wambosec/csi-sqli-rl huggingface dataset:
Security advisory GHSA-h2fw-93qx-vrcq: SQL Injection in Moodle
Package: moodle/moodle (composer), vulnerable version: v3.11.5, fixed in: 3.11.6
CWE: CWE-89
Files changed by the fix:
badges/criteria/award_criteria_profile.php

Fix diff:
diff --git a/badges/criteria/award_criteria_profile.php b/badges/criteria/award_criteria_profile.php
index b014cf5a92b00..d3ac2f25556f8 100644
--- a/badges/criteria/award_criteria_profile.php
+++ b/badges/criteria/award_criteria_profile.php
@@ -39,6 +39,26 @@ class award_criteria_profile extends award_criteria {
     public $required_param = 'field';
     public $optional_params = array();
 
+    /* @var array The default profile fields allowed to be used as award criteria.
+     *
+     * Note: This is used instead of user_get_default_fields(), because it is not possible to
+     * determine which fields the user can modify.
+     */
+    protected $allowed_default_fields = [
+        'firstname',
+        'lastname',
+        'email',
+        'address',
+        'phone1',
+        'phone2',
+        'department',
+        'institution',
+        'description',
+        'picture',
+        'city',
+        'country',
+    ];
+
     /**
      * Add appropriate new criteria options to the form
      *
@@ -50,10 +70,7 @@ public function get_options(&$mform) {
         $none = true;
         $existing = array();
         $missing = array();
-
-        // Note: cannot use user_get_default_fields() here because it is not possible to decide which fields user can modify.
-        $dfields = array('firstname', 'lastname', 'email', 'address', 'phone1', 'phone2',
-                         'department', 'institution', 'description', 'picture', 'city', 'country');
+        $dfields = $this->allowed_default_fields;
 
         // Get custom fields.
         $cfields = array_filter(profile_get_custom_fields(), function($field) {
@@ -230,8 +247,8 @@ public function get_completed_criteria_sql() {
                 $join .= " LEFT JOIN {user_info_data} uid{$idx} ON uid{$idx}.userid = u.id AND uid{$idx}.fieldid = :fieldid{$idx} ";
                 $params["fieldid{$idx}"] = $param['field'];
                 $whereparts[] = "uid{$idx}.id IS NOT NULL";
-            } else {
-                // This is a field from {user} table.
+            } else if (in_array($param['field'], $this->allowed_default_fields)) {
+                // This is a valid field from {user} table.
                 if ($param['field'] == 'picture') {
                     // The picture field is numeric and requires special handling.
                     $whereparts[] = "u.{$param['field']} != 0";
Security advisory GHSA-h4ph-crvj-9h92: Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
Package: pimcore/admin-ui-classic-bundle (composer), vulnerable version: v2.3.4, fixed in: 2.3.6
CWE: CWE-89
Files changed by the fix:
src/Helper/Dashboard.php

Fix diff:
diff --git a/src/Helper/Dashboard.php b/src/Helper/Dashboard.php
index d8619c1ec..af3af0048 100644
--- a/src/Helper/Dashboard.php
+++ b/src/Helper/Dashboard.php
@@ -58,9 +58,12 @@ protected function loadFile(): ?array
 
         if (empty($this->dashboards)) {
             if (is_file($this->getConfigFile())) {
-                $dashboards = Serialize::unserialize(file_get_contents($this->getConfigFile()));
-                if (!empty($dashboards)) {
-                    $this->dashboards = $dashboards;
+                $dashboardFile = file_get_contents($this->getConfigFile());
+                if ($dashboardFile !== false) {
+                    $dashboards = unserialize($dashboardFile, ['allowed_classes' => false]);
+                    if (is_array($dashboards) && !empty($dashboards)) {
+                        $this->dashboards = $dashboards;
+                    }
                 }
             }
Security advisory GHSA-h63c-xvpf-264j: ADOdb SQL injection vulnerability
Package: adodb/adodb-php (composer), vulnerable version: v5.20.10, fixed in: 5.20.11
CWE: CWE-89
Files changed by the fix:
drivers/adodb-pdo_mysql.inc.php

