From e1f4901ffc400b6d2df15eac0ba5015fe48a27c4 Mon Sep 17 00:00:00 2001 From: Herman van Rink Date: Thu, 25 Nov 2010 11:50:50 +0100 Subject: [PATCH 1/4] bug #3115519: fixed XSS on search --- libraries/common.lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libraries/common.lib.php b/libraries/common.lib.php index 716af94d21..4dcbe8ee3b 100644 --- a/libraries/common.lib.php +++ b/libraries/common.lib.php @@ -1644,7 +1644,7 @@ function PMA_linkOrButton($url, $message, $tag_params = array(), $tmp = $tag_params; $tag_params = array(); if (!empty($tmp)) { - $tag_params['onclick'] = 'return confirmLink(this, \'' . $tmp . '\')'; + $tag_params['onclick'] = 'return confirmLink(this, \'' . PMA_escapeJsString($tmp) . '\')'; } unset($tmp); } From 21f624a26574fd45c043ddd27bf5a190b80c2757 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Fri, 26 Nov 2010 08:51:46 -0500 Subject: [PATCH 2/4] ChangeLog for XSS search --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index ff8b9dd059..6cb1ab2596 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,9 @@ phpMyAdmin - ChangeLog $Id$ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/ChangeLog $ +2.11.11.1 (2010-11-26) +- bug #3115519 (private) [security] XSS on db search + 2.11.11.0 (2010-09-07) - [core] Fix broken cleanup of $_GET - bug #3054458 [core] Fixed displaying number of rows. From a6e79391b92a48ffef307fa107ce1a61965e4244 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Fri, 26 Nov 2010 09:17:30 -0500 Subject: [PATCH 3/4] 2.11.11.1 release --- Documentation.html | 4 ++-- README | 4 ++-- libraries/Config.class.php | 2 +- translators.html | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Documentation.html b/Documentation.html index 5513e18683..a3f7982789 100644 --- a/Documentation.html +++ b/Documentation.html @@ -11,7 +11,7 @@ - phpMyAdmin 2.11.11 - Documentation + phpMyAdmin 2.11.11.1 - Documentation @@ -33,7 +33,7 @@
  • Glossary
    • -

    phpMyAdmin 2.11.11 Documentation

    +

    phpMyAdmin 2.11.11.1 Documentation

    • phpMyAdmin homepage
      • diff --git a/README b/README index 375317e6aa..a1dfb541c4 100644 --- a/README +++ b/README @@ -5,8 +5,8 @@ phpMyAdmin - Readme A set of PHP-scripts to manage MySQL over the web. - Version 2.11.11 - --------------- + Version 2.11.11.1 + ----------------- http://www.phpmyadmin.net/ Copyright (C) 1998-2000 Tobias Ratschiller diff --git a/libraries/Config.class.php b/libraries/Config.class.php index a2cf481f7b..f1df2e09d3 100644 --- a/libraries/Config.class.php +++ b/libraries/Config.class.php @@ -85,7 +85,7 @@ class PMA_Config */ function checkSystem() { - $this->set('PMA_VERSION', '2.11.11'); + $this->set('PMA_VERSION', '2.11.11.1'); /** * @deprecated */ diff --git a/translators.html b/translators.html index 88148b99e7..f59ca41802 100644 --- a/translators.html +++ b/translators.html @@ -8,7 +8,7 @@ - phpMyAdmin 2.11.11 - Official translators + phpMyAdmin 2.11.11.1 - Official translators @@ -31,7 +31,7 @@
    • Glossary
    -

    phpMyAdmin 2.11.11 official translators list

    +

    phpMyAdmin 2.11.11.1 official translators list

    Here is the list of the "official translators" of phpMyAdmin.

    From 61d9e561580ccb4a07d6d0c5695c839a22cc3b78 Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Mon, 29 Nov 2010 12:11:59 -0500 Subject: [PATCH 4/4] 2.11.11.1 release date and PMASA ref --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 6cb1ab2596..89fe37c4b9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,8 +5,8 @@ phpMyAdmin - ChangeLog $Id$ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/ChangeLog $ -2.11.11.1 (2010-11-26) -- bug #3115519 (private) [security] XSS on db search +2.11.11.1 (2010-11-29) +- bug #3115519 (private) [security] XSS on db search, see PMASA-2010-8 2.11.11.0 (2010-09-07) - [core] Fix broken cleanup of $_GET