From 82568d93bf8234e377dc197b3b3d91bf558a2a45 Mon Sep 17 00:00:00 2001 From: Angel Cajas Date: Mon, 27 May 2019 22:49:37 -0600 Subject: [PATCH] FINERACT-757: Use of sqlEncodeString function isn't needed as parameters are passed as an array of Objects and SqlInjection validation is done by Spring JdbcTemplate. --- .../client/service/ClientReadPlatformServiceImpl.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientReadPlatformServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientReadPlatformServiceImpl.java index 2dde52b60..1e45cc75c 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientReadPlatformServiceImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientReadPlatformServiceImpl.java @@ -251,7 +251,7 @@ public class ClientReadPlatformServiceImpl implements ClientReadPlatformService } if (externalId != null) { - paramList.add(ApiParameterHelper.sqlEncodeString(externalId)); + paramList.add(externalId); extraCriteria += " and c.external_id like ? " ; } @@ -262,17 +262,17 @@ public class ClientReadPlatformServiceImpl implements ClientReadPlatformService } if (firstname != null) { - paramList.add(ApiParameterHelper.sqlEncodeString(firstname)); + paramList.add(firstname); extraCriteria += " and c.firstname like ? " ; } if (lastname != null) { - paramList.add(ApiParameterHelper.sqlEncodeString(lastname)); + paramList.add(lastname); extraCriteria += " and c.lastname like ? "; } if (searchParameters.isScopedByOfficeHierarchy()) { - paramList.add(ApiParameterHelper.sqlEncodeString(searchParameters.getHierarchy() + "%")); + paramList.add(searchParameters.getHierarchy() + "%"); extraCriteria += " and o.hierarchy like ? "; }