bug #4502 [security] Self-XSS in enum value editor

Signed-off-by: Marc Delisle <marc@infomarc.info>
2014-08-17 08:47:53 -04:00 · 2014-08-17 08:47:53 -04:00 · 2c45d7caa6
commit 2c45d7caa6
parent 647c9d12e3
2 changed files with 2 additions and 1 deletions
--- a/1
+++ b/1
@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog

 4.2.7.1 (2014-08-17)
 - bug #4501 [security] XSS in table browse page
+- bug #4502 [security] Self-XSS in enum value editor
 - bug #4505 [security] XSS in view operations page

 4.2.7.0 (2014-07-31)
--- a/js/functions.js
+++ b/js/functions.js
@ -2692,7 +2692,7 @@ AJAX.registerOnload('functions.js', function () {
        } else {
            title = PMA_messages.enum_columnVals.replace(
                /%s/,
-                '"' + decodeURIComponent(colname) + '"'
+                '"' + escapeHtml(decodeURIComponent(colname)) + '"'
            );
        }
        // Get the values as a string