Fix diff:
diff --git a/drivers/adodb-pdo_mysql.inc.php b/drivers/adodb-pdo_mysql.inc.php
index 7be0ef97a..663032b87 100644
--- a/drivers/adodb-pdo_mysql.inc.php
+++ b/drivers/adodb-pdo_mysql.inc.php
@@ -192,6 +192,8 @@ function SelectDB($dbName)
 	// parameters use PostgreSQL convention, not MySQL
 	function SelectLimit($sql, $nrows=-1, $offset=-1, $inputarr=false, $secs=0)
 	{
+		$nrows = (int) $nrows;
+		$offset = (int) $offset;		
 		$offsetStr =($offset>=0) ? "$offset," : '';
 		// jason judge, see http://phplens.com/lens/lensforum/msgs.php?id=9220
 		if ($nrows < 0) {
Security advisory GHSA-hhm6-jjf4-6pm3: Apache Airflow MySQL Provider is Vulnerable to SQL Injection
Package: apache-airflow-providers-mysql (pypi), vulnerable version: 6.1.0, fixed in: 6.2.0
CWE: CWE-89
Files changed by the fix:
providers/mysql/src/airflow/providers/mysql/hooks/mysql.py

Fix diff:
diff --git a/providers/mysql/src/airflow/providers/mysql/hooks/mysql.py b/providers/mysql/src/airflow/providers/mysql/hooks/mysql.py
index 05c851e7c5d76..da18d9d0bafb9 100644
--- a/providers/mysql/src/airflow/providers/mysql/hooks/mysql.py
+++ b/providers/mysql/src/airflow/providers/mysql/hooks/mysql.py
@@ -240,8 +240,14 @@ def get_conn(self) -> MySQLConnectionTypes:
 
     def bulk_load(self, table: str, tmp_file: str) -> None:
         """Load a tab-delimited file into a database table."""
+        import re
+
         conn = self.get_conn()
         cur = conn.cursor()
+
+        if not re.fullmatch(r"^[a-zA-Z0-9_.]+$", table):
+            raise ValueError(f"Invalid table name: {table}")
+
         cur.execute(
             f"LOAD DATA LOCAL INFILE %s INTO TABLE {table}",
             (tmp_file,),
Security advisory GHSA-hq25-vp56-qr86: Bacula-web SQL Injection Vulnerability
Package: bacula-web/bacula-web (composer), vulnerable version: v9.7.0, fixed in: 9.7.1
CWE: CWE-89
Files changed by the fix:
application/Table/JobFileTable.php

Fix diff:
diff --git a/application/Table/JobFileTable.php b/application/Table/JobFileTable.php
index 5b0c4347..0cfa3b39 100644
--- a/application/Table/JobFileTable.php
+++ b/application/Table/JobFileTable.php
@@ -61,7 +61,8 @@ public function getJobFiles($jobId, $limit, $offset, string $filename = '')
             $fields = array('Job.Name', 'Job.JobStatus', 'File.FileIndex', 'Path.Path', 'Filename.Name AS Filename');
             $where = array("File.JobId = $jobId");
             if (! empty($filename)) {
-                $where[] = "(Filename.Name LIKE '%$filename%' OR Path.Path LIKE '%$filename%' OR concat(Path.Path, '', Filename.Name) = '$filename')";
+                $this->addParameter('filename', '%'.$filename.'%');
+                $where[] = "(Filename.Name LIKE :filename OR Path.Path LIKE :filename OR concat(Path.Path, '', Filename.Name) = :filename)";
             }
 
             $orderby = 'File.FileIndex ASC';
@@ -84,7 +85,8 @@ public function getJobFiles($jobId, $limit, $offset, string $filename = '')
             $where = ["File.JobId = $jobId"];
 
             if (!empty($filename)) {
-                $where[] = "(File.Filename LIKE '%$filename%' OR Path.Path LIKE '%$filename%' OR concat(Path.Path, '', File.Filename) = '$filename')";
+                $this->addParameter('filename', '%'.$filename.'%');
+                $where[] = "(File.Filename LIKE :filename OR Path.Path LIKE :filename OR concat(Path.Path, '', File.Filename) = :filename)";
             }
 
             $orderby = 'File.FileIndex ASC';
Security advisory GHSA-j259-6c58-9m58: loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter
Package: loopback-connector-postgresql (npm), vulnerable version: 5.5.0, fixed in: 5.5.1
CWE: CWE-20
CWE-89
Files changed by the fix:
lib/postgresql.js

