Don't pass strings directly to errdetail() and errhint() - use
authorMagnus Hagander <magnus@hagander.net>
Thu, 20 Nov 2008 15:36:22 +0000 (15:36 +0000)
committerMagnus Hagander <magnus@hagander.net>
Thu, 20 Nov 2008 15:36:22 +0000 (15:36 +0000)
commit6c3690d835e3bb7fc86b4f08335cb7a8fd22f4e2
tree57aff6be54441f1dd49b1d8455b5789a5e8abdbe
parent284491ee714bb106ba11468d25fec5e485f03e90
Don't pass strings directly to errdetail() and errhint() - use
%s to unescape them. Fixes a potential security issue (in as yet
unreleased code)
src/pl/plpgsql/src/pl_exec.c