From: | Dave Page <dpage(at)pgadmin(dot)org> |
---|---|
To: | Ashesh Vashi <ashesh(dot)vashi(at)enterprisedb(dot)com> |
Cc: | Andrei Antonov <antonov(at)imp-m(dot)ru>, pgadmin-hackers <pgadmin-hackers(at)postgresql(dot)org> |
Subject: | Re: security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes |
Date: | 2017-05-10 08:35:58 |
Message-ID: | CA+OCxozF-WX_y2cPuf9g8X9V=RFU1r6mciam+8uTK1VgVG9NnA@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgadmin-hackers |
BTW; Ashesh, can you please ensure there's an RM ticket for this, as it's
obviously of interest to users.
Thanks.
On Wed, May 10, 2017 at 9:06 AM, Dave Page <dpage(at)pgadmin(dot)org> wrote:
>
>
> On Wed, May 10, 2017 at 9:00 AM, Ashesh Vashi <
> ashesh(dot)vashi(at)enterprisedb(dot)com> wrote:
>
>> On Wed, May 10, 2017 at 1:29 PM, Dave Page <dpage(at)pgadmin(dot)org> wrote:
>>
>>>
>>>
>>> On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <
>>> ashesh(dot)vashi(at)enterprisedb(dot)com> wrote:
>>>
>>>> Thanks.
>>>> Committed!
>>>>
>>>
>>> I agree with the change from a preventative/safety perspective, though
>>> I'm struggling to classify it as a security issue, given that collections
>>> are always named by the code and not from user input.
>>>
>>> Am I missing something?
>>>
>> True - but not the case with the server-group.
>> It is a collection node, still has it's own label.
>>
>
> Ahh, yes.
>
> --
> Dave Page
> Blog: http://pgsnake.blogspot.com
> Twitter: @pgsnake
>
> EnterpriseDB UK: http://www.enterprisedb.com
> The Enterprise PostgreSQL Company
>
--
Dave Page
Blog: http://pgsnake.blogspot.com
Twitter: @pgsnake
EnterpriseDB UK: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
From | Date | Subject | |
---|---|---|---|
Next Message | pgAdmin 4 Jenkins | 2017-05-10 08:36:25 | Jenkins build is back to normal : pgadmin4-master-python26 #218 |
Previous Message | pgAdmin 4 Jenkins | 2017-05-10 08:30:45 | Jenkins build is back to normal : pgadmin4-master-python27 #108 |