From: Aron Roberts <aron@socrates.berkeley.edu>
Date: Tue, 26 Mar 2013 18:33:52 +0000 (-0700)
Subject: CSPACE-5974: Correction to SQL query; table name should not be a replaceable paramete... 
X-Git-Url: https://git.aero2k.de/?a=commitdiff_plain;h=2469bcb4c17f1cc781c1369ca0947750d12f991b;p=tmp%2Fjakarta-migration.git

CSPACE-5974: Correction to SQL query; table name should not be a replaceable parameter in a prepared statement.
---

diff --git a/services/common/src/main/java/org/collectionspace/services/nuxeo/client/java/RepositoryJavaClientImpl.java b/services/common/src/main/java/org/collectionspace/services/nuxeo/client/java/RepositoryJavaClientImpl.java
index 60c2af0dd..5bba1a706 100644
--- a/services/common/src/main/java/org/collectionspace/services/nuxeo/client/java/RepositoryJavaClientImpl.java
+++ b/services/common/src/main/java/org/collectionspace/services/nuxeo/client/java/RepositoryJavaClientImpl.java
@@ -936,7 +936,7 @@ public class RepositoryJavaClientImpl implements RepositoryClient<PoxPayloadIn,
                 + " FROM hierarchy "
                 + " LEFT JOIN hierarchy h1 "
 	        + "   ON h1.parentid = hierarchy.id "
-                + " LEFT JOIN ? tg "
+                + " LEFT JOIN " + termGroupTableName + " tg "
 	        + "   ON tg.id = h1.id "
                 + " WHERE tg.termdisplayname ILIKE ?";
         
@@ -945,8 +945,7 @@ public class RepositoryJavaClientImpl implements RepositoryClient<PoxPayloadIn,
             protected void preparePrepared(PreparedStatement preparedStatement)
                 throws SQLException
             {
-                preparedStatement.setString(1, termGroupTableName);
-                preparedStatement.setString(2, partialTerm + JDBCTools.SQL_WILDCARD);
+                preparedStatement.setString(1, partialTerm + JDBCTools.SQL_WILDCARD);
             }};
 
         List<String> docIds = new ArrayList<String>();