Properly escape MIME transformatoin names

Fixes #13045

Signed-off-by: Michal Čihař <michal@cihar.com>

ChangeLog

@@ -91,6 +91,7 @@ phpMyAdmin - ChangeLog
 - issue #13040 Compatibility with hhvm 3.18
 - issue #13031 Fixed displaying of all rows
 - issue #12967 Fixed related field selection for native relations
+- issue #13045 Properly escape MIME transformatoin names
 
 4.6.6 (2017-01-23)
 - issue #12759 Fix Notice regarding 'Undefined index: old_usergroup'

templates/columns_definitions/transformation.phtml

@@ -17,7 +17,7 @@
                     $available_mime[$type . '_file'][$mimekey]
                 ) . ' (' . strtolower($parts[0]) . ":" . $parts[1] . ')';
             ?>
-            <option value="<?= $available_mime[$type . '_file'][$mimekey]; ?>"
+            <option value="<?= htmlspecialchars($available_mime[$type . '_file'][$mimekey]); ?>"
                     <?= $checked; ?>
                     title="<?= htmlspecialchars($tooltip); ?>">
                 <?= htmlspecialchars($name); ?>

transformation_overview.php

@@ -25,9 +25,9 @@ $types = PMA_getAvailableMIMEtypes();
 foreach ($types['mimetype'] as $key => $mimetype) {
 
     if (isset($types['empty_mimetype'][$mimetype])) {
-        echo '<i>' , $mimetype , '</i><br />';
+        echo '<i>' , htmlspecialchars($mimetype) , '</i><br />';
     } else {
-        echo $mimetype , '<br />';
+        echo htmlspecialchars($mimetype) , '<br />';
     }
 
 }
@@ -60,8 +60,8 @@ $th = array(
         $desc = PMA_getTransformationDescription($types[$ttype . '_file'][$key]);
         ?>
         <tr>
-            <td><?php echo $transform; ?></td>
-            <td><?php echo $desc; ?></td>
+            <td><?php echo htmlspecialchars($transform); ?></td>
+            <td><?php echo htmlspecialchars($desc); ?></td>
         </tr>
         <?php
     }