Fix diff:
diff --git a/lib/postgresql.js b/lib/postgresql.js
index 8ba9724e..8cb28a72 100644
--- a/lib/postgresql.js
+++ b/lib/postgresql.js
@@ -545,10 +545,11 @@ PostgreSQL.prototype.buildExpression = function(columnName, operator,
       return new ParameterizedSQL(columnName + regexOperator,
         [operatorValue.source]);
     case 'contains':
-      return new ParameterizedSQL(columnName + ' @> array[' + operatorValue.map((v) => `'${v}'`) + ']::'
-        + propertyDefinition.postgresql.dataType);
+      return new ParameterizedSQL(columnName + ' @> array[' + operatorValue.map(() => '?') + ']::'
+        + propertyDefinition.postgresql.dataType,
+        operatorValue);
     case 'match':
-      return new ParameterizedSQL(`to_tsvector(${columnName}) @@ to_tsquery('${operatorValue}')`);
+      return new ParameterizedSQL(`to_tsvector(${columnName}) @@ to_tsquery(?)`, [operatorValue]);
     default:
       // invoke the base implementation of `buildExpression`
       return this.invokeSuper('buildExpression', columnName, operator,
Security advisory GHSA-j6cv-98jx-mrwr: Mocodo vulnerable to SQL injection in `/web/generate.php`
Package: mocodo (pypi), vulnerable version: 4.2.6, fixed in: 4.2.7
CWE: CWE-89
Files changed by the fix:
mocodo/__init__.py
web/generate.php
web/rewrite.php

Fix diff:
diff --git a/mocodo/__init__.py b/mocodo/__init__.py
index b5a9f07f..56ad6854 100644
--- a/mocodo/__init__.py
+++ b/mocodo/__init__.py
@@ -1,7 +1,7 @@
 from pathlib import Path
 from importlib import import_module
 
-__version__ = "4.2.6"
+__version__ = "4.2.7"
 SCRIPT_DIRECTORY = Path(__file__).resolve().parent
 
 
diff --git a/web/generate.php b/web/generate.php
index b7b7a0a8..016f742c 100644
--- a/web/generate.php
+++ b/web/generate.php
@@ -106,7 +106,7 @@
   $conversions = array();
   foreach ($_POST['conversions'] as $ext) {
     if ($ext == "_ddl.sql") {
-      $transformation_options .= " " . $_POST['sql_case'] . ":labels";
+      $transformation_options .= " " . escapeshellarg($_POST["sql_case"]) . ":labels";
     };
     if ($_POST['with_constraints']) {
       $option = $transformations[str_replace("_mld", "_mld_with_constraints", $ext)];
@@ -136,7 +136,7 @@
   );
   foreach ($default_option_values as $option => $default_value) {
     if (isset($_POST[$option]) && ($_POST[$option] != $default_value)) {
-      $basthon_options .= " --{$option}=" . $_POST[$option];
+      $basthon_options .= " --{$option}=" . escapeshellarg($_POST[$option]);
     };
   };
   $basthon_options = substr($basthon_options, 1); // strip the first space
diff --git a/web/rewrite.php b/web/rewrite.php
index f8bba0e5..f5222fe2 100644
--- a/web/rewrite.php
+++ b/web/rewrite.php
@@ -42,7 +42,7 @@
   } else {
     $mocodo = "~/.local/bin/mocodo";
 };
-$command_line = "{$mocodo} -t " . $_POST['args'] . " 2>&1";
+$command_line = "{$mocodo} -t " . escapeshellarg($_POST['args']) . " 2>&1"; //
 
 // Execute the command and test the exit code.
 // If it is not 0, return an array with a key "err" and the error message.
Security advisory GHSA-jgjc-332c-8cmc: SQL injection in phpMyAdmin
Package: phpmyadmin/phpmyadmin (composer), vulnerable version: 4.9.1, fixed in: 4.9.2
CWE: CWE-89
Files changed by the fix:
js/designer/move.js

