gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Feature 14677: Security confirm() before running UPDATE

Browse Source 
When the user tries to execute an UPDATE query without an appopriate WHERE statement, the system will prompt an confirm dialog box asking him if he is sure about that.

Signed-off-by: Wellington Braga <wjbraga@artit.com.br>
This commit is contained in:
Wellington Braga 2018-10-23 11:01:51 -03:00
parent 87c742d12f
commit e249448839
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
js/functions.js
View File

@ -711,11 +711,13 @@ function confirmQuery (theForm1, sqlQuery1) {
var do_confirm_re_1 = new RegExp('^\\s*ALTER\\s+TABLE\\s+((`[^`]+`)|([A-Za-z0-9_$]+))\\s+DROP\\s', 'i');
var do_confirm_re_2 = new RegExp('^\\s*DELETE\\s+FROM\\s', 'i');
var do_confirm_re_3 = new RegExp('^\\s*TRUNCATE\\s', 'i');
var do_confirm_re_4 = new RegExp('^(?=.*UPDATE\\b)^((?!WHERE).)*$', 'i');
if (do_confirm_re_0.test(sqlQuery1) ||
do_confirm_re_1.test(sqlQuery1) ||
do_confirm_re_2.test(sqlQuery1) ||
do_confirm_re_3.test(sqlQuery1)) {
do_confirm_re_3.test(sqlQuery1) ||
do_confirm_re_4.test(sqlQuery1)) {
var message;
if (sqlQuery1.length > 100) {
message = sqlQuery1.substr(0, 100) + '\n ...';