gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bug #4562 [security] XSS in debug SQL output

Browse Source 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
This commit is contained in:
Madhura Jayaratne 2014-10-17 18:07:08 +05:30
parent 5118938f10
commit 57594febab
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -1,6 +1,9 @@
phpMyAdmin - ChangeLog
======================
4.0.10.5 (not yet released)
- bug #4562 [security] XSS in debug SQL output
4.0.10.4 (2014-10-01)
- bug #4544 [security] XSS vulnerabilities in table search and table structure pages

6
libraries/database_interface.lib.php
View File

@ -139,11 +139,11 @@ function PMA_DBI_DBG_query($query, $link, $result, $time)
} else {
$_SESSION['debug']['queries'][$hash] = array();
if ($result == false) {
$_SESSION['debug']['queries'][$hash]['error']
= '<b style="color:red">' . mysqli_error($link) . '</b>';
$_SESSION['debug']['queries'][$hash]['error'] = '<b style="color:red">'
. htmlspecialchars(mysqli_error($link)) . '</b>';
}
$_SESSION['debug']['queries'][$hash]['count'] = 1;
$_SESSION['debug']['queries'][$hash]['query'] = $query;
$_SESSION['debug']['queries'][$hash]['query'] = htmlspecialchars($query);
$_SESSION['debug']['queries'][$hash]['time'] = $time;
}