From 2f04cdaa7ac9d6b961ac0b4036e06435e735492c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Tue, 29 Aug 2017 14:58:40 +0200
Subject: [PATCH] Properly escape javascript variables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In case some variable name contains special chars, we should really
escape it.

Issue #13444

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/SysInfo.php                   | 2 +-
 libraries/server_status_monitor.lib.php | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/libraries/SysInfo.php b/libraries/SysInfo.php
index 0339d28fff..dcfbe511aa 100644
--- a/libraries/SysInfo.php
+++ b/libraries/SysInfo.php
@@ -45,4 +45,4 @@ class SysInfo
     {
         return true;
     }
-}
\ No newline at end of file
+}
diff --git a/libraries/server_status_monitor.lib.php b/libraries/server_status_monitor.lib.php
index 0bcacda030..4aad3cf72e 100644
--- a/libraries/server_status_monitor.lib.php
+++ b/libraries/server_status_monitor.lib.php
@@ -9,6 +9,7 @@
  */
 use PMA\libraries\ServerStatusData;
 use PMA\libraries\Util;
+use PMA\libraries\Sanitize;
 
 /**
  * Prints html with monitor
@@ -42,7 +43,7 @@ function PMA_getHtmlForMonitor($ServerStatusData)
             if ($i++ > 0) {
                 $retval .= ", ";
             }
-            $retval .= "'" . $name . "'";
+            $retval .= Sanitize::formatJsVal($name);
         }
     }
     $retval .= '];';