X-Git-Url: https://git.pterodactylus.net/?p=fms.git;a=blobdiff_plain;f=src%2Fhttp%2Fpages%2Fexecquerypage.cpp;h=97b402b60a586699f475e78c43e557b3fc462c1b;hp=8d46c46cd4e7989b80d2d4d2edb6109c668714e6;hb=HEAD;hpb=026dc6b2bc548c945359c4e166eff514f2c47c6a

diff --git a/src/http/pages/execquerypage.cpp b/src/http/pages/execquerypage.cpp
index 8d46c46..97b402b 100644
--- a/src/http/pages/execquerypage.cpp
+++ b/src/http/pages/execquerypage.cpp
@@ -10,7 +10,7 @@ const std::string ExecQueryPage::GeneratePage(const std::string &method, const s
 	std::string content="";
 	std::string query="";
 
-	if(queryvars.find("formaction")!=queryvars.end() && (*queryvars.find("formaction")).second=="execute" && queryvars.find("query")!=queryvars.end() && (*queryvars.find("query")).second!="")
+	if(queryvars.find("formaction")!=queryvars.end() && (*queryvars.find("formaction")).second=="execute" && queryvars.find("query")!=queryvars.end() && (*queryvars.find("query")).second!="" && ValidateFormPassword(queryvars))
 	{
 		query=(*queryvars.find("query")).second;
 		SQLite3DB::Recordset rs=m_db->Query(query);
@@ -30,6 +30,12 @@ const std::string ExecQueryPage::GeneratePage(const std::string &method, const s
 			}
 			content+="<tr>";
 		}
+		else if(m_db->GetLastResult()!=SQLITE_OK)
+		{
+			std::string error="";
+			m_db->GetLastError(error);
+			content+="<tr><td>"+error+"</td></tr>";
+		}
 		while(!rs.AtEnd())
 		{
 			content+="<tr>";
@@ -38,7 +44,7 @@ const std::string ExecQueryPage::GeneratePage(const std::string &method, const s
 				content+="<td>";
 				if(rs.GetField(i))
 				{
-					content+=rs.GetField(i);
+					content+=SanitizeOutput(std::string(rs.GetField(i)));
 				}
 				content+="</td>";
 			}
@@ -50,6 +56,7 @@ const std::string ExecQueryPage::GeneratePage(const std::string &method, const s
 
 	content+="<h2>Execute Query</h2>";
 	content+="<form name=\"frmquery\" method=\"POST\">";
+	content+=CreateFormPassword();
 	content+="<input type=\"hidden\" name=\"formaction\" value=\"execute\">";
 	content+="<textarea name=\"query\" rows=\"10\" cols=\"80\">"+StringFunctions::Replace(query,"<","&lt;")+"</textarea>";
 	content+="<input type=\"submit\" value=\"Execute Query\">";