gian/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #13957 from madhuracj/xss

Browse Source 
Escape search string and table names in database search results page
This commit is contained in:
Madhura Jayaratne 2018-02-07 23:21:43 +11:00 committed by GitHub
commit fab0a17886
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
templates/database/search/results.twig
View File

@ -3,7 +3,7 @@
{{ 'Search results for "<em>%s</em>" %s:'|format(
criteria_search_string,
search_type_description
)|raw }}
) }}
</caption>
{% for row in rows %}
<tr class="noclick">
@ -15,7 +15,7 @@
%1$s matches in <strong>%2$s</strong>
{% endtrans %}
{% endset %}
{{ result_message|format(row.result_count, row.table)|raw }}
{{ result_message|format(row.result_count, row.table) }}
</td>
{% if row.result_count > 0 %}
{% set url_params = {