Merge branch 'QA_5_0' into QA_5_1

- Pagination fix is already there since 77c34f4e65
- Adds security fix for drag and drop
- Updates ChangeLog
    - I did omit the 5.0.5 not yet released cut as the changes where eaten by 5.1.0
- discarded all incoming changes (all already applied, normally)

ChangeLog

@@ -576,7 +576,13 @@ phpMyAdmin - ChangeLog
 - issue #15677 Fix show process-list triggers a php exception
 - issue #15697 Fix uncaught php error: "Call to a member function get() on null" in db_export.php when exporting a table from the list
 
-4.9.9 (not yet released)
+4.9.11 (2023-02-07)
+- issue        [security] Fix an XSS attack through the drag-and-drop upload feature
+
+4.9.10 (2022-02-10)
+- issue #17308 Fix broken pagination links in the navigation sidebar
+
+4.9.9 (2022-01-22)
 - issue #17305 Fix syntax error for PHP 5
 - issue #17307 Fix hide_connection_errors being undefined when a controluser is set
 

composer.json

@@ -78,6 +78,7 @@
         "tecnickcom/tcpdf": "For PDF support",
         "pragmarx/google2fa-qrcode": "For 2FA authentication",
         "code-lts/u2f-php-server": "For FIDO U2F authentication",
+        "bacon/bacon-qr-code": "For 2FA authentication",
         "paragonie/sodium_compat": "For modern encryption support"
     },
     "require-dev": {
@@ -94,7 +95,9 @@
         "symfony/finder": "^4.4",
         "symfony/twig-bridge": "^4.4",
         "tecnickcom/tcpdf": "^6.4.4",
-        "vimeo/psalm": "^4.22"
+        "vimeo/psalm": "^4.22",
+        "paragonie/random_compat": ">=2",
+        "paragonie/sodium_compat": "^1.17"
     },
     "extra": {
         "branch-alias": {

js/src/drag_drop_import.js

@@ -130,7 +130,7 @@ var DragDropImport = {
                                 var filename = $this.parent('span').attr('data-filename');
                                 $('body').append('<div class="pma_drop_result"><h2>' +
                                 Messages.dropImportImportResultHeader + ' - ' +
-                                filename + '<span class="close">x</span></h2>' + value.message + '</div>');
+                                Functions.escapeHtml(filename) + '<span class="close">x</span></h2>' + value.message + '</div>');
                                 $('.pma_drop_result').draggable();  // to make this dialog draggable
                             }
                         });