@@ -3356,6 +3356,11 @@ QGISEXTERN bool saveStyle( const QString& uri, const QString& qmlStyle, const QS
3356
3356
uiFileValue = QString ( " ,XMLPARSE(DOCUMENT %1)" ).arg ( QgsPostgresConn::quotedValue ( uiFileContent ) );
3357
3357
}
3358
3358
3359
+ // Note: in the construction of the INSERT and UPDATE strings the qmlStyle and sldStyle values
3360
+ // can contain user entered strings, which may themselves include %## values that would be
3361
+ // replaced by the QString.arg function. To ensure that the final SQL string is not corrupt these
3362
+ // two values are both replaced in the final .arg call of the string construction.
3363
+
3359
3364
QString sql = QString ( " INSERT INTO layer_styles("
3360
3365
" f_table_catalog,f_table_schema,f_table_name,f_geometry_column,styleName,styleQML,styleSLD,useAsDefault,description,owner%11"
3361
3366
" ) VALUES ("
@@ -3371,6 +3376,7 @@ QGISEXTERN bool saveStyle( const QString& uri, const QString& qmlStyle, const QS
3371
3376
.arg ( QgsPostgresConn::quotedValue ( dsUri.username () ) )
3372
3377
.arg ( uiFileColumn )
3373
3378
.arg ( uiFileValue )
3379
+ // Must be the final .arg replacement - see above
3374
3380
.arg ( QgsPostgresConn::quotedValue ( qmlStyle ),
3375
3381
QgsPostgresConn::quotedValue ( sldStyle ) );
3376
3382
@@ -3419,6 +3425,7 @@ QGISEXTERN bool saveStyle( const QString& uri, const QString& qmlStyle, const QS
3419
3425
.arg ( QgsPostgresConn::quotedValue ( dsUri.table () ) )
3420
3426
.arg ( QgsPostgresConn::quotedValue ( dsUri.geometryColumn () ) )
3421
3427
.arg ( QgsPostgresConn::quotedValue ( styleName.isEmpty () ? dsUri.table () : styleName ) )
3428
+ // Must be the final .arg replacement - see above
3422
3429
.arg ( QgsPostgresConn::quotedValue ( qmlStyle ),
3423
3430
QgsPostgresConn::quotedValue ( sldStyle ) );
3424
3431
}
0 commit comments