IntenseWebs/pgadmin4
3
0
Fork 0
mirror of https://github.com/pgadmin-org/pgadmin4.git synced 2024-11-22 08:46:39 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix XSS issue in explain and explain analyze for table and type which contain HTML. Fixes #4947.

Browse Source
This commit is contained in:
Khushboo Vashi 2019-12-09 18:00:56 +05:30 committed by Akshay Joshi
parent f15db03ec3
commit cb26ca0e46
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/en_US/release_notes_4_16.rst
View File

@ -47,6 +47,7 @@ Bug fixes
| `Issue #4933 <https://redmine.postgresql.org/issues/4933>`_ - Ensure that the Servers collection node should expand independently of server connections.
| `Issue #4934 <https://redmine.postgresql.org/issues/4934>`_ - Fix the help button link on the User Management dialog.
| `Issue #4935 <https://redmine.postgresql.org/issues/4935>`_ - Fix accessibility issues.
| `Issue #4947 <https://redmine.postgresql.org/issues/4947>`_ - Fix XSS issue in explain and explain analyze for table and type which contain HTML.
| `Issue #4952 <https://redmine.postgresql.org/issues/4952>`_ - Fix an issue of retrieving properties for Compound Triggers. It's a regression of #4006.
| `Issue #4953 <https://redmine.postgresql.org/issues/4953>`_ - Fix an issue where pgAdmin4 unable to retrieve table node if the trigger is already disabled and the user clicks on Enable All.
| `Issue #4958 <https://redmine.postgresql.org/issues/4958>`_ - Fix reverse engineering SQL issue for triggers when passed a single argument to trigger function.

2
web/pgadmin/misc/static/explain/js/explain.js
View File

@ -436,7 +436,7 @@ define('pgadmin.misc.explain', [
tooltip.push(' as ');
display_text.push('<span class="pg-explain-text-name">');
display_text.push(_.escape(_planData['Alias']));
tooltip.push(_planData['Alias']);
tooltip.push(_.escape(_planData['Alias']));
display_text.push('</span>');
}
}