xtuple/xtuple — pull request #368 by bendiy (2013-05-13 15:33:23+00:00)
Title: 20266 Fix SQL Injection exploit in XT.Data

This PR changes XT.Data to use the new XT.format() function for properly escape queries.

It also wraps some functions in try/catch and hands off errors to a new function, XT.error(). XT.error(), will log a stack trace in the pg logs. There is now an event listener in XT.dataSource that will log that same stack and error to the node-datasource console log and browser JS console.

xt.js_init() now takes an optional "true" parameter: SELECT xt.js_init(true); This will cause plv8 to output debug messages including all queries ran in XT.Data.