Can user execute update/delete XSS in query? #199
-
I'm using this escaping method:
thoughts allow users make raw requests for extended (sphinx) queries but they able to delete records from index? for example by doing something like:
as understand, access permissions like in MySQL not implemented in manticore? Would be nice to allow extended features but worried somebody able to drop the index without |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
You can read more about the
Correct. |
Beta Was this translation helpful? Give feedback.
$index->search()
doesn't use the/sql
endpoint (https://manual.manticoresearch.com/Connecting_to_the_server/HTTP#/sql), so it's unlikely there can be an injection which would let you executeDELETE
with a specific query. Even ifsearch()
used/sql
,/sql
can only run searches, you'd have to use/sql?mode=raw
for everything else (https://manual.manticoresearch.com/Connecting_to_the_server/HTTP#/sql?mode=rawYou can read more about the
sql()
php method here https://github.com/manticoresoftware/manticoresearch-php/blob/abef209233f2acf03a9e1d3f2ba313cbf85ee0a9/docs/sql.md#sqlCorrect.