[Bug]: Use parameters for joins in Customer Segment (#549)

* Use parameters for joins * Use array_keys * Set param type * Use non deprecated version
pimcore · Jan 23, 2025 · a49b322 · a49b322
1 parent 0998ce4
commit a49b322
Showing 1 changed file with 16 additions and 4 deletions.
diff --git a/src/CustomerList/Filter/CustomerSegment.php b/src/CustomerList/Filter/CustomerSegment.php
@@ -18,7 +18,12 @@
 use CustomerManagementFrameworkBundle\Listing\Filter\AbstractFilter;
 use CustomerManagementFrameworkBundle\Listing\Filter\OnCreateQueryFilterInterface;
 use CustomerManagementFrameworkBundle\Service\MariaDb;
+use Doctrine\DBAL\ArrayParameterType;
+use Doctrine\DBAL\Connection;
+use Doctrine\DBAL\ParameterType;
 use Doctrine\DBAL\Query\QueryBuilder;
+use Exception;
+use InvalidArgumentException;
 use Pimcore\Model\DataObject;
 use Pimcore\Model\DataObject\Listing as CoreListing;
 
@@ -119,7 +124,7 @@ protected function addCustomerSegment(DataObject\CustomerSegment $segment)
     {
         if ($segment->getGroup() && null !== $this->segmentGroup) {
             if ($segment->getGroup()->getId() !== $this->segmentGroup->getId()) {
-                throw new \InvalidArgumentException('Segment does not belong to the defined segment group');
+                throw new InvalidArgumentException('Segment does not belong to the defined segment group');
             }
         }
 
@@ -187,6 +192,7 @@ protected function applyAndQuery(CoreListing\Concrete $listing, QueryBuilder $qu
      *
      * @param string $joinName
      * @param int|array $conditionValue
+     * @throws Exception
      */
     protected function addJoin(
         CoreListing\Concrete $listing,
@@ -212,21 +218,25 @@ protected function addJoin(
         );
 
         $condition = $baseCondition;
-
+        $valuePlaceholder = $joinName . '_value';
+        $parameterType = ParameterType::INTEGER;
         if ($this->type === self::OPERATOR_OR) {
             // must match any of the passed IDs
             $condition .= sprintf(
                 ' AND %1$s.dest_id IN (%2$s)',
                 $joinName,
-                implode(',', $conditionValue)
+                ':' . $valuePlaceholder
             );
+            $value = array_keys($conditionValue);
+            $parameterType = ArrayParameterType::INTEGER;
         } else {
             // runs an extra join for every ID - all joins must match
             $condition .= sprintf(
                 ' AND %1$s.dest_id = %2$s',
                 $joinName,
-                $conditionValue
+                ':' . $valuePlaceholder
             );
+            $value = $conditionValue;
         }
 
         $queryBuilder->join(
@@ -235,5 +245,7 @@ protected function addJoin(
             $joinName,
             $condition
         );
+
+        $queryBuilder->setParameter($valuePlaceholder, $value, $parameterType);
     }
 }