Merge remote-tracking branch 'origin/QA_4_2' into QA_4_2

ChangeLog

@@ -4,6 +4,14 @@ phpMyAdmin - ChangeLog
 4.2.8.0 (not yet released)
 - bug #4516 Odd export behavior
 
+4.2.7.1 (2014-08-17)
+- bug #4501 [security] XSS in table browse page
+- bug #4502 [security] Self-XSS in enum value editor
+- bug #4503 [security] Self-XSSes in monitor
+- bug #4504 [security] Self-XSS in query charts
+- bug #4505 [security] XSS in view operations page
+- bug #4517 [security] XSS in relation view
+
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page
 - bug #4494 Overlap in navigation panel

js/functions.js

@@ -2692,7 +2692,7 @@ AJAX.registerOnload('functions.js', function () {
         } else {
             title = PMA_messages.enum_columnVals.replace(
                 /%s/,
-                '"' + decodeURIComponent(colname) + '"'
+                '"' + escapeHtml(decodeURIComponent(colname)) + '"'
             );
         }
         // Get the values as a string
@@ -3585,7 +3585,7 @@ AJAX.registerOnload('functions.js', function () {
         var question = PMA_messages.strDropTableStrongWarning + ' ';
         question += $.sprintf(
             PMA_messages.strDoYouReally,
-            'DROP VIEW ' + PMA_commonParams.get('table')
+            'DROP VIEW ' + escapeHtml(PMA_commonParams.get('table'))
         );
 
         $(this).PMA_confirm(question, $(this).attr('href'), function (url) {

js/server_status_monitor.js

@@ -908,7 +908,7 @@ AJAX.registerOnload('server_status_monitor.js', function () {
             label: $('#variableInput').val().replace(/_/g, " ")
         };
         newChart.series.push(newSeries);
-        $('#seriesPreview').append('- ' + newSeries.label + str + '<br/>');
+        $('#seriesPreview').append('- ' + escapeHtml(newSeries.label + str) + '<br/>');
         newChart.nodes.push(serie);
         $('#variableInput').val('');
         $('input[name="differentialValue"]').prop('checked', true);

js/sql.js

@@ -119,7 +119,7 @@ AJAX.registerOnload('sql.js', function () {
     // Delete row from SQL results
     $('a.delete_row.ajax').live('click', function (e) {
         e.preventDefault();
-        var question = $.sprintf(PMA_messages.strDoYouReally, $(this).closest('td').find('div').text());
+        var question = $.sprintf(PMA_messages.strDoYouReally, escapeHtml($(this).closest('td').find('div').text()));
         var $link = $(this);
         $link.PMA_confirm(question, $link.attr('href'), function (url) {
             $msgbox = PMA_ajaxShowMessage();

js/tbl_chart.js

@@ -47,7 +47,7 @@ function PMA_queryChart(data, columnNames, settings) {
         },
         axes : {
             xaxis : {
-                label : settings.xaxisLabel
+                label : escapeHtml(settings.xaxisLabel)
             },
             yaxis : {
                 label : settings.yaxisLabel

libraries/tbl_relation.lib.php

@@ -554,7 +554,7 @@ function PMA_getHtmlForForeignKey($save_row, $i, $existrel_foreign, $myfield, $d
         $html_output .= __('Constraint name');
         $html_output .= '<input type="text" name="constraint_name['
             . $myfield_md5 . ']"'
-            . ' value="' . $constraint_name . '"/>';
+            . ' value="' . htmlspecialchars($constraint_name) . '"/>';
         $html_output .= '</span>' . "\n";
 
         $html_output .= '<span class="formelement clearfloat">';