From 762de973ebea283e2746ddcbdd6ad437c44c59ec Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Tue, 1 Mar 2022 18:43:16 +0100
Subject: [PATCH] Fix sql injection

---
 htdocs/core/lib/security.lib.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/core/lib/security.lib.php b/htdocs/core/lib/security.lib.php
index ccdfa261fc8..44d6f5c739b 100644
--- a/htdocs/core/lib/security.lib.php
+++ b/htdocs/core/lib/security.lib.php
@@ -289,7 +289,7 @@ function restrictedArea($user, $features, $objectid = 0, $tableandshare = '', $f
 	}
 
 	if ($dbt_select != 'rowid' && $dbt_select != 'id') {
-		$objectid = "'".$objectid."'";
+		$objectid = "'".$db->escape($objectid)."'";
 	}
 
 	// Features/modules to check