gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix escaping of SQL query and errors for debug console

Browse Source 
Signed-off-by: William Desportes <williamdes@wdes.fr>
This commit is contained in:
William Desportes 2022-08-15 12:52:25 +02:00
parent 2365ec78e2
commit d0093468d0
No known key found for this signature in database
GPG Key ID: 90A0EF1B8251A889
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/console.js
View File

@ -1364,7 +1364,7 @@ var ConsoleDebug = {
appendQueryExtraInfo: function (query, $elem) {
if ('error' in query) {
$elem.append(
$('<div>').html(query.error)
$('<div>').append($('<span class="text-danger">').text(query.error))
);
}
$elem.append(this.formatBackTrace(query.trace));

7
libraries/classes/Query/Utilities.php
View File

@ -13,6 +13,7 @@ use function array_slice;
use function debug_backtrace;
use function explode;
use function htmlspecialchars;
use function htmlspecialchars_decode;
use function intval;
use function md5;
use function sprintf;
@ -181,11 +182,11 @@ class Utilities
$dbgInfo = [];
if ($result === false && $errorMessage !== null) {
$dbgInfo['error'] = '<span class="text-danger">'
. htmlspecialchars($errorMessage) . '</span>';
// because Utilities::formatError is applied in DbiMysqli
$dbgInfo['error'] = htmlspecialchars_decode($errorMessage);
}
$dbgInfo['query'] = htmlspecialchars($query);
$dbgInfo['query'] = $query;
$dbgInfo['time'] = $time;
// Get and slightly format backtrace, this is used
// in the javascript console.