From 7983308e8aadebe63effb0ae6c80e910700dc57e Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Sat, 31 Mar 2012 07:22:51 -0400
Subject: [PATCH] Add minimal XSS protection to appended string ChangeLog entry

---
 ChangeLog                                            | 1 +
 libraries/transformations/text_plain__append.inc.php | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 3b73524cea..eed39d83d1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -14,6 +14,7 @@ phpMyAdmin - ChangeLog
 + Patch #3506552 Contest-2: Show index information in the data dictionary
 + Patch #3510656 Contest-1: Ignoring foreign keys while dropping tables
 - Bug #3509686 Reverting sort on joined column does not work
++ New transformation: append string
 
 3.5.1.0 (not yet released)
 - bug #3510784 [edit] Limit clause ignored when sort order is remembered
diff --git a/libraries/transformations/text_plain__append.inc.php b/libraries/transformations/text_plain__append.inc.php
index 8a8b3f4198..5ca0d3c7e0 100644
--- a/libraries/transformations/text_plain__append.inc.php
+++ b/libraries/transformations/text_plain__append.inc.php
@@ -17,7 +17,7 @@ function PMA_transformation_text_plain__append($buffer, $options = array(), $met
         $options[0] = '';
     }
 
-    $newtext = $buffer . $options[0];  //just append the option to the original text
+    $newtext = $buffer . htmlspecialchars($options[0]);  //just append the option to the original text
 
     return $newtext;
 }