From 73913f135e51cbc3eba559ffd8af70a2938f0ac3 Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Tue, 4 Oct 2011 05:49:20 -0400
Subject: [PATCH 1/2] Use standard SQL terminology in format string

---
 Documentation.html       |  4 ++--
 libraries/common.lib.php | 23 ++++++++++++++---------
 2 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/Documentation.html b/Documentation.html
index af27b89d50..1c47508839 100644
--- a/Documentation.html
+++ b/Documentation.html
@@ -4341,8 +4341,8 @@ INSERT INTO REL_towns VALUES ('M', 'Montr&eacute;al');
         <dd>Currently opened database</dd>
     <dt><code>@TABLE@</code></dt>
         <dd>Currently opened table</dd>
-    <dt><code>@FIELDS@</code></dt>
-        <dd>Fields of currently opened table</dd>
+    <dt><code>@COLUMNS@</code></dt>
+        <dd>Columns of the currently opened table</dd>
     <dt><code>@PHPMYADMIN@</code></dt>
         <dd>phpMyAdmin with version</dd>
 </dl>
diff --git a/libraries/common.lib.php b/libraries/common.lib.php
index 2cc2278d42..5dcf21ed22 100644
--- a/libraries/common.lib.php
+++ b/libraries/common.lib.php
@@ -3097,7 +3097,7 @@ function PMA_getTitleForTarget($target)
 }
 
 /**
- * Formats user string, expading @VARIABLES@, accepting strftime format string.
+ * Formats user string, expanding @VARIABLES@, accepting strftime format string.
  *
  * @param string   $string  Text where to do expansion.
  * @param function $escape  Function to call for escaping variable values.
@@ -3149,20 +3149,25 @@ function PMA_expandUserString($string, $escape = null, $updates = array())
         }
     }
 
-    /* Fetch fields list if required */
+    /* Backward compatibility in 3.5.x */
     if (strpos($string, '@FIELDS@') !== false) {
-        $fields_list = PMA_DBI_get_columns($GLOBALS['db'], $GLOBALS['table']);
+        $string = strtr($string, array('@FIELDS@' => '@COLUMNS@')); 
+    }
 
-        $field_names = array();
-        foreach ($fields_list as $field) {
-            if (!is_null($escape)) {
-                $field_names[] = $escape($field['Field']);
+    /* Fetch columns list if required */
+    if (strpos($string, '@COLUMNS@') !== false) {
+        $columns_list = PMA_DBI_get_columns($GLOBALS['db'], $GLOBALS['table']);
+
+        $column_names = array();
+        foreach ($columns_list as $column) {
+            if (! is_null($escape)) {
+                $column_names[] = $escape($column['Field']);
             } else {
-                $field_names[] = $field['Field'];
+                $column_names[] = $field['Field'];
             }
         }
 
-        $replace['@FIELDS@'] = implode(',', $field_names);
+        $replace['@COLUMNS@'] = implode(',', $column_names);
     }
 
     /* Do the replacement */

From 1af420e22367ae72ff4091adb1620e59ddad5ba6 Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Tue, 4 Oct 2011 06:20:17 -0400
Subject: [PATCH 2/2] [security] Fixed XSS in setup (verbose parameter)

---
 ChangeLog                             | 1 +
 libraries/config/ConfigFile.class.php | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index b8c33cb8ce..020aef316e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -21,6 +21,7 @@ phpMyAdmin - ChangeLog
 - patch #3314626 [display] CharTextareaRows is not respected
 - bug #3417089 [synchronize] Extraneous db choices
 - [security] Fixed local path disclosure vulnerability, see PMASA-2011-15
+- [security] Fixed XSS in setup (verbose parameter)
 
 3.4.5.0 (2011-09-14)
 - bug #3375325 [interface] Page list in navigation frame looks odd
diff --git a/libraries/config/ConfigFile.class.php b/libraries/config/ConfigFile.class.php
index 20369f1efc..9e1690c07a 100644
--- a/libraries/config/ConfigFile.class.php
+++ b/libraries/config/ConfigFile.class.php
@@ -422,7 +422,7 @@ class ConfigFile
         }
         $verbose = $this->get("Servers/$id/verbose");
         if (!empty($verbose)) {
-            return $verbose;
+            return htmlspecialchars($verbose);
         }
         $host = $this->get("Servers/$id/host");
         return empty($host) ? 'localhost' : $host;
@@ -508,4 +508,4 @@ class ConfigFile
         return $c;
     }
 }
-?>
\ No newline at end of file
+?>