CVE-2022-31058 (published 2022-06-29T18:15Z)

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tuleap does not sanitize properly user inputs when constructing the SQL query to retrieve data for the tracker reports. An attacker with the capability to create a new tracker can execute arbitrary SQL queries. Users are advised to upgrade. There is no known workaround for this issue.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Enalean/tuleap
commit_details: repo_url: https://github.com/Enalean/tuleap
author: Thomas Gerbet
author_date: 2022-06-09 17:49:25+02:00
msg: request #27166: Naming a field "id" breaks the report

Field names are now prefixed in the SQL query in order to avoid conflict
with the static SQL columns we always retrieve.

Change-Id: I7eaaf95e24f52f6e52647d679b5058bc09139b5f
repository: repo_url: https://github.com/Enalean/tuleap
repo_name: Enalean/tuleap
description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. With a single web-based solution, project managers, developers & quality managers can easily build, deploy software projects.
repo_language: PHP
owner: Enalean
file_changes: filename: Burnup.php
change_type: ModificationType.MODIFY
diff: @@ -285,8 +285,9 @@ class Burnup extends Tracker_FormElement_Field implements Tracker_FormElement_Fi
     {
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
+        return '';
     }
 
     public function getRESTValue(PFUser $user, Tracker_Artifact_Changeset $changeset)

programming_language: PHP
filename: StepExecution.php
change_type: ModificationType.MODIFY
diff: @@ -123,7 +123,7 @@ class StepExecution extends Tracker_FormElement_Field implements TrackerFormElem
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         return '';
     }

programming_language: PHP
filename: Tracker_FormElement_Field.php
change_type: ModificationType.MODIFY
diff: @@ -41,6 +41,8 @@ use Tuleap\Tracker\Workflow\SimpleMode\State\TransitionRetriever;
 // phpcs:ignore PSR1.Classes.ClassDeclaration.MissingNamespace, Squiz.Classes.ValidClassName.NotCamelCaps
 abstract class Tracker_FormElement_Field extends Tracker_FormElement implements Tracker_Report_Field, Tracker_FormElement_IAcceptFieldVisitor
 {
+    public const PREFIX_NAME_SQL_COLUMN = 'user_defined_';
+
     protected $has_errors = false;
 
     /**
@@ -203,15 +205,19 @@ abstract class Tracker_FormElement_Field extends Tracker_FormElement implements
         $this->updateCriteriaValue($criteria, $value);
     }
 
+    final public function getQuerySelectName(): string
+    {
+        return \Tuleap\DB\DBFactory::getMainTuleapDBConnection()->getDB()->escapeIdentifier(self::PREFIX_NAME_SQL_COLUMN . $this->name);
+    }
+
     /**
      * Get the "select" statement to retrieve field values
-     * @return string
      * @see getQueryFrom
      */
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         $R = 'R_' . $this->id;
-        return "$R.value_id AS `" . $this->name . "`";
+        return "$R.value_id AS " . $this->getQuerySelectName();
     }
 
     /**
@@ -229,15 +235,15 @@ abstract class Tracker_FormElement_Field extends Tracker_FormElement implements
     /**
      * Get the "order by" statement to retrieve field values
      */
-    public function getQueryOrderby()
+    public function getQueryOrderby(): string
     {
-        return '`' . $this->name . '`';
+        return $this->getQuerySelectName();
     }
 
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
         $R = 'R_' . $this->id;
         return "$R.value_id";

programming_language: PHP
filename: Tracker_FormElement_Field_Alphanum.php
change_type: ModificationType.MODIFY
diff: @@ -70,9 +70,8 @@ abstract class Tracker_FormElement_Field_Alphanum extends Tracker_FormElement_Fi
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
-        $R1 = 'R1_' . $this->id;
         $R2 = 'R2_' . $this->id;
         return "$R2.value";
     }

programming_language: PHP
filename: Tracker_FormElement_Field_ArtifactId.php
change_type: ModificationType.MODIFY
diff: @@ -38,9 +38,9 @@ class Tracker_FormElement_Field_ArtifactId extends Tracker_FormElement_Field_Int
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
-        return "a.id AS `" . $this->name . "`";
+        return "a.id AS " . $this->getQuerySelectName();
     }
 
     public function getQueryFrom()
@@ -51,7 +51,7 @@ class Tracker_FormElement_Field_ArtifactId extends Tracker_FormElement_Field_Int
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
         return "a.id";
     }

programming_language: PHP
filename: Tracker_FormElement_Field_ArtifactLink.php
change_type: ModificationType.MODIFY
diff: @@ -418,7 +418,7 @@ class Tracker_FormElement_Field_ArtifactLink extends Tracker_FormElement_Field
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         return '';
     }

programming_language: PHP
filename: Tracker_FormElement_Field_Burndown.php
change_type: ModificationType.MODIFY
diff: @@ -447,8 +447,9 @@ class Tracker_FormElement_Field_Burndown extends Tracker_FormElement_Field imple
     {
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
+        return '';
     }
 
     public function getQueryFrom()

programming_language: PHP
filename: Tracker_FormElement_Field_Computed.php
change_type: ModificationType.MODIFY
diff: @@ -627,7 +627,7 @@ class Tracker_FormElement_Field_Computed extends Tracker_FormElement_Field_Float
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         return '';
     }

programming_language: PHP
filename: Tracker_FormElement_Field_CrossReferences.php
change_type: ModificationType.MODIFY
diff: @@ -139,7 +139,7 @@ class Tracker_FormElement_Field_CrossReferences extends Tracker_FormElement_Fiel
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         return '';
     }

programming_language: PHP
filename: Tracker_FormElement_Field_Date.php
change_type: ModificationType.MODIFY
diff: @@ -413,11 +413,10 @@ class Tracker_FormElement_Field_Date extends Tracker_FormElement_Field
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
-        $R1 = 'R1_' . $this->id;
         $R2 = 'R2_' . $this->id;
-        return "$R2.value AS `" . $this->name . "`";
+        return "$R2.value AS " . $this->getQuerySelectName();
     }
 
     public function getQueryFrom()
@@ -432,9 +431,8 @@ class Tracker_FormElement_Field_Date extends Tracker_FormElement_Field
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
-        $R1 = 'R1_' . $this->id;
         $R2 = 'R2_' . $this->id;
         return "$R2.value";
     }

programming_language: PHP
filename: Tracker_FormElement_Field_File.php
change_type: ModificationType.MODIFY
diff: @@ -69,7 +69,7 @@ class Tracker_FormElement_Field_File extends Tracker_FormElement_Field
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         return '';
     }

programming_language: PHP
filename: Tracker_FormElement_Field_LastModifiedBy.php
change_type: ModificationType.MODIFY
diff: @@ -67,9 +67,9 @@ class Tracker_FormElement_Field_LastModifiedBy extends Tracker_FormElement_Field
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
-        return "c.submitted_by AS `" . $this->name . "`";
+        return "c.submitted_by AS " . $this->getQuerySelectName();
     }
 
     public function getQueryFrom()
@@ -84,16 +84,11 @@ class Tracker_FormElement_Field_LastModifiedBy extends Tracker_FormElement_Field
         return " LEFT JOIN  user AS $R2 ON ($R2.user_id = c.submitted_by ) ";
     }
 
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
         return '';
     }
 
-    public function getQueryOrderby()
-    {
-        return $this->name;
-    }
-
     public static function getFactoryLabel()
     {
         return dgettext('tuleap-tracker', 'Last Updated By');

programming_language: PHP
filename: Tracker_FormElement_Field_LastUpdateDate.php
change_type: ModificationType.MODIFY
diff: @@ -68,10 +68,10 @@ class Tracker_FormElement_Field_LastUpdateDate extends Tracker_FormElement_Field
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         //Last update date is stored in the changeset (the date of the changeset)
-        return "c.submitted_on AS `" . $this->name . "`";
+        return "c.submitted_on AS " . $this->getQuerySelectName();
     }
 
     public function getQueryFrom()
@@ -83,7 +83,7 @@ class Tracker_FormElement_Field_LastUpdateDate extends Tracker_FormElement_Field
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
         //Last update date is stored in the changeset (the date of the changeset)
         return 'c.submitted_on';

