gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bug #4562 [security] XSS in debug SQL output

Browse Source 
Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
This commit is contained in:
Madhura Jayaratne 2014-10-21 08:42:02 +05:30
parent 319aac3c76
commit bd68c54d1b
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -1,6 +1,9 @@
phpMyAdmin - ChangeLog
======================
4.2.10.1 (not yet released)
- bug #4562 [security] XSS in debug SQL output
4.2.10.0 (2014-10-11)
- bug #4361 Can't change font size (when config.inc.php not present)
- bug #4542 Tab key in column name not shown

5
libraries/DatabaseInterface.class.php
View File

@ -139,10 +139,11 @@ class PMA_DatabaseInterface
$_SESSION['debug']['queries'][$hash] = array();
if ($result == false) {
$_SESSION['debug']['queries'][$hash]['error']
= '<b style="color:red">' . mysqli_error($link) . '</b>';
= '<b style="color:red">'
. htmlspecialchars(mysqli_error($link)) . '</b>';
}
$_SESSION['debug']['queries'][$hash]['count'] = 1;
$_SESSION['debug']['queries'][$hash]['query'] = $query;
$_SESSION['debug']['queries'][$hash]['query'] = htmlspecialchars($query);
$_SESSION['debug']['queries'][$hash]['time'] = $time;
}