IntenseWebs/pgadmin4
3
0
Fork 0
mirror of https://github.com/pgadmin-org/pgadmin4.git synced 2026-09-03 20:52:57 -05:00
Code Issues Packages Projects Releases Wiki Activity

Allow editing of data where a primary key column includes a % sign in the value. Fixes #4036

Browse Source 
Fix an XSS issue seen in View/Edit data mode if a column name includes HTML. Fixes #4367
This commit is contained in:
Aditya Toshniwal
2019-06-20 12:21:37 +01:00
committed by Dave Page
parent 5c0ea0c012
commit 6e8ebbd375
10 changed files with 112 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/pgadmin/tools/sqleditor/command.py
+35 -11
View File
@@ -677,6 +677,11 @@ class TableCommand(GridCommand):
list_of_sql = {}
_rowid = None
pgadmin_alias = {
col_name: col_info['pgadmin_alias']
for col_name, col_info in columns_info
.items()
}
if conn.connected():
# Start the transaction
@@ -745,6 +750,7 @@ class TableCommand(GridCommand):
sql = render_template(
"/".join([self.sql_path, 'insert.sql']),
data_to_be_saved=column_data,
pgadmin_alias=pgadmin_alias,
primary_keys=None,
object_name=self.object_name,
nsp_name=self.nsp_name,
@@ -774,11 +780,17 @@ class TableCommand(GridCommand):
list_of_sql[of_type] = []
for each_row in changed_data[of_type]:
data = changed_data[of_type][each_row]['data']
pk = changed_data[of_type][each_row]['primary_keys']
pk_escaped = {
pk: pk_val.replace('%', '%%')
for pk, pk_val in
changed_data[of_type][each_row]['primary_keys']
.items()
}
sql = render_template(
"/".join([self.sql_path, 'update.sql']),
data_to_be_saved=data,
primary_keys=pk,
pgadmin_alias=pgadmin_alias,
primary_keys=pk_escaped,
object_name=self.object_name,
nsp_name=self.nsp_name,
data_type=column_type
@@ -831,17 +843,14 @@ class TableCommand(GridCommand):
for opr, sqls in list_of_sql.items():
for item in sqls:
if item['sql']:
item['data'] = {
pgadmin_alias[k] if k in pgadmin_alias else k: v
for k, v in item['data'].items()
}
row_added = None
# Fetch oids/primary keys
if 'select_sql' in item and item['select_sql']:
status, res = conn.execute_dict(
item['sql'], item['data'])
else:
status, res = conn.execute_void(
item['sql'], item['data'])
if not status:
def failure_handle():
conn.execute_void('ROLLBACK;')
# If we roll backed every thing then update the
# message for each sql query.
@@ -861,6 +870,21 @@ class TableCommand(GridCommand):
return status, res, query_res, _rowid
try:
# Fetch oids/primary keys
if 'select_sql' in item and item['select_sql']:
status, res = conn.execute_dict(
item['sql'], item['data'])
else:
status, res = conn.execute_void(
item['sql'], item['data'])
except Exception as _:
failure_handle()
raise
if not status:
return failure_handle()
# Select added row from the table
if 'select_sql' in item:
status, sel_res = conn.execute_dict(