programming_language: PHP
filename: Tracker_FormElement_Field_List.php
change_type: ModificationType.MODIFY
diff: @@ -162,9 +162,8 @@ abstract class Tracker_FormElement_Field_List extends Tracker_FormElement_Field
      *
      * @see getQueryFrom
      *
-     * @return string
      */
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         return $this->getBind()->getQuerySelect();
     }
@@ -205,7 +204,7 @@ abstract class Tracker_FormElement_Field_List extends Tracker_FormElement_Field
     /**
      * Get the "order by" statement to retrieve field values
      */
-    public function getQueryOrderby()
+    public function getQueryOrderby(): string
     {
         return $this->getBind()->getQueryOrderby();
     }
@@ -213,7 +212,7 @@ abstract class Tracker_FormElement_Field_List extends Tracker_FormElement_Field
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
         return $this->getBind()->getQueryGroupby();
     }

programming_language: PHP
filename: Tracker_FormElement_Field_List_Bind.php
change_type: ModificationType.MODIFY
diff: @@ -326,10 +326,9 @@ abstract class Tracker_FormElement_Field_List_Bind implements //phpcs:ignore PSR
 
     /**
      * Get the "select" statement to retrieve field values
-     * @return string
      * @see getQueryFrom
      */
-    abstract public function getQuerySelect();
+    abstract public function getQuerySelect(): string;
 
     /**
      * Get the "select" statement to retrieve field values with their decorator if they exist
@@ -393,12 +392,12 @@ abstract class Tracker_FormElement_Field_List_Bind implements //phpcs:ignore PSR
     /**
      * Get the "order by" statement to retrieve field values
      */
-    abstract public function getQueryOrderby();
+    abstract public function getQueryOrderby(): string;
 
     /**
      * Get the "group by" statement to retrieve field values
      */
-    abstract public function getQueryGroupby();
+    abstract public function getQueryGroupby(): string;
 
     public function getSelectOptionStyles($value_id)
     {

programming_language: PHP
filename: Tracker_FormElement_Field_List_Bind_Null.php
change_type: ModificationType.MODIFY
diff: @@ -150,10 +150,9 @@ class Tracker_FormElement_Field_List_Bind_Null extends Tracker_FormElement_Field
 
     /**
      * Get the "select" statement to retrieve field values
-     * @return string
      * @see getQueryFrom
      */
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         return '';
     }
@@ -205,7 +204,7 @@ class Tracker_FormElement_Field_List_Bind_Null extends Tracker_FormElement_Field
     /**
      * Get the "order by" statement to retrieve field values
      */
-    public function getQueryOrderby()
+    public function getQueryOrderby(): string
     {
         return '';
     }
@@ -213,7 +212,7 @@ class Tracker_FormElement_Field_List_Bind_Null extends Tracker_FormElement_Field
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
         return '';
     }

programming_language: PHP
filename: Tracker_FormElement_Field_List_Bind_Static.php
change_type: ModificationType.MODIFY
diff: @@ -274,14 +274,12 @@ class Tracker_FormElement_Field_List_Bind_Static extends Tracker_FormElement_Fie
 
     /**
      * Get the "select" statement to retrieve field values
-     * @return string
      * @see getQueryFrom
      */
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
-        $R1 = 'R1_' . $this->field->id;
         $R2 = 'R2_' . $this->field->id;
-        return "$R2.id AS `" . $this->field->name . "`";
+        return "$R2.id AS " . $this->field->getQuerySelectName();
     }
 
     /**
@@ -334,9 +332,8 @@ class Tracker_FormElement_Field_List_Bind_Static extends Tracker_FormElement_Fie
     /**
      * Get the "order by" statement to retrieve field values
      */
-    public function getQueryOrderby()
+    public function getQueryOrderby(): string
     {
-        $R1 = 'R1_' . $this->field->id;
         $R2 = 'R2_' . $this->field->id;
         return $this->is_rank_alpha ? "$R2.label" : "$R2.rank";
     }
@@ -344,9 +341,8 @@ class Tracker_FormElement_Field_List_Bind_Static extends Tracker_FormElement_Fie
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
-        $R1 = 'R1_' . $this->field->id;
         $R2 = 'R2_' . $this->field->id;
         return "$R2.id";
     }

programming_language: PHP
filename: Tracker_FormElement_Field_List_Bind_Ugroups.php
change_type: ModificationType.MODIFY
diff: @@ -225,15 +225,12 @@ class Tracker_FormElement_Field_List_Bind_Ugroups extends Tracker_FormElement_Fi
 
