Re: security bug (with patch-fix) -- need more HTML-escaping for working with tree-nodes

Sure - I will create one.

On May 10, 2017 14:05, "Dave Page" <dpage(at)pgadmin(dot)org> wrote:

> BTW; Ashesh, can you please ensure there's an RM ticket for this, as it's
> obviously of interest to users.
>
> Thanks.
>
> On Wed, May 10, 2017 at 9:06 AM, Dave Page <dpage(at)pgadmin(dot)org> wrote:
>
>>
>>
>> On Wed, May 10, 2017 at 9:00 AM, Ashesh Vashi <
>> ashesh(dot)vashi(at)enterprisedb(dot)com> wrote:
>>
>>> On Wed, May 10, 2017 at 1:29 PM, Dave Page <dpage(at)pgadmin(dot)org> wrote:
>>>
>>>>
>>>>
>>>> On Wed, May 10, 2017 at 8:56 AM, Ashesh Vashi <
>>>> ashesh(dot)vashi(at)enterprisedb(dot)com> wrote:
>>>>
>>>>> Thanks.
>>>>> Committed!
>>>>>
>>>>
>>>> I agree with the change from a preventative/safety perspective, though
>>>> I'm struggling to classify it as a security issue, given that collections
>>>> are always named by the code and not from user input.
>>>>
>>>> Am I missing something?
>>>>
>>> True - but not the case with the server-group.
>>> It is a collection node, still has it's own label.
>>>
>>
>> Ahh, yes.
>>
>> --
>> Dave Page
>> Blog: http://pgsnake.blogspot.com
>> Twitter: @pgsnake
>>
>> EnterpriseDB UK: http://www.enterprisedb.com
>> The Enterprise PostgreSQL Company
>>
>
>
>
> --
> Dave Page
> Blog: http://pgsnake.blogspot.com
> Twitter: @pgsnake
>
> EnterpriseDB UK: http://www.enterprisedb.com
> The Enterprise PostgreSQL Company
>