From e24944883948ea1b866b7e7bb716cc43c8f57d9d Mon Sep 17 00:00:00 2001 From: Wellington Braga Date: Tue, 23 Oct 2018 11:01:51 -0300 Subject: [PATCH] Feature 14677: Security confirm() before running UPDATE When the user tries to execute an UPDATE query without an appopriate WHERE statement, the system will prompt an confirm dialog box asking him if he is sure about that. Signed-off-by: Wellington Braga --- js/functions.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/js/functions.js b/js/functions.js index f9c39255c8..a6c3e813b9 100644 --- a/js/functions.js +++ b/js/functions.js @@ -711,11 +711,13 @@ function confirmQuery (theForm1, sqlQuery1) { var do_confirm_re_1 = new RegExp('^\\s*ALTER\\s+TABLE\\s+((`[^`]+`)|([A-Za-z0-9_$]+))\\s+DROP\\s', 'i'); var do_confirm_re_2 = new RegExp('^\\s*DELETE\\s+FROM\\s', 'i'); var do_confirm_re_3 = new RegExp('^\\s*TRUNCATE\\s', 'i'); + var do_confirm_re_4 = new RegExp('^(?=.*UPDATE\\b)^((?!WHERE).)*$', 'i'); if (do_confirm_re_0.test(sqlQuery1) || do_confirm_re_1.test(sqlQuery1) || do_confirm_re_2.test(sqlQuery1) || - do_confirm_re_3.test(sqlQuery1)) { + do_confirm_re_3.test(sqlQuery1) || + do_confirm_re_4.test(sqlQuery1)) { var message; if (sqlQuery1.length > 100) { message = sqlQuery1.substr(0, 100) + '\n ...';