From 5dffdab32c5c874b211f38686ec3bd7959746050 Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Wed, 30 Apr 2008 16:27:46 +0000
Subject: [PATCH] sanitize $after_field

---
 ChangeLog                        | 2 ++
 libraries/tbl_properties.inc.php | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index eec479ddd2..c29eebc0c5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,6 +10,8 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA
 - [dbi] Incorrect interpretation for some mysqli field flags 
 - bug #1910621 [display] part 1: do not display a TEXT utf8_bin as BLOB
   (fixed for mysqli extension only)
+- [interface] sanitize the after_field parameter,
+  thanks to Norman Hippert
 
 2.11.6.0 (2008-04-29)
 - bug #1903724 [interface] Displaying of very large queries in error message 
diff --git a/libraries/tbl_properties.inc.php b/libraries/tbl_properties.inc.php
index f5b2ec4404..3251b18f4a 100644
--- a/libraries/tbl_properties.inc.php
+++ b/libraries/tbl_properties.inc.php
@@ -68,7 +68,7 @@ if ($action == 'tbl_create.php') {
 } elseif ($action == 'tbl_addfield.php') {
     ?>
     <input type="hidden" name="field_where" value="<?php echo $field_where; ?>" />
-    <input type="hidden" name="after_field" value="<?php echo $after_field; ?>" />
+    <input type="hidden" name="after_field" value="<?php echo PMA_sanitize($after_field); ?>" />
     <?php
 }
 
@@ -86,7 +86,7 @@ if (isset($field_where)) {
 
 if (isset($after_field)) {
     ?>
-    <input type="hidden" name="orig_after_field" value="<?php echo $after_field; ?>" />
+    <input type="hidden" name="orig_after_field" value="<?php echo PMA_sanitize($after_field); ?>" />
     <?php
 }