From 142408430c0036dc6ce133d6e8b667be3483faa5 Mon Sep 17 00:00:00 2001
From: "Ann + J.M" <phpMyAdmin@ZweiSteinSoft.de>
Date: Mon, 14 Jul 2014 20:06:17 +0200
Subject: [PATCH] Fix stored XSS in SQL console (history)

Signed-off-by: Ann + J.M <phpMyAdmin@ZweiSteinSoft.de>
---
 libraries/Console.class.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/libraries/Console.class.php b/libraries/Console.class.php
index fbf26de400..92324cdbf9 100644
--- a/libraries/Console.class.php
+++ b/libraries/Console.class.php
@@ -210,8 +210,9 @@ class PMA_Console
             if ($_sql_history) {
                 foreach (array_reverse($_sql_history) as $record) {
                     $output .= '<div class="message history collapsed hide" targetdb="'
-                            . $record['db'] . '" targettable="' . $record['table']
-                            . '""><div class="action_content">'
+                            . htmlspecialchars($record['db'])
+                            . '" targettable="' . htmlspecialchars($record['table'])
+                            . '"><div class="action_content">'
                             . sprintf(
                                   $tpl_query_actions,
                                   $record['db'],
@@ -221,7 +222,7 @@ class PMA_Console
                                   )
                               )
                             . '</div><span class="query">'
-                            . $record['sqlquery']
+                            . htmlspecialchars($record['sqlquery'])
                             . '</span></div>';
                 }
             }