From 10014d4dc596b9e3a491bf04f3e708cf1887d5e1 Mon Sep 17 00:00:00 2001
From: Madhura Jayaratne <madhura.cj@gmail.com>
Date: Fri, 11 Jul 2014 06:39:20 -0400
Subject: [PATCH] bug #4488 [security] XSS injection due to unescaped table
 name (triggers)

Signed-off-by: Marc Delisle <marc@infomarc.info>
---
 ChangeLog                      | 1 +
 libraries/rte/rte_list.lib.php | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 431379ee70..446230a688 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -12,6 +12,7 @@ phpMyAdmin - ChangeLog
 - bug #4440 Javascript error when renaming table
 - bug #4483 'New window' link (selflink) disappears, causing Javascript error
 - bug #4486 [security] XSS injection due to unescaped table comment
+- bug #4488 [security] XSS injection due to unescaped table name (triggers)
 
 4.2.5.0 (2014-06-26)
 - bug #4467 shell_exec() has been disabled for security reasons
diff --git a/libraries/rte/rte_list.lib.php b/libraries/rte/rte_list.lib.php
index e6d119bffd..78a4fcaf36 100644
--- a/libraries/rte/rte_list.lib.php
+++ b/libraries/rte/rte_list.lib.php
@@ -259,9 +259,9 @@ function PMA_TRI_getRowForList($trigger, $rowclass = '')
     $retval .= "            </td>\n";
     if (empty($table)) {
         $retval .= "            <td>\n";
-        $retval .= "                <a href='db_triggers.php?{$url_query}"
-                                     . "&amp;table={$trigger['table']}'>"
-                                     . $trigger['table'] . "</a>\n";
+        $retval .= "<a href='db_triggers.php?{$url_query}"
+            . "&amp;table=" . urlencode($trigger['table']) . "'>"
+            . urlencode($trigger['table']) . "</a>";
         $retval .= "            </td>\n";
     }
     $retval .= "            <td>\n";