From 4d9e662ba9739c89c15e68662dce8fd55f5c1d5b Mon Sep 17 00:00:00 2001
From: kindlm <kindlm@technikum-wien.at>
Date: Wed, 2 Nov 2016 13:35:45 +0100
Subject: [PATCH] =?UTF-8?q?SQL-Injection=20L=C3=BCcke=20geschlossen?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 include/organisationseinheit.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/organisationseinheit.class.php b/include/organisationseinheit.class.php
index e6e0c4bd3..43322b1d6 100644
--- a/include/organisationseinheit.class.php
+++ b/include/organisationseinheit.class.php
@@ -572,7 +572,7 @@ class organisationseinheit extends basis_db
 	    		foreach($searchItem as $value)
 				{
 					$qry.=' OR (LOWER(oe_kurzbz)=LOWER('.$this->db_add_param($value).'))
-							OR (LOWER(bezeichnung)=LOWER('.$this->db_add_param($value).'))'; 
+							OR (LOWER(bezeichnung) LIKE LOWER(\'%'.$this->db_escape($value).'%\'))'; 
 				}
 	    $qry.=	' ORDER BY organisationseinheittyp_kurzbz, bezeichnung;';