From f0f8f2b65e46f11ed23efe3262810132ffa2b1bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Sat, 23 Jul 2016 09:38:44 +0200
Subject: [PATCH] Escape routine privileges listing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 libraries/server_privileges.lib.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libraries/server_privileges.lib.php b/libraries/server_privileges.lib.php
index 6fa1a2f907..7b6109996f 100644
--- a/libraries/server_privileges.lib.php
+++ b/libraries/server_privileges.lib.php
@@ -2399,13 +2399,13 @@ function PMA_getHtmlTableBodyForSpecificDbRoutinePrivs($db, $odd_row, $index_che
             . 'id="checkbox_sel_users_' . ($index_checkbox++) . '" '
             . 'value="' . $value . '" /></td>';
 
-        $html_output .= '<td>' . $row['User']
+        $html_output .= '<td>' . htmlspecialchars($row['User'])
             . '</td>'
-            . '<td>' . $row['Host']
+            . '<td>' . htmlspecialchars($row['Host'])
             . '</td>'
             . '<td>' . 'routine'
             . '</td>'
-            . '<td>' . '<code>' . $row['Routine_name'] . '</code>'
+            . '<td>' . '<code>' . htmlspecialchars($row['Routine_name']) . '</code>'
             . '</td>'
             . '<td>' . 'Yes'
             . '</td>';