[pgAdmin][RM4584] HTML entities aren't escaped in database names
Aditya Toshniwal <[email protected]>
| Newsgroups | gmane.comp.db.postgresql.pgadmin.devel |
|---|---|
| Message-ID | <CAM9w-_k2s0aNsxvxUC=YPV4F-+Di5kEBTaZZVvd9YqWn9Kjn5g@mail.gmail.com> |
Hi Hackers, Attached patch will fix issue where HTML entities aren't escaped in database names. This was fixed previously, but seems to be broken again now :/ Kindly review. -- Thanks and Regards, Aditya Toshniwal Software Engineer | EnterpriseDB India | Pune "Don't Complain about Heat, Plant a TREE"
RM4584.patch
(application/octet-stream, 1.1 KB)
diff --git a/web/pgadmin/tools/datagrid/static/js/datagrid.js b/web/pgadmin/tools/datagrid/static/js/datagrid.js
index 7610d955..b4258ee5 100644
--- a/web/pgadmin/tools/datagrid/static/js/datagrid.js
+++ b/web/pgadmin/tools/datagrid/static/js/datagrid.js
@@ -227,7 +227,7 @@ define('pgadmin.datagrid', [
queryToolForm +=`
</form>
<script>
- document.getElementById("title").value = "${_.escape(panel_title)}";
+ document.getElementById("title").value = "${panel_title}";
document.getElementById("queryToolForm").submit();
</script>
`;
@@ -244,7 +244,7 @@ define('pgadmin.datagrid', [
var queryToolPanel = pgBrowser.docker.addPanel('frm_datagrid', wcDocker.DOCK.STACKED, propertiesPanel[0]);
// Set panel title and icon
- panelTitleFunc.setQueryToolDockerTitle(queryToolPanel, is_query_tool, panel_title);
+ panelTitleFunc.setQueryToolDockerTitle(queryToolPanel, is_query_tool, _.unescape(panel_title));
queryToolPanel.focus();
// Listen on the panel closed event.