From 6c9c0b5dbfdd97dd4ee7664df6dcc729ac20676c Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Sun, 28 Sep 2014 09:48:13 -0400
Subject: [PATCH 1/2] [security] XSS with malicious ENUM values

Signed-off-by: Marc Delisle <marc@infomarc.info>

Conflicts:
	libraries/Util.class.php

Signed-off-by: Marc Delisle <marc@infomarc.info>
---
 libraries/TableSearch.class.php | 11 ++++++++---
 libraries/Util.class.php        |  9 ++++++---
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/libraries/TableSearch.class.php b/libraries/TableSearch.class.php
index d77cce1470..a0b3fa4924 100644
--- a/libraries/TableSearch.class.php
+++ b/libraries/TableSearch.class.php
@@ -316,6 +316,7 @@ EOT;
     private function _getEnumSetInputBox($column_index, $criteriaValues,
         $column_type, $column_id, $in_zoom_search_edit = false
     ) {
+        $column_type = htmlspecialchars($column_type);
         $html_output = '';
         $value = explode(
             ', ',
@@ -985,7 +986,9 @@ EOT;
             $html_output .= '<th>'
                 . htmlspecialchars($this->_columnNames[$column_index]) . '</th>';
             $properties = $this->getColumnProperties($column_index, $column_index);
-            $html_output .= '<td>' . $properties['type'] . '</td>';
+            $html_output .= '<td>'
+                . htmlspecialchars($properties['type'])
+                . '</td>';
             $html_output .= '<td>' . $properties['collation'] . '</td>';
             $html_output .= '<td>' . $properties['func'] . '</td>';
             // here, the data-type attribute is needed for a date/time picker
@@ -996,11 +999,13 @@ EOT;
             $html_output .= '<tr><td>';
             $html_output .= '<input type="hidden"'
                 . ' name="criteriaColumnNames[' . $column_index . ']"'
-                . ' value="' . htmlspecialchars($this->_columnNames[$column_index])
+                . ' value="'
+                . htmlspecialchars($this->_columnNames[$column_index])
                 . '" />';
             $html_output .= '<input type="hidden"'
                 . ' name="criteriaColumnTypes[' . $column_index . ']"'
-                . ' value="' . $this->_columnTypes[$column_index] . '" />';
+                . ' value="'
+                . htmlspecialchars($this->_columnTypes[$column_index]) . '" />';
             $html_output .= '<input type="hidden"'
                 . ' name="criteriaColumnCollations[' . $column_index . ']"'
                 . ' value="' . $this->_columnCollations[$column_index] . '" />';
diff --git a/libraries/Util.class.php b/libraries/Util.class.php
index a6fd9702ee..047232a3b9 100644
--- a/libraries/Util.class.php
+++ b/libraries/Util.class.php
@@ -3030,9 +3030,12 @@ class PMA_Util
         // for the case ENUM('&#8211;','&ldquo;')
         $displayed_type = htmlspecialchars($printtype);
         if (strlen($printtype) > $GLOBALS['cfg']['LimitChars']) {
-            $displayed_type  = '<abbr title="' . $printtype . '">';
-            $displayed_type .= $GLOBALS['PMA_String']->substr(
-                $printtype, 0, $GLOBALS['cfg']['LimitChars']
+            $displayed_type  = '<abbr title="'
+                . htmlspecialchars($printtype) . '">';
+            $displayed_type .= htmlspecialchars(
+                $GLOBALS['PMA_String']->substr(
+                    $printtype, 0, $GLOBALS['cfg']['LimitChars']
+                )
             );
             $displayed_type .= '</abbr>';
         }

From 9cb2f3e29ea7854006b932cab1c2e45767b23f88 Mon Sep 17 00:00:00 2001
From: Marc Delisle <marc@infomarc.info>
Date: Wed, 1 Oct 2014 08:09:12 -0400
Subject: [PATCH 2/2] Bug 4544: additional fix for 4.2.x

Signed-off-by: Marc Delisle <marc@infomarc.info>
---
 libraries/TableSearch.class.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libraries/TableSearch.class.php b/libraries/TableSearch.class.php
index a0b3fa4924..b7eb42f176 100644
--- a/libraries/TableSearch.class.php
+++ b/libraries/TableSearch.class.php
@@ -992,7 +992,8 @@ EOT;
             $html_output .= '<td>' . $properties['collation'] . '</td>';
             $html_output .= '<td>' . $properties['func'] . '</td>';
             // here, the data-type attribute is needed for a date/time picker
-            $html_output .= '<td data-type="' . $properties['type'] . '"'
+            $html_output .= '<td data-type="'
+                . htmlspecialchars($properties['type']) . '"'
                 . '>' . $properties['value'] . '</td>';
             $html_output .= '</tr>';
             //Displays hidden fields