gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix escaping of SQL query and errors for debug console

Browse Source 
Signed-off-by: William Desportes <williamdes@wdes.fr>
This commit is contained in:
William Desportes 2022-08-15 12:52:25 +02:00
parent 2365ec78e2
commit d0093468d0
No known key found for this signature in database
GPG Key ID: 90A0EF1B8251A889
2 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
js/src/console.js
View File

@ -1364,7 +1364,7 @@ var ConsoleDebug = {
appendQueryExtraInfo: function (query, $elem) { appendQueryExtraInfo: function (query, $elem) {
if ('error' in query) { if ('error' in query) {
$elem.append( $elem.append(
$('<div>').html(query.error) $('<div>').append($('<span class="text-danger">').text(query.error))
); );
} }
$elem.append(this.formatBackTrace(query.trace)); $elem.append(this.formatBackTrace(query.trace));

7
libraries/classes/Query/Utilities.php
View File

@ -13,6 +13,7 @@ use function array_slice;
use function debug_backtrace; use function debug_backtrace;
use function explode; use function explode;
use function htmlspecialchars; use function htmlspecialchars;
use function htmlspecialchars_decode;
use function intval; use function intval;
use function md5; use function md5;
use function sprintf; use function sprintf;
@ -181,11 +182,11 @@ class Utilities
$dbgInfo = []; $dbgInfo = [];
if ($result === false && $errorMessage !== null) { if ($result === false && $errorMessage !== null) {
$dbgInfo['error'] = '<span class="text-danger">' // because Utilities::formatError is applied in DbiMysqli
. htmlspecialchars($errorMessage) . '</span>'; $dbgInfo['error'] = htmlspecialchars_decode($errorMessage);
} }
$dbgInfo['query'] = htmlspecialchars($query); $dbgInfo['query'] = $query;
$dbgInfo['time'] = $time; $dbgInfo['time'] = $time;
// Get and slightly format backtrace, this is used // Get and slightly format backtrace, this is used
// in the javascript console. // in the javascript console.