From 29a1f56495a7d1d98da31a614f23c0819a606a4d Mon Sep 17 00:00:00 2001 From: Marc Delisle Date: Thu, 17 Jul 2014 17:18:52 -0400 Subject: [PATCH] bug #4492 [security] XSS in AJAX confirmation messages Signed-off-by: Marc Delisle --- ChangeLog | 1 + js/functions.js | 4 ++-- js/tbl_structure.js | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 5a07d9023c..66c51992da 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,7 @@ phpMyAdmin - ChangeLog - bug #4459 First few characters of database name aren't clickable when expanded - bug #4486 [security] XSS injection due to unescaped table comment - bug #4488 [security] XSS injection due to unescaped table name (triggers) +- bug #4492 [security] XSS in AJAX confirmation messages 4.2.5.0 (2014-06-26) - bug #4467 shell_exec() has been disabled for security reasons diff --git a/js/functions.js b/js/functions.js index b3e3d0f8ba..ac6e0180c5 100644 --- a/js/functions.js +++ b/js/functions.js @@ -3548,7 +3548,7 @@ AJAX.registerOnload('functions.js', function () { var question = PMA_messages.strDropTableStrongWarning + ' '; question += $.sprintf( PMA_messages.strDoYouReally, - 'DROP TABLE ' + PMA_commonParams.get('table') + 'DROP TABLE ' + escapeHtml(PMA_commonParams.get('table')) ); $(this).PMA_confirm(question, $(this).attr('href'), function (url) { @@ -3614,7 +3614,7 @@ AJAX.registerOnload('functions.js', function () { var question = PMA_messages.strTruncateTableStrongWarning + ' '; question += $.sprintf( PMA_messages.strDoYouReally, - 'TRUNCATE ' + PMA_commonParams.get('table') + 'TRUNCATE ' + escapeHtml(PMA_commonParams.get('table')) ); $(this).PMA_confirm(question, $(this).attr('href'), function (url) { PMA_ajaxShowMessage(PMA_messages.strProcessingRequest); diff --git a/js/tbl_structure.js b/js/tbl_structure.js index f754832c8a..9821cb312f 100644 --- a/js/tbl_structure.js +++ b/js/tbl_structure.js @@ -198,6 +198,7 @@ AJAX.registerOnload('tbl_structure.js', function () { * @var curr_column_name String containing name of the field referred to by {@link curr_row} */ var curr_column_name = $curr_row.children('th').children('label').text(); + curr_column_name = escapeHtml(curr_column_name); /** * @var $after_field_item Corresponding entry in the 'After' field. */