bug #4502 [security] Self-XSS in enum value editor

Signed-off-by: Marc Delisle <marc@infomarc.info>
phpmyadmin · Aug 17, 2014 · 2c45d7c · 2c45d7c
1 parent 647c9d1
commit 2c45d7c
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/ChangeLog b/ChangeLog
@@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog
 
 4.2.7.1 (2014-08-17)
 - bug #4501 [security] XSS in table browse page
+- bug #4502 [security] Self-XSS in enum value editor
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)

diff --git a/js/functions.js b/js/functions.js
@@ -2692,7 +2692,7 @@ AJAX.registerOnload('functions.js', function () {
         } else {
             title = PMA_messages.enum_columnVals.replace(
                 /%s/,
-                '"' + decodeURIComponent(colname) + '"'
+                '"' + escapeHtml(decodeURIComponent(colname)) + '"'
             );
         }
         // Get the values as a string