Merge pull request #20444 from fproldan/fix_sqlinjection_develop

fix: SQL Injection in get_product_list_for_group method