diff --git a/ChangeLog b/ChangeLog
index a26b9709ac..55769bc88c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,10 @@
 phpMyAdmin - ChangeLog
 ======================
 
+4.2.13.1 (2014-12-03)
+- bug #4612 [security] XSS vulnerability in redirection mechanism
+- bug #4611 [security] DOS attack with long passwords
+
 4.2.13.0 (2014-11-30)
 - bug #4604 Query history not being deleted
 - bug #4057 db/table query string parameters no longer work
diff --git a/README b/README
index 284cdc2173..03485075f4 100644
--- a/README
+++ b/README
@@ -1,7 +1,7 @@
 phpMyAdmin - Readme
 ===================
 
-Version 4.2.13
+Version 4.2.13.1
 
 A set of PHP-scripts to manage MySQL over the web.
 
diff --git a/doc/conf.py b/doc/conf.py
index 595dcabd66..b369db359c 100644
--- a/doc/conf.py
+++ b/doc/conf.py
@@ -51,7 +51,7 @@ copyright = u'2012 - 2014, The phpMyAdmin devel team'
 # built documents.
 #
 # The short X.Y version.
-version = '4.2.13'
+version = '4.2.13.1'
 # The full version, including alpha/beta/rc tags.
 release = version
 
diff --git a/libraries/Config.class.php b/libraries/Config.class.php
index be7c1c600c..fca662415b 100644
--- a/libraries/Config.class.php
+++ b/libraries/Config.class.php
@@ -114,7 +114,7 @@ class PMA_Config
      */
     function checkSystem()
     {
-        $this->set('PMA_VERSION', '4.2.13');
+        $this->set('PMA_VERSION', '4.2.13.1');
         /**
          * @deprecated
          */
diff --git a/libraries/common.inc.php b/libraries/common.inc.php
index 2227c1e466..5cea823605 100644
--- a/libraries/common.inc.php
+++ b/libraries/common.inc.php
@@ -859,6 +859,9 @@ if (! defined('PMA_MINIMUM_COMMON')) {
                 . ' ' . $cfg['Server']['auth_type']
             );
         }
+        if (isset($_REQUEST['pma_password'])) {
+            $_REQUEST['pma_password'] = substr($_REQUEST['pma_password'], 0, 256);
+        }
         include_once  './libraries/plugins/auth/' . $auth_class . '.class.php';
         // todo: add plugin manager
         $plugin_manager = null;
@@ -988,6 +991,8 @@ if (! defined('PMA_MINIMUM_COMMON')) {
             $controllink = $userlink;
         }
 
+        $auth_plugin->storeUserCredentials();
+
         /* Log success */
         PMA_logUser($cfg['Server']['user']);
 
diff --git a/libraries/plugins/AuthenticationPlugin.class.php b/libraries/plugins/AuthenticationPlugin.class.php
index 3ddf55ee20..7943d2cb15 100644
--- a/libraries/plugins/AuthenticationPlugin.class.php
+++ b/libraries/plugins/AuthenticationPlugin.class.php
@@ -41,6 +41,15 @@ abstract class AuthenticationPlugin extends PluginObserver
      */
     abstract public function authSetUser();
 
+    /**
+     * Stores user credentials after successful login.
+     *
+     * @return void
+     */
+    public function storeUserCredentials()
+    {
+    }
+
     /**
      * User is not allowed to login to MySQL -> authentication failed
      *
diff --git a/libraries/plugins/auth/AuthenticationCookie.class.php b/libraries/plugins/auth/AuthenticationCookie.class.php
index e21471c5eb..68cb5d4b35 100644
--- a/libraries/plugins/auth/AuthenticationCookie.class.php
+++ b/libraries/plugins/auth/AuthenticationCookie.class.php
@@ -557,6 +557,16 @@ class AuthenticationCookie extends AuthenticationPlugin
         unset($_SERVER['PHP_AUTH_PW']);
 
         $_SESSION['last_access_time'] = time();
+    }
+
+    /**
+     * Stores user credentials after successful login.
+     *
+     * @return void
+     */
+    public function storeUserCredentials()
+    {
+        global $cfg;
 
         $this->createBlowfishIV();
 
diff --git a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php
index ca09a8d7b7..38620970eb 100644
--- a/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php
+++ b/test/classes/plugin/auth/PMA_AuthenticationCookie_test.php
@@ -797,6 +797,8 @@ class PMA_AuthenticationCookie_Test extends PHPUnit_Framework_TestCase
             isset($_SERVER['PHP_AUTH_PW'])
         );
 
+        $this->object->storeUserCredentials();
+
         $this->assertTrue(
             isset($_COOKIE['pmaUser-1'])
         );
@@ -866,6 +868,7 @@ class PMA_AuthenticationCookie_Test extends PHPUnit_Framework_TestCase
         $attrInstance->setValue(null, $mockResponse);
 
         $this->object->authSetUser();
+        $this->object->storeUserCredentials();
 
         $this->assertTrue(
             isset($_COOKIE['pmaServer-2'])
diff --git a/url.php b/url.php
index 71efc9fb6b..82b224311b 100644
--- a/url.php
+++ b/url.php
@@ -11,6 +11,10 @@
  */
 define('PMA_MINIMUM_COMMON', true);
 require_once './libraries/common.inc.php';
+/**
+ * JavaScript escaping.
+ */
+require_once './libraries/js_escape.lib.php';
 
 if (! PMA_isValid($_GET['url'])
     || ! preg_match('/^https?:\/\/[^\n\r]*$/', $_GET['url'])
@@ -24,7 +28,7 @@ if (! PMA_isValid($_GET['url'])
     //  external site.
     echo "<script type='text/javascript'>
             window.onload=function(){
-                window.location='" . htmlspecialchars($_GET['url']) . "';
+                window.location='" . PMA_escapeJsString($_GET['url']) . "';
             }
         </script>";
     // Display redirecting msg on screen.