From 2469bcb4c17f1cc781c1369ca0947750d12f991b Mon Sep 17 00:00:00 2001
From: Aron Roberts <aron@socrates.berkeley.edu>
Date: Tue, 26 Mar 2013 11:33:52 -0700
Subject: [PATCH] CSPACE-5974: Correction to SQL query; table name should not
 be a replaceable parameter in a prepared statement.

---
 .../services/nuxeo/client/java/RepositoryJavaClientImpl.java | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/services/common/src/main/java/org/collectionspace/services/nuxeo/client/java/RepositoryJavaClientImpl.java b/services/common/src/main/java/org/collectionspace/services/nuxeo/client/java/RepositoryJavaClientImpl.java
index 60c2af0dd..5bba1a706 100644
--- a/services/common/src/main/java/org/collectionspace/services/nuxeo/client/java/RepositoryJavaClientImpl.java
+++ b/services/common/src/main/java/org/collectionspace/services/nuxeo/client/java/RepositoryJavaClientImpl.java
@@ -936,7 +936,7 @@ public class RepositoryJavaClientImpl implements RepositoryClient<PoxPayloadIn,
                 + " FROM hierarchy "
                 + " LEFT JOIN hierarchy h1 "
 	        + "   ON h1.parentid = hierarchy.id "
-                + " LEFT JOIN ? tg "
+                + " LEFT JOIN " + termGroupTableName + " tg "
 	        + "   ON tg.id = h1.id "
                 + " WHERE tg.termdisplayname ILIKE ?";
         
@@ -945,8 +945,7 @@ public class RepositoryJavaClientImpl implements RepositoryClient<PoxPayloadIn,
             protected void preparePrepared(PreparedStatement preparedStatement)
                 throws SQLException
             {
-                preparedStatement.setString(1, termGroupTableName);
-                preparedStatement.setString(2, partialTerm + JDBCTools.SQL_WILDCARD);
+                preparedStatement.setString(1, partialTerm + JDBCTools.SQL_WILDCARD);
             }};
 
         List<String> docIds = new ArrayList<String>();
-- 
2.47.3