mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-10-31 08:34:01 -05:00
Ashesh Vashi
3b1a6ce481
The SQL injection fix for create_restore_point now calls pg_catalog.pg_create_restore_point so that a non-default search_path on the connection cannot redirect the call to a shadow definition. Apply the same hardening to the other pg_* calls in the same file that were still unqualified: pg_reload_conf in reload_configuration, and pg_xlog_replay_pause / pg_wal_replay_pause / pg_xlog_replay_resume / pg_wal_replay_resume in wal_replay. These were not exploitable on their own -- the SQL string is static and not user-derived -- but resolving them via pg_catalog removes any dependency on the connection's search_path being trustworthy.