Re: [pgadmin-hackers] security bug (with patch-fix) -- need moreHTML-escaping for working with tree-nodes

Поиск
Список
Период
Сортировка
От Dave Page
Тема Re: [pgadmin-hackers] security bug (with patch-fix) -- need moreHTML-escaping for working with tree-nodes
Дата
Msg-id CA+OCxowGKGo+cVpKV6q8HzNdz0cZYEo+HQhwDrG6D2owbitqeQ@mail.gmail.com
обсуждение исходный текст
Ответ на Re: [pgadmin-hackers] security bug (with patch-fix) -- need moreHTML-escaping for working with tree-nodes  (Ashesh Vashi <ashesh.vashi@enterprisedb.com>)
Ответы Re: [pgadmin-hackers] security bug (with patch-fix) -- need moreHTML-escaping for working with tree-nodes  (Dave Page <dpage@pgadmin.org>)
Список pgadmin-hackers
Дерево обсуждения


On Wed, May 10, 2017 at 9:00 AM, Ashesh Vashi <ashesh.vashi@enterprisedb.com> wrote:
On Wed, May 10, 2017 at 1:29 PM, Dave Page <dpage@pgadmin.org> wrote:


On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <ashesh.vashi@enterprisedb.com> wrote:
Thanks.
Committed!

I agree with the change from a preventative/safety perspective, though I'm struggling to classify it as a security issue, given that collections are always named by the code and not from user input. 

Am I missing something?
True - but not the case with the server-group.
It is a collection node, still has it's own label.

Ahh, yes. 

--
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake

EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

В списке pgadmin-hackers по дате отправления:

Предыдущее
От: Akshay Joshi
Дата:
Сообщение: [pgadmin-hackers] pgAdmin 4 commit: 1) Fixed compilation issue with QT4.
Следующее
От: pgAdmin 4 Jenkins
Дата:
Сообщение: [pgadmin-hackers] Jenkins build is back to normal : pgadmin4-master-python34 #99