Fix diff:
diff --git a/js/designer/move.js b/js/designer/move.js
index 48f1a4fe27a..0f8fabfcaad 100644
--- a/js/designer/move.js
+++ b/js/designer/move.js
@@ -576,7 +576,7 @@ function addTableToTablesList (index, table_dom) {
         '            />' +
         '    </td>' +
         '    <td class="designer_Tabs"' +
-        '        designer_url_table_name="' + db_encoded + '.' + table_encoded + '">' + db + '.' + table + '</td>' +
+        '        designer_url_table_name="' + db_encoded + '.' + table_encoded + '">' + $('<div/>').text(db + '.' + table).html() + '</td>' +
         '</tr>');
     $('#id_scroll_tab table').first().append($new_table_line);
     $($new_table_line).find('.scroll_tab_struct').click(function () {
diff --git a/templates/database/designer/database_tables.twig b/templates/database/designer/database_tables.twig
index 1ca1ebe0174..9b77d6eb349 100644
--- a/templates/database/designer/database_tables.twig
+++ b/templates/database/designer/database_tables.twig
@@ -50,7 +50,7 @@
                     table_name="{{ t_n_url }}"
                     query_set="{{ has_query ? 1 : 0 }}">
                     <span class="owner">{{ designerTable.getDatabaseName() }}</span>
-                    {{ designerTable.getTableName()|raw }}
+                    {{ designerTable.getTableName() }}
                 </td>
                 {% if has_query %}
                     <td class="tab_zag tab_zag_query"
@@ -122,7 +122,8 @@
                     </td>
                     {% if has_query %}
                         <td class="small_tab_pref small_tab_pref_click_opt"
-                            option_col_name_modal="<strong>{{ 'Add an option for column "%s".'|trans|format(col_name) }}</strong>"
+                            {# Escaped 2 times to be able to use it in innerHtml #}
+                            option_col_name_modal="<strong>{{ 'Add an option for column "%s".'|trans|format(col_name)|escape('html')|escape('html') }}</strong>"
                             db_name="{{ db }}"
                             table_name="{{ table_name }}"
                             col_name="{{ col_name }}"
Security advisory GHSA-jwg4-qcgv-5wg6: SQL Injection in Admin Translations API
Package: pimcore/pimcore (composer), vulnerable version: v10.5.20, fixed in: 10.5.21
CWE: CWE-89
Files changed by the fix:
bundles/AdminBundle/Controller/Admin/TranslationController.php

Fix diff:
diff --git a/bundles/AdminBundle/Controller/Admin/TranslationController.php b/bundles/AdminBundle/Controller/Admin/TranslationController.php
index 2e78979caf0..62068a62f48 100644
--- a/bundles/AdminBundle/Controller/Admin/TranslationController.php
+++ b/bundles/AdminBundle/Controller/Admin/TranslationController.php
@@ -633,7 +633,7 @@ protected function getGridFilterCondition(Request $request, $tableName, $languag
                 }
 
                 if ($field && $value) {
-                    $condition = $field . ' ' . $operator . ' ' . $db->quote($value);
+                    $condition = $db->quoteIdentifier($field) . ' ' . $operator . ' ' . $db->quote($value);
 
                     if ($languageMode) {
                         $conditions[$fieldname] = $condition;
Security advisory GHSA-mj2c-5mjv-gmmj: SQL Injection in Pimcore
Package: pimcore/pimcore (composer), vulnerable version: v10.3.4, fixed in: 10.3.5
CWE: CWE-89
Files changed by the fix:
bundles/AdminBundle/Controller/Admin/ElementController.php
bundles/AdminBundle/Controller/Admin/RecyclebinController.php

Fix diff:
diff --git a/bundles/AdminBundle/Controller/Admin/ElementController.php b/bundles/AdminBundle/Controller/Admin/ElementController.php
index a669b858c29..e36dade0664 100644
--- a/bundles/AdminBundle/Controller/Admin/ElementController.php
+++ b/bundles/AdminBundle/Controller/Admin/ElementController.php
@@ -232,21 +232,20 @@ public function noteListAction(Request $request)
                     $filter['value'] = (int) $filter['value'];
                 }
                 // system field
-                $value = $filter['value'];
+                $value = ($filter['value']??'');
                 if ($operator == 'LIKE') {
                     $value = '%' . $value . '%';
                 }
 
