X-Git-Url: https://git.pterodactylus.net/?p=fms.git;a=blobdiff_plain;f=src%2Fhttp%2Fpages%2Fexecquerypage.cpp;h=8ef4c48bd9ec76a9ac6499ec81e3c39f579dd13b;hp=50d3f0ce56aff09133080903879a377241e66b0c;hb=3dc3ac3cfe10b7196a7977e9c041c29fa141c35e;hpb=befd91205eff729a182f66de15374a577a8718f7

diff --git a/src/http/pages/execquerypage.cpp b/src/http/pages/execquerypage.cpp
index 50d3f0c..8ef4c48 100644
--- a/src/http/pages/execquerypage.cpp
+++ b/src/http/pages/execquerypage.cpp
@@ -8,10 +8,12 @@
 const std::string ExecQueryPage::GeneratePage(const std::string &method, const std::map<std::string,std::string> &queryvars)
 {
 	std::string content="";
+	std::string query="";
 
 	if(queryvars.find("formaction")!=queryvars.end() && (*queryvars.find("formaction")).second=="execute" && queryvars.find("query")!=queryvars.end() && (*queryvars.find("query")).second!="")
 	{
-		SQLite3DB::Recordset rs=m_db->Query((*queryvars.find("query")).second);
+		query=(*queryvars.find("query")).second;
+		SQLite3DB::Recordset rs=m_db->Query(query);
 
 		content+="<table>";
 		if(rs.Count()>0)
@@ -49,7 +51,7 @@ const std::string ExecQueryPage::GeneratePage(const std::string &method, const s
 	content+="<h2>Execute Query</h2>";
 	content+="<form name=\"frmquery\" method=\"POST\">";
 	content+="<input type=\"hidden\" name=\"formaction\" value=\"execute\">";
-	content+="<textarea name=\"query\" rows=\"10\" cols=\"80\"></textarea>";
+	content+="<textarea name=\"query\" rows=\"10\" cols=\"80\">"+SanitizeOutput(query)+"</textarea>";
 	content+="<input type=\"submit\" value=\"Execute Query\">";
 	content+="</form>";