From 3ffc967fb60cf2910cc2f571017e977558c67821 Mon Sep 17 00:00:00 2001
From: Madhura Jayaratne <madhura.cj@gmail.com>
Date: Sun, 17 Aug 2014 08:54:05 -0400
Subject: [PATCH] bug #4517 [security] XSS in relation view

Signed-off-by: Marc Delisle <marc@infomarc.info>
---
 ChangeLog                      | 1 +
 libraries/tbl_relation.lib.php | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index eea09d6158..1edd1858bc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,7 @@ phpMyAdmin - ChangeLog
 - bug #4503 [security] Self-XSSes in monitor
 - bug #4504 [security] Self-XSS in query charts
 - bug #4505 [security] XSS in view operations page
+- bug #4517 [security] XSS in relation view
 
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
diff --git a/libraries/tbl_relation.lib.php b/libraries/tbl_relation.lib.php
index 0e1bc3d802..60b020ed47 100644
--- a/libraries/tbl_relation.lib.php
+++ b/libraries/tbl_relation.lib.php
@@ -554,7 +554,7 @@ function PMA_getHtmlForForeignKey($save_row, $i, $existrel_foreign, $myfield, $d
         $html_output .= __('Constraint name');
         $html_output .= '<input type="text" name="constraint_name['
             . $myfield_md5 . ']"'
-            . ' value="' . $constraint_name . '"/>';
+            . ' value="' . htmlspecialchars($constraint_name) . '"/>';
         $html_output .= '</span>' . "\n";
 
         $html_output .= '<span class="formelement clearfloat">';