                 if ($filter[$propertyKey] == 'user') {
-                    $conditions[] = '`user` IN (SELECT `id` FROM `users` WHERE `name` LIKE ' . $list->quote('%'.$filter['value'].'%') . ')';
+                    $conditions[] = '`user` IN (SELECT `id` FROM `users` WHERE `name` LIKE ' . $list->quote($value) . ')';
                 } else {
                     if ($filter['type'] == 'date' && $filter[$comparisonKey] == 'eq') {
-                        $maxTime = $filter['value'] + (86400 - 1); //specifies the top point of the range used in the condition
-                        $dateCondition = '`' . $filter[$propertyKey] . '` ' . ' BETWEEN ' . $db->quote($filter['value']) . ' AND ' . $db->quote($maxTime);
+                        $maxTime = $value + (86400 - 1); //specifies the top point of the range used in the condition
+                        $dateCondition = '`' . $filter[$propertyKey] . '` ' . ' BETWEEN ' . $db->quote($value) . ' AND ' . $db->quote($maxTime);
                         $conditions[] = $dateCondition;
                     } else {
-                        $field = '`'.$filter[$propertyKey].'` ';
-                        $conditions[] = $field.$operator.' '.$db->quote($value);
+                        $conditions[] = $db->quoteIdentifier($filter[$propertyKey]).' '.$operator.' '.$db->quote($value);
                     }
                 }
             }
diff --git a/bundles/AdminBundle/Controller/Admin/RecyclebinController.php b/bundles/AdminBundle/Controller/Admin/RecyclebinController.php
index b759b9e4989..68f389afe87 100644
--- a/bundles/AdminBundle/Controller/Admin/RecyclebinController.php
+++ b/bundles/AdminBundle/Controller/Admin/RecyclebinController.php
@@ -109,7 +109,7 @@ public function listAction(Request $request)
                         $value = '%' . $value . '%';
                     }
 
-                    $field = '`' . $filterField . '` ';
+                    $field = $db->quoteIdentifier($filterField);
                     if (($filter['field'] ?? false) == 'fullpath') {
                         $field = 'CONCAT(path,filename)';
                     }
Security advisory GHSA-mrmx-jfw8-qhgv: Melis Platform CMS SQL Injection
Package: melisplatform/melis-cms (composer), vulnerable version: v5.3.3, fixed in: 5.3.4
CWE: CWE-89
Files changed by the fix:
src/Controller/PageEditionController.php

Fix diff:
diff --git a/src/Controller/PageEditionController.php b/src/Controller/PageEditionController.php
index f80a42a1..d0f5c87c 100755
--- a/src/Controller/PageEditionController.php
+++ b/src/Controller/PageEditionController.php
@@ -367,6 +367,10 @@ public function getTinyTemplatesAction()
 		$success = 1;
 		$tinyTemplates = array();
 
+        if((is_null($idPage) || empty($idPage) || !is_numeric($idPage))){
+            return new JsonModel($tinyTemplates);
+        }
+
 		// No pageId, return empty array 
 		if (!empty($idPage))
 		{
Security advisory GHSA-q863-cchm-c6c6: SQL Injection in Fork CMS
Package: forkcms/forkcms (composer), vulnerable version: 5.11.0, fixed in: 5.11.1
CWE: CWE-89
Files changed by the fix:
src/Backend/Modules/FormBuilder/Engine/Model.php

Fix diff:
diff --git a/src/Backend/Modules/FormBuilder/Engine/Model.php b/src/Backend/Modules/FormBuilder/Engine/Model.php
index 6a13543526..6028b7607f 100644
--- a/src/Backend/Modules/FormBuilder/Engine/Model.php
+++ b/src/Backend/Modules/FormBuilder/Engine/Model.php
@@ -152,6 +152,7 @@ public static function delete(int $id): void
     public static function deleteData(array $ids): void
     {
         $database = BackendModel::getContainer()->get('database');
+        $ids = array_map('intval', $ids);
 
         $database->delete('forms_data', 'id IN(' . implode(',', $ids) . ')');
         $database->delete('forms_data_fields', 'data_id IN(' . implode(',', $ids) . ')');
Security advisory GHSA-q9p4-qfc8-fvpp: SQL Injection in medoo
Package: catfan/medoo (composer), vulnerable version: v1.7.4, fixed in: 1.7.5
CWE: CWE-89
Files changed by the fix:
src/Medoo.php

Fix diff:
diff --git a/src/Medoo.php b/src/Medoo.php
index 6d68f4c2..478e0a87 100644
--- a/src/Medoo.php
+++ b/src/Medoo.php
@@ -500,6 +500,11 @@ protected function typeMap($value, $type)
 
 	protected function columnQuote($string)
 	{
+		if (!preg_match('/^[a-zA-Z0-9]+(\.?[a-zA-Z0-9]+)?$/i', $string))
+		{
+			throw new InvalidArgumentException("Incorrect column name \"$string\"");
+		}
+
 		if (strpos($string, '.') !== false)
 		{
 			return '"' . $this->prefix . str_replace('.', '"."', $string) . '"';
Security advisory GHSA-qvw9-6567-wq78: MunkiReport reportdata module SQL injection vulnerability
Package: munkireport/reportdata (composer), vulnerable version: v3.4, fixed in: 3.5
CWE: CWE-89
Files changed by the fix:
b/reportdata_controller.php
b/reportdata_factory.php