     /**
      * Get the "select" statement to retrieve field values
-     * @return string
      * @see getQueryFrom
      */
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
-        $R1 = 'R1_' . $this->field->id;
         $R2 = 'R2_' . $this->field->id;
-        $R3 = 'R3_' . $this->field->id;
-        return "$R2.id AS `" . $this->field->name . "`";
+        return "$R2.id AS " . $this->field->getQuerySelectName();
     }
 
     /**
@@ -265,10 +262,8 @@ class Tracker_FormElement_Field_List_Bind_Ugroups extends Tracker_FormElement_Fi
     /**
      * Get the "order by" statement to retrieve field values
      */
-    public function getQueryOrderby()
+    public function getQueryOrderby(): string
     {
-        $uh = UserHelper::instance();
-        $R1 = 'R1_' . $this->field->id;
         $R2 = 'R2_' . $this->field->id;
         return "$R2.ugroup_id";
     }
@@ -276,9 +271,8 @@ class Tracker_FormElement_Field_List_Bind_Ugroups extends Tracker_FormElement_Fi
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
-        $R1 = 'R1_' . $this->field->id;
         $R2 = 'R2_' . $this->field->id;
         return "$R2.id";
     }

programming_language: PHP
filename: Tracker_FormElement_Field_List_Bind_Users.php
change_type: ModificationType.MODIFY
diff: @@ -418,15 +418,12 @@ class Tracker_FormElement_Field_List_Bind_Users extends Tracker_FormElement_Fiel
 
     /**
      * Get the "select" statement to retrieve field values
-     * @return string
      * @see getQueryFrom
      */
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
-        $R1 = 'R1_' . $this->field->id;
         $R2 = 'R2_' . $this->field->id;
-        $R3 = 'R3_' . $this->field->id;
-        return "$R2.user_id AS `" . $this->field->name . "`";
+        return "$R2.user_id AS " . $this->field->getQuerySelectName();
     }
 
     /**
@@ -452,10 +449,9 @@ class Tracker_FormElement_Field_List_Bind_Users extends Tracker_FormElement_Fiel
     /**
      * Get the "order by" statement to retrieve field values
      */
-    public function getQueryOrderby()
+    public function getQueryOrderby(): string
     {
         $uh = UserHelper::instance();
-        $R1 = 'R1_' . $this->field->id;
         $R2 = 'R2_' . $this->field->id;
         return $R2 . "." . str_replace('user.', '', $uh->getDisplayNameSQLOrder());
     }
@@ -463,9 +459,8 @@ class Tracker_FormElement_Field_List_Bind_Users extends Tracker_FormElement_Fiel
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
-        $R1 = 'R1_' . $this->field->id;
         $R2 = 'R2_' . $this->field->id;
         return "$R2.user_id";
     }

programming_language: PHP
filename: Tracker_FormElement_Field_Numeric.php
change_type: ModificationType.MODIFY
diff: @@ -84,11 +84,10 @@ abstract class Tracker_FormElement_Field_Numeric extends Tracker_FormElement_Fie
         return 0;
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
-        $R1 = 'R1_' . $this->id;
         $R2 = 'R2_' . $this->id;
-        return "$R2.value AS `" . $this->name . "`";
+        return "$R2.value AS " . $this->getQuerySelectName();
     }
 
     /**

programming_language: PHP
filename: Tracker_FormElement_Field_PerTrackerArtifactIdclass.php
change_type: ModificationType.MODIFY
diff: @@ -35,15 +35,15 @@ class Tracker_FormElement_Field_PerTrackerArtifactId extends Tracker_FormElement
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
-        return "a.per_tracker_artifact_id AS `" . $this->name . "`";
+        return "a.per_tracker_artifact_id AS " . $this->getQuerySelectName();
     }
 
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
         return "a.per_tracker_artifact_id";
     }

programming_language: PHP
filename: Tracker_FormElement_Field_PermissionsOnArtifact.php
change_type: ModificationType.MODIFY
diff: @@ -444,10 +444,9 @@ class Tracker_FormElement_Field_PermissionsOnArtifact extends Tracker_FormElemen
     }
 
      /**
-     * @return string
      * @see getQueryFrom
      */
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         return '';
     }

programming_language: PHP
filename: Tracker_FormElement_Field_Priority.php
change_type: ModificationType.MODIFY
diff: @@ -91,12 +91,11 @@ class Tracker_FormElement_Field_Priority extends Tracker_FormElement_Field_Integ
 
