From 274fa6c0e7de3c84ae2fa853184335c2e7dfcbf9 Mon Sep 17 00:00:00 2001
From: Isabelle <isabelle@dewebsmid.nl>
Date: Fri, 10 Jul 2026 17:17:49 +0200
Subject: [PATCH] fix(main): validate specialty exists, fix double-escaped
 title filter

---
 .../src/Grid/Query/CustomerSpecialtyQueryBuilder.php   |  2 +-
 ws_customerspecialty/src/Module/DisplayHooks.php       | 10 +++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/ws_customerspecialty/src/Grid/Query/CustomerSpecialtyQueryBuilder.php b/ws_customerspecialty/src/Grid/Query/CustomerSpecialtyQueryBuilder.php
index 444eca0..82a2755 100644
--- a/ws_customerspecialty/src/Grid/Query/CustomerSpecialtyQueryBuilder.php
+++ b/ws_customerspecialty/src/Grid/Query/CustomerSpecialtyQueryBuilder.php
@@ -78,7 +78,7 @@ class CustomerSpecialtyQueryBuilder extends AbstractDoctrineQueryBuilder
             switch ($filterName) {
                 case 'title':
                     $queryBuilder->andWhere('csl.title LIKE :title')
-                        ->setParameter('title', '%' . pSQL($filterValue) . '%');
+                        ->setParameter('title', '%' . $filterValue . '%');
                     break;
                 case 'active':
                     $queryBuilder->andWhere('cs.active = :active')
diff --git a/ws_customerspecialty/src/Module/DisplayHooks.php b/ws_customerspecialty/src/Module/DisplayHooks.php
index ff4c8ad..8d88fbd 100644
--- a/ws_customerspecialty/src/Module/DisplayHooks.php
+++ b/ws_customerspecialty/src/Module/DisplayHooks.php
@@ -91,7 +91,7 @@ trait DisplayHooks
         $idCustomer = (int) $customer->id;
         $specialization = (int) Tools::getValue('specialization');
 
-        if ($idCustomer <= 0 || $specialization <= 0) {
+        if ($idCustomer <= 0 || $specialization <= 0 || !$this->customerSpecialtyExists($specialization)) {
             return;
         }
 
@@ -108,6 +108,14 @@ trait DisplayHooks
         );
     }
 
+    private function customerSpecialtyExists(int $idCustomerSpecialty): bool
+    {
+        return (bool) Db::getInstance()->getValue(
+            'SELECT `id_ws_customerspecialty` FROM `' . _DB_PREFIX_ . 'ws_customerspecialty`
+             WHERE `id_ws_customerspecialty` = ' . $idCustomerSpecialty . ' AND `active` = 1'
+        );
+    }
+
     private function loadOrderCustomerSpecialization(int $idOrder): ?string
     {
         $idCustomer = (int) Db::getInstance()->getValue(