bug #4504 [security] Self-XSS in query charts

Signed-off-by: Marc Delisle <marc@infomarc.info>
phpmyadmin · Aug 17, 2014 · 90ddeec · 90ddeec
1 parent cd9f302
commit 90ddeec
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/ChangeLog b/ChangeLog
@@ -5,6 +5,7 @@ phpMyAdmin - ChangeLog
 - bug #4501 [security] XSS in table browse page
 - bug #4502 [security] Self-XSS in enum value editor
 - bug #4503 [security] Self-XSSes in monitor
+- bug #4504 [security] Self-XSS in query charts
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)

diff --git a/js/tbl_chart.js b/js/tbl_chart.js
@@ -47,7 +47,7 @@ function PMA_queryChart(data, columnNames, settings) {
         },
         axes : {
             xaxis : {
-                label : settings.xaxisLabel
+                label : escapeHtml(settings.xaxisLabel)
             },
             yaxis : {
                 label : settings.yaxisLabel