IntenseWebs/pgadmin4
3
0
Fork 0
mirror of https://github.com/pgadmin-org/pgadmin4.git synced 2026-08-19 01:15:04 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(server): schema-qualify remaining pg_catalog calls in ServerNode

Browse Source 
The SQL injection fix for create_restore_point now calls
pg_catalog.pg_create_restore_point so that a non-default search_path
on the connection cannot redirect the call to a shadow definition.
Apply the same hardening to the other pg_* calls in the same file
that were still unqualified: pg_reload_conf in reload_configuration,
and pg_xlog_replay_pause / pg_wal_replay_pause / pg_xlog_replay_resume
/ pg_wal_replay_resume in wal_replay.

These were not exploitable on their own -- the SQL string is static
and not user-derived -- but resolving them via pg_catalog removes any
dependency on the connection's search_path being trustworthy.
This commit is contained in:
Ashesh Vashi
2026-06-08 18:42:40 +05:30
parent 3379c39865
commit 3b1a6ce481
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/pgadmin/browser/server_groups/servers/__init__.py
+7 -5
View File
@@ -1847,7 +1847,9 @@ class ServerNode(PGChildNodeView):
if conn.connected():
# Execute the command for reload configuration for the server
status, _ = conn.execute_scalar("SELECT pg_reload_conf();")
status, _ = conn.execute_scalar(
"SELECT pg_catalog.pg_reload_conf();"
)
if not status:
return internal_server_error(
@@ -2076,9 +2078,9 @@ class ServerNode(PGChildNodeView):
# Execute SQL to pause or resume WAL replay
if conn.connected():
if pause:
sql = "SELECT pg_xlog_replay_pause();"
sql = "SELECT pg_catalog.pg_xlog_replay_pause();"
if manager.version >= 100000:
sql = "SELECT pg_wal_replay_pause();"
sql = "SELECT pg_catalog.pg_wal_replay_pause();"
status, res = conn.execute_scalar(sql)
if not status:
@@ -2087,9 +2089,9 @@ class ServerNode(PGChildNodeView):
)
msg = gettext('WAL replay paused')
else:
sql = "SELECT pg_xlog_replay_resume();"
sql = "SELECT pg_catalog.pg_xlog_replay_resume();"
if manager.version >= 100000:
sql = "SELECT pg_wal_replay_resume();"
sql = "SELECT pg_catalog.pg_wal_replay_resume();"
status, res = conn.execute_scalar(sql)
if not status: