bug #4505 [security] XSS in view operations page

Signed-off-by: Marc Delisle <marc@infomarc.info>
2014-08-17 08:41:57 -04:00 · 2014-08-17 08:41:57 -04:00 · 0cd293f5e1
commit 0cd293f5e1
parent 773c507cda
2 changed files with 4 additions and 1 deletions
--- a/3
+++ b/3
@ -1,6 +1,9 @@
 phpMyAdmin - ChangeLog
 ======================

+4.2.7.1 (2014-08-17)
+- bug #4505 [security] XSS in view operations page
+
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
 - bug #4494 Overlap in navigation panel
--- a/js/functions.js
+++ b/js/functions.js
@ -3585,7 +3585,7 @@ AJAX.registerOnload('functions.js', function () {
        var question = PMA_messages.strDropTableStrongWarning + ' ';
        question += $.sprintf(
            PMA_messages.strDoYouReally,
-            'DROP VIEW ' + PMA_commonParams.get('table')
+            'DROP VIEW ' + escapeHtml(PMA_commonParams.get('table'))
        );

        $(this).PMA_confirm(question, $(this).attr('href'), function (url) {