From 90ddeecf60fc029608b972e490b735f3a65ed0cb Mon Sep 17 00:00:00 2001 From: Madhura Jayaratne Date: Sun, 17 Aug 2014 08:52:05 -0400 Subject: [PATCH] bug #4504 [security] Self-XSS in query charts Signed-off-by: Marc Delisle --- ChangeLog | 1 + js/tbl_chart.js | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 94b41b5d26..eea09d6158 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,7 @@ phpMyAdmin - ChangeLog - bug #4501 [security] XSS in table browse page - bug #4502 [security] Self-XSS in enum value editor - bug #4503 [security] Self-XSSes in monitor +- bug #4504 [security] Self-XSS in query charts - bug #4505 [security] XSS in view operations page 4.2.7.0 (2014-07-31) diff --git a/js/tbl_chart.js b/js/tbl_chart.js index 943d4aee35..04c9c40b0c 100644 --- a/js/tbl_chart.js +++ b/js/tbl_chart.js @@ -47,7 +47,7 @@ function PMA_queryChart(data, columnNames, settings) { }, axes : { xaxis : { - label : settings.xaxisLabel + label : escapeHtml(settings.xaxisLabel) }, yaxis : { label : settings.yaxisLabel