From 3c271da9b420af76d17e2b116978e82cfcec885b Mon Sep 17 00:00:00 2001
From: Michael Jumper <mike.jumper@guac-dev.org>
Date: Thu, 8 Oct 2015 17:54:43 -0700
Subject: [PATCH] GUAC-1193: Do not use <bind> within <foreach>, as it only
 substitutes the last bound value for *ALL* usages of the created variable. Do
 not use LIKE, as we would then have to escape the search term in Java.

---
 .../auth/jdbc/connection/ConnectionRecordMapper.xml    | 10 ++++------
 .../auth/jdbc/connection/ConnectionRecordMapper.xml    | 10 ++++------
 2 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/connection/ConnectionRecordMapper.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/connection/ConnectionRecordMapper.xml
index eeb00bca1..eaf69fffa 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/connection/ConnectionRecordMapper.xml
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-mysql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/connection/ConnectionRecordMapper.xml
@@ -88,19 +88,18 @@
         <!-- Search terms -->
         <foreach collection="terms" item="term"
                  open="WHERE " separator=" AND ">
-            <bind name="termPattern" value="'%' + term.term + '%'" />
             (
 
                 guacamole_connection_history.user_id IN (
                     SELECT user_id
                     FROM guacamole_user
-                    WHERE username LIKE #{termPattern,jdbcType=VARCHAR}
+                    WHERE POSITION(#{term.term,jdbcType=VARCHAR} IN username) > 0
                 )
 
                 OR guacamole_connection_history.connection_id IN (
                     SELECT connection_id
                     FROM guacamole_connection
-                    WHERE connection_name LIKE #{termPattern,jdbcType=VARCHAR}
+                    WHERE POSITION(#{term.term,jdbcType=VARCHAR} IN connection_name) > 0
                 )
 
                 <if test="term.startDate != null and term.endDate != null">
@@ -164,19 +163,18 @@
         <!-- Search terms -->
         <foreach collection="terms" item="term"
                  open="WHERE " separator=" AND ">
-            <bind name="termPattern" value="'%' + term.term + '%'" />
             (
 
                 guacamole_connection_history.user_id IN (
                     SELECT user_id
                     FROM guacamole_user
-                    WHERE username LIKE #{termPattern,jdbcType=VARCHAR}
+                    WHERE POSITION(#{term.term,jdbcType=VARCHAR} IN username) > 0
                 )
 
                 OR guacamole_connection_history.connection_id IN (
                     SELECT connection_id
                     FROM guacamole_connection
-                    WHERE connection_name LIKE #{termPattern,jdbcType=VARCHAR}
+                    WHERE POSITION(#{term.term,jdbcType=VARCHAR} IN connection_name) > 0
                 )
 
                 <if test="term.startDate != null and term.endDate != null">
diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/connection/ConnectionRecordMapper.xml b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/connection/ConnectionRecordMapper.xml
index 09641f2a1..a93679e82 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/connection/ConnectionRecordMapper.xml
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-postgresql/src/main/resources/org/glyptodon/guacamole/auth/jdbc/connection/ConnectionRecordMapper.xml
@@ -88,19 +88,18 @@
         <!-- Search terms -->
         <foreach collection="terms" item="term"
                  open="WHERE " separator=" AND ">
-            <bind name="termPattern" value="'%' + term.term + '%'" />
             (
 
                 guacamole_connection_history.user_id IN (
                     SELECT user_id
                     FROM guacamole_user
-                    WHERE username LIKE #{termPattern,jdbcType=VARCHAR}
+                    WHERE POSITION(#{term.term,jdbcType=VARCHAR} IN username) > 0
                 )
 
                 OR guacamole_connection_history.connection_id IN (
                     SELECT connection_id
                     FROM guacamole_connection
-                    WHERE connection_name LIKE #{termPattern,jdbcType=VARCHAR}
+                    WHERE POSITION(#{term.term,jdbcType=VARCHAR} IN connection_name) > 0
                 )
 
                 <if test="term.startDate != null and term.endDate != null">
@@ -164,19 +163,18 @@
         <!-- Search terms -->
         <foreach collection="terms" item="term"
                  open="WHERE " separator=" AND ">
-            <bind name="termPattern" value="'%' + term.term + '%'" />
             (
 
                 guacamole_connection_history.user_id IN (
                     SELECT user_id
                     FROM guacamole_user
-                    WHERE username LIKE #{termPattern,jdbcType=VARCHAR}
+                    WHERE POSITION(#{term.term,jdbcType=VARCHAR} IN username) > 0
                 )
 
                 OR guacamole_connection_history.connection_id IN (
                     SELECT connection_id
                     FROM guacamole_connection
-                    WHERE connection_name LIKE #{termPattern,jdbcType=VARCHAR}
+                    WHERE POSITION(#{term.term,jdbcType=VARCHAR} IN connection_name) > 0
                 )
 
                 <if test="term.startDate != null and term.endDate != null">