From ddee97f828527f0a5376aa0985598a753f44eb36 Mon Sep 17 00:00:00 2001
From: Mitch Gaffigan <mitch.gaffigan@comcast.net>
Date: Tue, 27 Oct 2026 19:53:02 -0500
Subject: [PATCH] Fix authenticated sqli

Signed-off-by: Mitch Gaffigan <mitch.gaffigan@comcast.net>
---
 server/dbconf/derby/derby-event.xml | 2 +-
 server/dbconf/mysql/mysql-event.xml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/dbconf/derby/derby-event.xml b/server/dbconf/derby/derby-event.xml
index 7df3aa6a4e..15c8c611bd 100644
--- a/server/dbconf/derby/derby-event.xml
+++ b/server/dbconf/derby/derby-event.xml
@@ -17,7 +17,7 @@
 	  	 <if test='maxEventId != null'>AND ID &lt;= #{maxEventId}</if>
 	  	 <if test='minEventId != null'>AND ID &gt;= #{minEventId}</if>
          <if test='id != null'>AND ID = #{id}</if>
-         <if test='name != null'>AND LOWER(NAME) LIKE LOWER('%${name}%')</if>
+         <if test='name != null'>AND LOWER(NAME) LIKE LOWER('%' || #{name} || '%')</if>
          <if test="levels != null">
 				AND EVENT_LEVEL IN
 				<foreach item="level" collection="levels" open="(" separator="," close=")">
diff --git a/server/dbconf/mysql/mysql-event.xml b/server/dbconf/mysql/mysql-event.xml
index 03ad82fe8b..5538ecf28f 100644
--- a/server/dbconf/mysql/mysql-event.xml
+++ b/server/dbconf/mysql/mysql-event.xml
@@ -17,7 +17,7 @@
 	  	 <if test='maxEventId != null'>AND ID <![CDATA[ <= ]]> #{maxEventId}</if>
 	  	 <if test='minEventId != null'>AND ID <![CDATA[ >= ]]> #{minEventId}</if>
          <if test='id != null'>AND ID = #{id}</if>
-         <if test='name != null'>AND LOWER(NAME) LIKE LOWER('%${name}%')</if>
+         <if test='name != null'>AND LOWER(NAME) LIKE LOWER(CONCAT('%', #{name}, '%'))</if>
          <if test="levels != null">
 				AND EVENT_LEVEL IN
 				<foreach item="level" collection="levels" open="(" separator="," close=")">