From 09a427b288cbbd1508a055a5594f906c22a60dec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= Date: Wed, 13 Jul 2016 10:32:55 +0200 Subject: [PATCH] Escape HTML markup in transformation wrapper MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ...in case content type is html. Signed-off-by: Michal Čihař --- transformation_wrapper.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/transformation_wrapper.php b/transformation_wrapper.php index 25bc61bc7c..769bca208a 100644 --- a/transformation_wrapper.php +++ b/transformation_wrapper.php @@ -112,7 +112,11 @@ if (isset($ct) && ! empty($ct)) { PMA_downloadHeader($cn, $mime_type); if (! isset($resize)) { - echo $row[$transform_key]; + if (stripos($mime_type, 'html') === false) { + echo $row[$transform_key]; + } else { + echo htmlspecialchars($row[$transform_key]); + } } else { // if image_*__inline.inc.php finds that we can resize, // it sets $resize to jpeg or png