     /**
      * Get the "select" statement to retrieve field values
-     * @return string
      * @see getQueryFrom
      */
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
-        return "R_{$this->id}.rank AS `$this->name`";
+        return "R_{$this->id}.rank AS " . $this->getQuerySelectName();
     }
 
     /**

programming_language: PHP
filename: Tracker_FormElement_Field_SubmittedBy.php
change_type: ModificationType.MODIFY
diff: @@ -64,10 +64,10 @@ class Tracker_FormElement_Field_SubmittedBy extends Tracker_FormElement_Field_Li
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         // SubmittedOn is stored in the artifact
-        return "a.submitted_by AS `" . $this->name . "`";
+        return "a.submitted_by AS " . $this->getQuerySelectName();
     }
 
     public function getQueryFrom()
@@ -85,7 +85,7 @@ class Tracker_FormElement_Field_SubmittedBy extends Tracker_FormElement_Field_Li
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
         // SubmittedOn is stored in the artifact
         return 'a.submitted_by';
@@ -94,9 +94,9 @@ class Tracker_FormElement_Field_SubmittedBy extends Tracker_FormElement_Field_Li
     /**
      * Get the "order by" statement to retrieve field values
      */
-    public function getQueryOrderby()
+    public function getQueryOrderby(): string
     {
-        return $this->name;
+        return $this->getQuerySelectName();
     }
 
     public static function getFactoryLabel()

programming_language: PHP
filename: Tracker_FormElement_Field_SubmittedOn.php
change_type: ModificationType.MODIFY
diff: @@ -67,10 +67,10 @@ class Tracker_FormElement_Field_SubmittedOn extends Tracker_FormElement_Field_Da
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         // SubmittedOn is stored in the artifact
-        return "a.submitted_on AS `" . $this->name . "`";
+        return "a.submitted_on AS " . $this->getQuerySelectName();
     }
 
     public function getQueryFrom()
@@ -82,7 +82,7 @@ class Tracker_FormElement_Field_SubmittedOn extends Tracker_FormElement_Field_Da
     /**
      * Get the "group by" statement to retrieve field values
      */
-    public function getQueryGroupby()
+    public function getQueryGroupby(): string
     {
         // SubmittedOn is stored in the artifact
         return 'a.submitted_on';

programming_language: PHP
filename: Tracker_FormElement_Field_Text.php
change_type: ModificationType.MODIFY
diff: @@ -83,11 +83,10 @@ class Tracker_FormElement_Field_Text extends Tracker_FormElement_Field_Alphanum
         return '';
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
-        $R1 = 'R1_' . $this->id;
         $R2 = 'R2_' . $this->id;
-        return "$R2.value AS `" . $this->name . "`";
+        return "$R2.value AS " . $this->getQuerySelectName();
     }
 
     public function getQueryFrom()

programming_language: PHP
filename: Tracker_Report_Renderer_Table.class.php
change_type: ModificationType.MODIFY
diff: @@ -1213,7 +1213,7 @@ class Tracker_Report_Renderer_Table extends Tracker_Report_Renderer implements T
                     }
                     foreach ($columns as $key => $column) {
                         if ($column['field']->isUsed()) {
-                            $field_name = $column['field']->name;
+                            $field_name = Tracker_FormElement_Field::PREFIX_NAME_SQL_COLUMN . $column['field']->name;
                             $value      = isset($row[$field_name]) ? $row[$field_name] : null;
                             $html      .= '<td data-column-id="' . $purifier->purify($key) . '">';
 

programming_language: PHP
filename: Tracker_FormElement_Field_Encrypted.class.php
change_type: ModificationType.MODIFY
diff: @@ -185,11 +185,11 @@ class Tracker_FormElement_Field_Encrypted extends Tracker_FormElement_Field impl
                 ) ON ($R1.changeset_id = c.id AND $R1.field_id = " . $this->id . " )";
     }
 
-    public function getQuerySelect()
+    public function getQuerySelect(): string
     {
         $R2 = 'R2_' . $this->id;
 
-        return "$R2.value AS `" . $this->name . "`";
+        return "$R2.value AS " . $this->getQuerySelectName();
     }
 
     /**

programming_language: PHP