(ofbiz-framework) branch release24.09 updated: Fixed: DELETE statements built from EntityCondition inlined values as SQL literals instead of binding them (OFBIZ-13620)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new f802cbcc43 Fixed: DELETE statements built from EntityCondition inlined 
values as SQL literals instead of binding them (OFBIZ-13620)
f802cbcc43 is described below

commit f802cbcc432b4a8c294adaa401ac3861314854e1
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sun Sep 27 13:06:18 2026 +0530

    Fixed: DELETE statements built from EntityCondition inlined values as SQL 
literals instead of binding them (OFBIZ-13620)
    
    GenericDAO.deleteByCondition() called condition.makeWhereString() with a
    null EntityConditionParam list, which caused every value in the generated
    DELETE's WHERE clause to be inlined into the SQL text as a literal instead
    of bound as a JDBC parameter, the same way the existing SELECT/UPDATE code
    paths in this class already do.
    
    Build and bind a real EntityConditionParam list instead, mirroring
    updateByCondition's existing pattern.
---
 .../main/java/org/apache/ofbiz/entity/datasource/GenericDAO.java    | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git 
a/framework/entity/src/main/java/org/apache/ofbiz/entity/datasource/GenericDAO.java
 
b/framework/entity/src/main/java/org/apache/ofbiz/entity/datasource/GenericDAO.java
index fbc0395038..d13c8af871 100644
--- 
a/framework/entity/src/main/java/org/apache/ofbiz/entity/datasource/GenericDAO.java
+++ 
b/framework/entity/src/main/java/org/apache/ofbiz/entity/datasource/GenericDAO.java
@@ -1375,11 +1375,15 @@ public class GenericDAO {
 
         StringBuilder sql = new StringBuilder("DELETE FROM 
").append(modelEntity.getTableName(this.datasource));
 
-        String whereCondition = condition.makeWhereString(modelEntity, null, 
this.datasource, sqlP.getDelegator());
+        List<EntityConditionParam> params = new LinkedList<>();
+        String whereCondition = condition.makeWhereString(modelEntity, params, 
this.datasource, sqlP.getDelegator());
         if (UtilValidate.isNotEmpty(whereCondition)) {
             sql.append(" WHERE ").append(whereCondition);
         }
         sqlP.prepareStatement(sql.toString());
+        for (EntityConditionParam param : params) {
+            SqlJdbcUtil.setValue(sqlP, param.getModelField(), 
modelEntity.getEntityName(), param.getFieldValue(), modelFieldTypeReader);
+        }
 
         return sqlP.executeUpdate();
     }