Merge pull request #85 from nextcloud/backport/84/proper-column-name-…

…escaping [stable14] Properly escape column name in "createFunction" call
nextcloud · Oct 19, 2018 · 34f152b · 34f152b
2 parents 033f72c + 18040d4
commit 34f152b
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/lib/Categories/Stats.php b/lib/Categories/Stats.php
@@ -125,11 +125,11 @@ protected function countStorages($type) {
 	 * @return int
 	 */
 	protected function countEntries($tableName, $column = '*') {
+		$query = $this->connection->getQueryBuilder();
+
 		if ($column !== '*') {
-			$column = 'DISTINCT(' . $column . ')';
+			$column = 'DISTINCT(' . $query->getColumnName($column ) . ')';
 		}
-
-		$query = $this->connection->getQueryBuilder();
 		$query->selectAlias($query->createFunction('COUNT(' . $column . ')'), 'num_entries')
 			->from($tableName);
 		$result = $query->execute();