gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: table columns with names of ' or "" or `` could not be dropped (#18506)

Browse Source 
* fix: table columns with names of ' or "" or `` could not be dropped

    Unsafe javascript string was passed to the currColumnName var. By using
    escapeJsString from /modules/functions/escape.ts the unsafe string becomes
    a safe string and the rest of the code runs as expected. fixes issue #18448

    Signed-off-by: Thanasis Mpalatsoukas <thanasismpalatsoukas@gmail.com>

* fix: added an extra space below and added a signoff additionally

Signed-off-by: Thanasis Mpalatsoukas <thanasismpalatsoukas@gmail.com>

---------

Signed-off-by: Thanasis Mpalatsoukas <thanasismpalatsoukas@gmail.com>
This commit is contained in:
Sakis bal 2023-06-25 22:53:07 +03:00 committed by GitHub
parent 170cc40ed6
commit 8e3615eca8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
js/src/table/structure.ts
View File

@ -7,7 +7,7 @@ import highlightSql from '../modules/sql-highlight.ts';
import { ajaxRemoveMessage, ajaxShowMessage } from '../modules/ajax-message.ts';
import { Indexes } from '../modules/indexes.ts';
import getJsConfirmCommonParam from '../modules/functions/getJsConfirmCommonParam.ts';
import { escapeHtml } from '../modules/functions/escape.ts';
import { escapeHtml, escapeJsString } from '../modules/functions/escape.ts';
import refreshMainContent from '../modules/functions/refreshMainContent.ts';
/**
@ -191,7 +191,8 @@ AJAX.registerOnload('table/structure.js', function () {
* @var currColumnName String containing name of the field referred to by {@link curr_row}
*/
var currColumnName = $currRow.children('th').children('label').text().trim();
currColumnName = escapeHtml(currColumnName);
currColumnName = escapeJsString(escapeHtml(currColumnName));
/**
* @var $afterFieldItem Corresponding entry in the 'After' field.
*/