Security: Escape array filter values in ExtraField::get_where_clause()

Refs GHSA-7whw-8467-78jp

Author: AngelFQC

public/main/inc/lib/extra_field.lib.php

@@ -2943,7 +2943,8 @@ public function get_where_clause($col, $oper, $val, $conditionBetweenOptions = '
         }
         if ('cn' === $oper || 'nc' === $oper || 'in' === $oper || 'ni' === $oper) {
             if (is_array($val)) {
-                $result = '"%'.implode(';', $val).'%"';
+                $escaped = array_map(static fn ($item) => Database::escape_string(trim($item)), $val);
+                $result = '"%'.implode(';', $escaped).'%"';
                 foreach ($val as $item) {
                     $item = Database::escape_string(trim($item));
                     $result .= ' '.$conditionBetweenOptions.' '.$col.' LIKE "%'.$item.'%"';