Amazing ! but it needs security update

You can select and display content from any table you want. What kind of security checks do you think should be in place? It’s a plugin that takes a query and builds a table around it that can be filtered and exported.

I could try and add a basic string check to see if DELETE is at the start of the query but there are a number of ways to get around it I’m sure.

The plugin is meant to let you do whatever you’d like as an admin and provide access to those reports (no direct SQL access) to people of lower roles based on access rights in WP.

• This reply was modified 3 years, 7 months ago by Scott Kingsley Clark.

If you put “delete from wp_posts” in query, it works … And it shouldn’t

Yeah, I know it, that it is a many ways to filter and to avoid id, but maybe , add a few checks, only for a check ??

What about some JS that checks for the word “delete” and if it finds it, warn the person typing the query?