MDL-62589 dataprivacy: Correct not in sql
authorAndrew Nicols <andrew@nicols.co.uk>
Tue, 6 Nov 2018 23:51:27 +0000 (07:51 +0800)
committerAndrew Nicols <andrew@nicols.co.uk>
Wed, 7 Nov 2018 11:24:07 +0000 (19:24 +0800)
admin/tool/dataprivacy/classes/api.php

index 10889a9..a17d388 100644 (file)
@@ -437,8 +437,8 @@ class api {
             self::DATAREQUEST_STATUS_EXPIRED,
             self::DATAREQUEST_STATUS_DELETED,
         ];
-        list($insql, $inparams) = $DB->get_in_or_equal($nonpendingstatuses, SQL_PARAMS_NAMED);
-        $select = 'type = :type AND userid = :userid AND status NOT ' . $insql;
+        list($insql, $inparams) = $DB->get_in_or_equal($nonpendingstatuses, SQL_PARAMS_NAMED, 'st', false);
+        $select = "type = :type AND userid = :userid AND status {$insql}";
         $params = array_merge([
             'type' => $type,
             'userid' => $userid