From c6c7a12586afa3e312a4ef0e8623ebd7c675e8f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Tue, 13 Jun 2017 10:37:14 +0200
Subject: [PATCH] Escape token in HTML
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 js/functions.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/js/functions.js b/js/functions.js
index e766bd8894..429d3e1143 100644
--- a/js/functions.js
+++ b/js/functions.js
@@ -4670,7 +4670,7 @@ AJAX.registerOnload('functions.js', function () {
     $('.logout').click(function() {
         var form = $(
             '<form method="POST" action="' + $(this).attr('href') + '" class="disableAjax">' +
-            '<input type="hidden" name="token" value="' + PMA_commonParams.get('token') + '"/>' +
+            '<input type="hidden" name="token" value="' + escapeHtml(PMA_commonParams.get('token')) + '"/>' +
             '</form>'
         );
         $('body').append(form);