Fix diff:
diff -ruN --no-dereference /home/ubuntu/closed-source-intelligence/data/cache/composer-zips/munkireport-reportdata-v3.4/reportdata_controller.php /home/ubuntu/closed-source-intelligence/data/cache/composer-zips/munkireport-reportdata-3.5/reportdata_controller.php
--- a/reportdata_controller.php
+++ b/reportdata_controller.php
@@ -206,22 +206,14 @@
      **/
     public function ip()
     {
-        $ip_arr = array();
         
-        // See if we're being parsed a request object
-        if (array_key_exists('req', $_GET)) {
-            $ip_arr = (array) json_decode($_GET['req']);
+        try {
+            $ip_arr = Yaml::parseFile($this->config['ip_config_path']);
+        } catch (\Exception $e) {
+            // Do something
+            $ip_arr = [];
         }
 
-        if (! $ip_arr) { // Empty array, fall back on default ip ranges
-          try {
-              $ip_arr = Yaml::parseFile($this->config['ip_config_path']);
-          } catch (\Exception $e) {
-             // Do something
-             $ip_arr = [];
-          }
-        }
-        
         $out = [];
 
         // Compile SQL
diff -ruN --no-dereference /home/ubuntu/closed-source-intelligence/data/cache/composer-zips/munkireport-reportdata-v3.4/reportdata_factory.php /home/ubuntu/closed-source-intelligence/data/cache/composer-zips/munkireport-reportdata-3.5/reportdata_factory.php
--- a/reportdata_factory.php
+++ b/reportdata_factory.php
@@ -21,7 +21,7 @@
         'console_user' => $faker->userName,
         'long_username' => $faker->name,
         'remote_ip' => $faker->ipv4,
-        'uptime' => $faker->numberBetween(0, 100000),
+        'uptime' => $faker->numberBetween(0, 1000000),
         'reg_timestamp' => $faker->dateTimeBetween('-4 years')->format('U'),
         'machine_group' => 0,
         'archive_status' => $faker->numberBetween(0, 1),
Security advisory GHSA-r3jc-3qmm-w3pw: SQLAlchemyDA unauthenticated arbitrary SQL query execution
Package: products-sqlalchemyda (pypi), vulnerable version: 2.1, fixed in: 2.2
CWE: CWE-89
Files changed by the fix:
src/Products/SQLAlchemyDA/da.py

Fix diff:
diff --git a/CHANGES.rst b/CHANGES.rst
index e040af6..b66a8e8 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -4,6 +4,9 @@ Change log
 2.2 (unreleased)
 ----------------
 
+- Add missing security declarations on the database adapter class
+  to mitigate arbitrary SQL query execution vulnerability.
+
 - Add support for Python 3.12.
 
 
diff --git a/src/Products/SQLAlchemyDA/da.py b/src/Products/SQLAlchemyDA/da.py
index c44a730..000f043 100644
--- a/src/Products/SQLAlchemyDA/da.py
+++ b/src/Products/SQLAlchemyDA/da.py
@@ -13,6 +13,7 @@
 
 from AccessControl import ClassSecurityInfo
 from AccessControl.class_init import InitializeClass
+from AccessControl.Permissions import change_database_connections
 from AccessControl.Permissions import view_management_screens
 from OFS.PropertyManager import PropertyManager
 from OFS.SimpleItem import SimpleItem
@@ -295,6 +296,7 @@ def engine_options(self):
         engine_options = dict(self.extra_engine_options)
         return engine_options
 
+    @security.protected(change_database_connections)
     def add_extra_engine_options(self, engine_options):
         """ engine_options is a tuple containing additional
             options for sqlalchemy.create_engine.
@@ -346,6 +348,7 @@ def _typesMap(self, proxy):
             self._v_types_map = map
         return self._v_types_map
 
+    @security.private
     def query(self, query_string, max_rows=None, query_data=None):
         """ *The* query() method as used by the internal ZSQL
             machinery.