fix(sec): Fix SQL Injection in administration logs

* Fix SQL Injection in Administration logs in search fields

www/include/Administration/configChangelog/viewLogs.ihtml

@@ -11,8 +11,8 @@
             <td></td>
         </tr>
         <tr>
-            <td><input type='text' name='searchO' value='{$searchO}' /></td>
-            <td><input type='text' name='searchU' value='{$searchU}' /></td>
+            <td><input type='text' name='searchO' value="{$searchO}" /></td>
+            <td><input type='text' name='searchU' value="{$searchU}" /></td>
             <td><select name='otype'>{$obj_type}</select></td>
             <td><input type='submit' class="btc bt_success" name='SearchB' value='{$Search}' /></td>
         </tr>

www/include/Administration/configChangelog/viewLogs.php

@@ -44,7 +44,10 @@ function searchUserName($user_name)
     global $pearDB;
     $str = "";
 
-    $DBRES = $pearDB->query("SELECT contact_id FROM contact WHERE contact_name LIKE '%".$user_name."%' OR contact_alias LIKE '%".$user_name."%'");
+    $DBRES = $pearDB->query("SELECT contact_id
+        FROM contact
+        WHERE contact_name LIKE '%" . $pearDB->escape($user_name) . "%'
+            OR contact_alias LIKE '%" . $pearDB->escape($user_name) . "%'");
     while ($row = $DBRES->fetchRow()) {
         if ($str != "") {
             $str .= ", ";
@@ -166,7 +169,7 @@ if ($searchO) {
     } else {
         $query .= " AND ";
     }
-    $query .= " object_name LIKE '%".$searchO."%' ";
+    $query .= " object_name LIKE '%" . $pearDB->escape($searchO) . "%' ";
 }
 if ($searchU) {
     if ($where_flag) {
@@ -313,8 +316,8 @@ $tpl->assign('form', $renderer->toArray());
 $tpl->assign('search_object_str', _("Object"));
 $tpl->assign('search_user_str', _("User"));
 $tpl->assign('Search', _('Search'));
-$tpl->assign('searchO', $searchO);
-$tpl->assign('searchU', $searchU);
+$tpl->assign('searchO', htmlentities($searchO));
+$tpl->assign('searchU', htmlentities($searchU));
 $tpl->assign('obj_str', _("Object Type"));
 $tpl->assign('type_id', $otype);