gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[security] properly escape query error message when creating new trigger, see PMASA-2012-4

Browse Source
This commit is contained in:
Rouslan Placella 2012-08-10 16:26:11 +02:00 committed by Dieter Adriaenssens
parent dca22c5046
commit 1aec25f5f2
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libraries/rte/rte_triggers.lib.php
View File

@ -100,8 +100,12 @@ function PMA_TRI_handleEditor()
// 'Add a new item' mode
$result = PMA_DBI_try_query($item_query);
if (! $result) {
$errors[] = sprintf(__('The following query has failed: "%s"'), $item_query) . '<br /><br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
$errors[] = sprintf(
__('The following query has failed: "%s"'),
htmlspecialchars($item_query)
)
. '<br /><br />'
. __('MySQL said: ') . PMA_DBI_getError(null);
} else {
$message = PMA_Message::success(__('Trigger %1$s has been created.'));
$message->addParam(PMA_backquote($_REQUEST['item_name']));