From 2c45d7caa614afd71dbe3d0f7270f51ce5569614 Mon Sep 17 00:00:00 2001
From: Madhura Jayaratne <madhura.cj@gmail.com>
Date: Sun, 17 Aug 2014 08:47:53 -0400
Subject: [PATCH] bug #4502 [security] Self-XSS in enum value editor

Signed-off-by: Marc Delisle <marc@infomarc.info>
---
 ChangeLog       | 1 +
 js/functions.js | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 54120c2053..941a059ada 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog
 
 4.2.7.1 (2014-08-17)
 - bug #4501 [security] XSS in table browse page
+- bug #4502 [security] Self-XSS in enum value editor
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)
diff --git a/js/functions.js b/js/functions.js
index a970a81584..bcdead8e17 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -2692,7 +2692,7 @@ AJAX.registerOnload('functions.js', function () {
         } else {
             title = PMA_messages.enum_columnVals.replace(
                 /%s/,
-                '"' + decodeURIComponent(colname) + '"'
+                '"' + escapeHtml(decodeURIComponent(colname)) + '"'
             );
         }
         // Get the values as a string