Re: pgAdmin 4 commit: Don't quote variable values used by SET. It's usually - Mailing list pgadmin-hackers

Hi Dave,

There is a possibility of SQL Injection (if we don't use qtLiteral.

We need some kind of check for this.

What do you say?

--

Thanks & Regards,

Ashesh Vashi
EnterpriseDB INDIA: Enterprise PostgreSQL Company

http://www.linkedin.com/in/asheshvashi

On Fri, Feb 2, 2018 at 7:28 PM, Dave Page <dpage@pgadmin.org> wrote:

Don't quote variable values used by SET. It's usually going to be wrong. Fixes #3027

Branch
------
master

Details
-------
https://git.postgresql.org/gitweb?p=pgadmin4.git;a=commitdiff;h=4d69764869bf9d1731d61d15a290388d5bd0f789

Modified Files
--------------
.../databases/schemas/templates/macros/functions/variable.macros      | 2 +-
.../browser/server_groups/servers/templates/macros/variable.macros    | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)