Put queries into a transaction and rollback after user query

So that users cannot change the database.
This has the disadvantage, that we cant have tests
where user has to insert stuff.

1 files changed, 6 insertions, 0 deletions

diff --git a/sqlbox/view.php b/sqlbox/view.php
index 47a9de4..f215d7d 100644
--- a/sqlbox/view.php
+++ b/sqlbox/view.php
@@ -99,12 +99,18 @@ if (isset($data->sqlbox_query)) {
         print_error('dbconnectionfailed', 'sqlbox');
 
     $table = db_table_from_query($db, $data->sqlbox_query);
+    $result = @pg_query($db, "BEGIN TRANSACTION;");
+    if (!$result)
+        print_error('dmltransactionexception');
     if (strlen($sqlbox->query) > 0) {
         $table_orig = db_table_from_query($db, $sqlbox->query);
         if ($table->data != $table_orig->data ||
             $table->head != $table_orig->head) 
             $correct = false;
     }
+    $result = @pg_query($db, "ROLLBACK TRANSACTION;");
+    if (!$result)
+        print_error('dmltransactionexception');
     pg_close($db);
 
     echo html_writer::table($table);