand(String lowerCaseSQL, String[] commands, SQLCommandCondition condition) {
         for (String command : commands) {
-            if (condition.checkCondition(command, lowerCaseSQL)) {
+            if (condition.checkCondition(lowerCaseSQL, command)) {
                 throw new SQLInjectionException();
             }
         }