| From: | Dave Page <dpage(at)pgadmin(dot)org> |
|---|---|
| To: | Ashesh Vashi <ashesh(dot)vashi(at)enterprisedb(dot)com> |
| Cc: | Andrei Antonov <antonov(at)imp-m(dot)ru>, pgadmin-hackers <pgadmin-hackers(at)postgresql(dot)org> |
| Subject: | Re: security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes |
| Date: | 2017-05-10 08:06:30 |
| Message-ID: | CA+OCxowGKGo+cVpKV6q8HzNdz0cZYEo+HQhwDrG6D2owbitqeQ@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgadmin-hackers |
On Wed, May 10, 2017 at 9:00 AM, Ashesh Vashi <ashesh(dot)vashi(at)enterprisedb(dot)com
> wrote:
> On Wed, May 10, 2017 at 1:29 PM, Dave Page <dpage(at)pgadmin(dot)org> wrote:
>
>>
>>
>> On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <
>> ashesh(dot)vashi(at)enterprisedb(dot)com> wrote:
>>
>>> Thanks.
>>> Committed!
>>>
>>
>> I agree with the change from a preventative/safety perspective, though
>> I'm struggling to classify it as a security issue, given that collections
>> are always named by the code and not from user input.
>>
>> Am I missing something?
>>
> True - but not the case with the server-group.
> It is a collection node, still has it's own label.
>
Ahh, yes.
--
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake
EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
| From | Date | Subject | |
|---|---|---|---|
| Next Message | pgAdmin 4 Jenkins | 2017-05-10 08:12:42 | Jenkins build is back to normal : pgadmin4-master-python34 #99 |
| Previous Message | Akshay Joshi | 2017-05-10 08:06:29 | pgAdmin 4 commit: 1) Fixed compilation issue with QT4. |