From 5b29e018d0166c9fc46fd729b18a80b1c2016eff Mon Sep 17 00:00:00 2001
From: Isaac Connor <isaac@zoneminder.com>
Date: Tue, 18 Oct 2022 13:28:24 -0400
Subject: [PATCH] IN () being false could still result in a true result of used
 in an OR, so instead of just returning, use an always false sql equivalent

---
 web/includes/Object.php | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/web/includes/Object.php b/web/includes/Object.php
index 719312157..9900a984b 100644
--- a/web/includes/Object.php
+++ b/web/includes/Object.php
@@ -103,9 +103,8 @@ class ZM_Object {
             $fields[] = '`'.$field.'` IN ('.implode(',', array_map($func, $value)). ')';
             $values += $value;
           } else {
-            return array();
+            $fields[] = '`'.$field'` IN (select top 0 0)'; # evaluates to false
           }
-
         } else {
           $fields[] = '`'.$field.'`=?';
           $values[] = $value;