adamsaghy commented on code in PR #5417:
URL: https://github.com/apache/fineract/pull/5417#discussion_r2758378333
##########
fineract-provider/src/main/java/org/apache/fineract/infrastructure/campaigns/email/service/EmailReadPlatformServiceImpl.java:
##########
@@ -185,4 +178,16 @@ public Page<EmailData> retrieveEmailByStatus(final Integer
limit, final Integer
return this.paginationHelper.fetchPage(this.jdbcTemplate,
sqlBuilder.toString(),
new Object[] { status, fromDateString, toDateString },
this.emailRowMapper);
}
+
+ private Collection<EmailData> retrieveEmailByStatus(final Integer status,
final String sqlPlusLimit) {
+ String sql = "select " + this.emailRowMapper.schema() + " where
emo.status_enum = ?";
+ List<Object> args = new ArrayList<>();
+ args.add(status);
+
+ if (sqlPlusLimit != null) {
+ sql += sqlPlusLimit;
Review Comment:
No, that is not the problem.
The PR title says: use prepared statements. However, you are not using that
for the `sqlPlusLimit`... you are still just concatenate a string to the SQL
query itself. Please rewrite it to use prepared statements only and provide the
arguments only.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
