-
Notifications
You must be signed in to change notification settings - Fork 3.4k
Closed
Description
-
bug
-
CakePHP Version: 3.1 to 3.5
-
Platform and Target: ORM
What you did
It is possible to execute SQL sentences after "order" clause
Examples:
$query = $this->Assets->find('all',array(
'contain' => array(
'Attributes' => array(
'sort' => array(
'Attributes.name' => "DESC; UPDATE assets SET name = 'inject' WHERE id = 1"
)
)
),
'order' => array(
'name' => "DESC; UPDATE assets SET name = 'inject' WHERE id = 1"
)
));What happened
SQL UPDATE executed!
What you expected to happen
I expected that it doesn't possible!
inoas