From 79089c9bc02c82c15419fd9d6496b8781ae08a5a Mon Sep 17 00:00:00 2001
From: Dieter Adriaenssens <ruleant@users.sourceforge.net>
Date: Sun, 31 Mar 2013 23:11:10 +0200
Subject: [PATCH 1/3] fix XSS reported by Janek Vind

---
 tbl_gis_visualization.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tbl_gis_visualization.php b/tbl_gis_visualization.php
index 0811d01aeb..bd95b2e6c7 100644
--- a/tbl_gis_visualization.php
+++ b/tbl_gis_visualization.php
@@ -110,7 +110,7 @@ $visualization = PMA_GIS_visualizationResults($data, $visualizationSettings, $fo
 <?php echo PMA_generate_common_hidden_inputs($url_params); ?>
 <fieldset>
     <legend><?php echo __('Display GIS Visualization'); ?></legend>
-    <div id="placeholder" style="width:<?php echo($visualizationSettings['width']); ?>px;height:<?php echo($visualizationSettings['height']); ?>px;">
+    <div id="placeholder" style="width:<?php echo(htmlspecialchars($visualizationSettings['width'])); ?>px;height:<?php echo(htmlspecialchars($visualizationSettings['height'])); ?>px;">
         <?php echo $visualization; ?>
     </div>
     <div id="openlayersmap"></div>
@@ -202,4 +202,4 @@ $visualization = PMA_GIS_visualizationResults($data, $visualizationSettings, $fo
  */
 require './libraries/footer.inc.php';
 
-?>
\ No newline at end of file
+?>

From 7e9ac67cbb58b40fbe0c18401b8e7d033c9dfe28 Mon Sep 17 00:00:00 2001
From: Dieter Adriaenssens <ruleant@users.sourceforge.net>
Date: Mon, 1 Apr 2013 22:35:37 +0200
Subject: [PATCH 2/3] add Changelog item for XSS found by Janek Vind, fixed in
 commit 79089c9bc02c82c15419fd9d6496b8781ae08a5a

---
 ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ChangeLog b/ChangeLog
index d8b56ced28..43abe9e53e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,7 @@ phpMyAdmin - ChangeLog
 - bug #3854 Incorrect header for Safari 6.0
 - bug #3705 Attempt to open trigger for edit gives NULL
 - Use HTML5 DOCTYPE 
+- [security] Self-XSS on GIS visualisation page, reported by Janek Vind
 
 3.5.7.0 (2013-02-15)
 - bug #3779 [core] Problem with backslash in enum fields

From b6ae26a7a9334be01517ebe79a603ea9e4cb0ede Mon Sep 17 00:00:00 2001
From: Dieter Adriaenssens <ruleant@users.sourceforge.net>
Date: Mon, 1 Apr 2013 22:56:43 +0200
Subject: [PATCH 3/3] improve coding style : echo does not need parenthesis

---
 tbl_gis_visualization.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tbl_gis_visualization.php b/tbl_gis_visualization.php
index bd95b2e6c7..1cf5c014ca 100644
--- a/tbl_gis_visualization.php
+++ b/tbl_gis_visualization.php
@@ -110,7 +110,7 @@ $visualization = PMA_GIS_visualizationResults($data, $visualizationSettings, $fo
 <?php echo PMA_generate_common_hidden_inputs($url_params); ?>
 <fieldset>
     <legend><?php echo __('Display GIS Visualization'); ?></legend>
-    <div id="placeholder" style="width:<?php echo(htmlspecialchars($visualizationSettings['width'])); ?>px;height:<?php echo(htmlspecialchars($visualizationSettings['height'])); ?>px;">
+    <div id="placeholder" style="width:<?php echo htmlspecialchars($visualizationSettings['width']); ?>px;height:<?php echo htmlspecialchars($visualizationSettings['height']); ?>px;">
         <?php echo $visualization; ?>
     </div>
     <div id="openlayersmap"></div>