gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'QA_4_2'

Browse Source
This commit is contained in:
Marc Delisle 2014-07-17 17:19:50 -04:00
commit 75aa2e8cd2
3 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ChangeLog
View File

@ -36,6 +36,7 @@ phpMyAdmin - ChangeLog
- bug #4459 First few characters of database name aren't clickable when expanded
- bug #4486 [security] XSS injection due to unescaped table comment
- bug #4488 [security] XSS injection due to unescaped table name (triggers)
- bug #4492 [security] XSS in AJAX confirmation messages
4.2.5.0 (2014-06-26)
- bug #4467 shell_exec() has been disabled for security reasons

4
js/functions.js
View File

@ -3780,7 +3780,7 @@ AJAX.registerOnload('functions.js', function () {
var question = PMA_messages.strDropTableStrongWarning + ' ';
question += $.sprintf(
PMA_messages.strDoYouReally,
'DROP TABLE ' + PMA_commonParams.get('table')
'DROP TABLE ' + escapeHtml(PMA_commonParams.get('table'))
);
$(this).PMA_confirm(question, $(this).attr('href'), function (url) {
@ -3846,7 +3846,7 @@ AJAX.registerOnload('functions.js', function () {
var question = PMA_messages.strTruncateTableStrongWarning + ' ';
question += $.sprintf(
PMA_messages.strDoYouReally,
'TRUNCATE ' + PMA_commonParams.get('table')
'TRUNCATE ' + escapeHtml(PMA_commonParams.get('table'))
);
$(this).PMA_confirm(question, $(this).attr('href'), function (url) {
PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);

1
js/tbl_structure.js
View File

@ -198,6 +198,7 @@ AJAX.registerOnload('tbl_structure.js', function () {
* @var curr_column_name String containing name of the field referred to by {@link curr_row}
*/
var curr_column_name = $curr_row.children('th').children('label').text();
curr_column_name = escapeHtml(curr_column_name);
/**
* @var $after_field_item Corresponding entry in the 'After' field.
*/