Re: [pgAdmin][RM4674] User can not launch query tool window if user name contain html characters
Aditya Toshniwal <[email protected]> Thu, 5 Dec 2019 12:43:34 +0530
| Newsgroups | gmane.comp.db.postgresql.pgadmin.devel |
|---|---|
| Message-ID | <CAM9w-_kPk=7DWjC1eUkwp99g9B38ZLnDAy5DoaNj-SzsFMEwSw@mail.gmail.com> |
Hi Hackers, This issue seems to have reappeared. Kindly review the attached patch to fix it again. On Wed, Aug 28, 2019 at 10:47 AM Akshay Joshi <[email protected]> wrote: > Thanks patch applied. > > On Tue, Aug 27, 2019 at 4:44 PM Aditya Toshniwal < > [email protected]> wrote: > >> Hi Hackers, >> >> Attached is the patch to fix the issue. >> Kindly review. >> >> -- >> Thanks and Regards, >> Aditya Toshniwal >> Software Engineer | EnterpriseDB India | Pune >> "Don't Complain about Heat, Plant a TREE" >> > > > -- > *Thanks & Regards* > *Akshay Joshi* > > *Sr. Software Architect* > *EnterpriseDB Software India Private Limited* > *Mobile: +91 976-788-8246* > -- Thanks and Regards, Aditya Toshniwal Sr. Software Engineer | EnterpriseDB India | Pune "Don't Complain about Heat, Plant a TREE"
RM4674_v2.patch
(application/octet-stream, 635 B)
diff --git a/web/pgadmin/tools/datagrid/static/js/datagrid.js b/web/pgadmin/tools/datagrid/static/js/datagrid.js
index b4258ee59..1df617386 100644
--- a/web/pgadmin/tools/datagrid/static/js/datagrid.js
+++ b/web/pgadmin/tools/datagrid/static/js/datagrid.js
@@ -227,7 +227,7 @@ define('pgadmin.datagrid', [
queryToolForm +=`
</form>
<script>
- document.getElementById("title").value = "${panel_title}";
+ document.getElementById("title").value = "${_.escape(panel_title)}";
document.getElementById("queryToolForm").submit();
</script>
`;