(ofbiz-framework) branch trunk updated: Fixed: DELETE statements built from EntityCondition inlined values as SQL literals instead of binding them (OFBIZ-13620)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 5400cf0708 Fixed: DELETE statements built from EntityCondition inlined 
values as SQL literals instead of binding them (OFBIZ-13620)
5400cf0708 is described below

commit 5400cf0708e896b55c913120a96352de56d3d101
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sun Sep 27 13:06:18 2026 +0530

    Fixed: DELETE statements built from EntityCondition inlined values as SQL 
literals instead of binding them (OFBIZ-13620)
    
    GenericDAO.deleteByCondition() called condition.makeWhereString() with a
    null EntityConditionParam list, which caused every value in the generated
    DELETE's WHERE clause to be inlined into the SQL text as a literal instead
    of bound as a JDBC parameter, the same way the existing SELECT/UPDATE code
    paths in this class already do.
    
    Build and bind a real EntityConditionParam list instead, mirroring
    updateByCondition's existing pattern.
---
 .../main/java/org/apache/ofbiz/entity/datasource/GenericDAO.java    | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git 
a/framework/entity/src/main/java/org/apache/ofbiz/entity/datasource/GenericDAO.java
 
b/framework/entity/src/main/java/org/apache/ofbiz/entity/datasource/GenericDAO.java
index 6833daa1f6..c53283306a 100644
--- 
a/framework/entity/src/main/java/org/apache/ofbiz/entity/datasource/GenericDAO.java
+++ 
b/framework/entity/src/main/java/org/apache/ofbiz/entity/datasource/GenericDAO.java
@@ -1427,11 +1427,15 @@ public class GenericDAO {
 
         StringBuilder sql = new StringBuilder("DELETE FROM 
").append(modelEntity.getTableName(this.datasource));
 
-        String whereCondition = condition.makeWhereString(modelEntity, null, 
this.datasource, sqlP.getDelegator());
+        List<EntityConditionParam> params = new LinkedList<>();
+        String whereCondition = condition.makeWhereString(modelEntity, params, 
this.datasource, sqlP.getDelegator());
         if (UtilValidate.isNotEmpty(whereCondition)) {
             sql.append(" WHERE ").append(whereCondition);
         }
         sqlP.prepareStatement(sql.toString());
+        for (EntityConditionParam param : params) {
+            SqlJdbcUtil.setValue(sqlP, param.getModelField(), 
modelEntity.getEntityName(), param.getFieldValue(), modelFieldTypeReader);
+        }
 
         return sqlP.executeUpdate();
     }