From dabda0585777351703fbacfe870b7ea78db91528 Mon Sep 17 00:00:00 2001 From: Valeri Sokolov Date: Sat, 24 Jan 2026 10:59:10 +0000 Subject: [PATCH] fix(criteria): use query parameters Signed-off-by: Valeri Sokolov --- persistence/playlist_repository.go | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/persistence/playlist_repository.go b/persistence/playlist_repository.go index ddefcd7a8..6967014f9 100644 --- a/persistence/playlist_repository.go +++ b/persistence/playlist_repository.go @@ -260,15 +260,15 @@ func (r *playlistRepository) refreshSmartPlaylist(pls *model.Playlist) bool { } sq := Select("row_number() over (order by "+rules.OrderBy()+") as id", "'"+pls.ID+"' as playlist_id", "media_file.id as media_file_id"). - From("media_file").LeftJoin("annotation on (" + - "annotation.item_id = media_file.id" + - " AND annotation.item_type = 'media_file'" + - " AND annotation.user_id = '" + usr.ID + "')"). + From("media_file").LeftJoin("annotation on ("+ + "annotation.item_id = media_file.id"+ + " AND annotation.item_type = 'media_file'"+ + " AND annotation.user_id = ?)", usr.ID). LeftJoin("album on (album.id = media_file.album_id)"). LeftJoin("annotation as album_annotation on ("+ - "album_annotation.item_id = album.id" + - " AND album_annotation.item_type = 'album'" + - " AND album_annotation.user_id = '" + usr.ID + "')") + "album_annotation.item_id = album.id"+ + " AND album_annotation.item_type = 'album'"+ + " AND album_annotation.user_id = ?)", usr.ID) // Only include media files from libraries the user has access to sq = r.applyLibraryFilter(sq, "media_file")