bug #4596 [security] XSS through exception stack

Signed-off-by: Madhura Jayaratne <madhura.cj@gmail.com>
phpmyadmin · Nov 20, 2014 · 9364e2e · 9364e2e
1 parent 8252099
commit 9364e2e
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/ChangeLog b/ChangeLog
@@ -13,6 +13,7 @@ phpMyAdmin - ChangeLog
 - bug #4599 Input field unnecessarily selected on focus
 - bug #4602 Exporting selected rows exports all rows of the query
 - bug #4444 No insert statement produced in SQL export for queries with alias
+- bug #4596 [security] XSS through exception stack
 
 4.2.11.0 (2014-10-31)
 - bug       ReferenceError: Table_onover is not defined

diff --git a/libraries/error_report.lib.php b/libraries/error_report.lib.php
@@ -279,7 +279,7 @@ function PMA_getErrorReportForm()
             . __('You may examine the data in the error report:')
             . '</p></label></div>'
             . '<pre class="report-data">'
-            . PMA_getReportData()
+            . htmlspecialchars(PMA_getReportData())
             . '</pre>';
 
     $html .= '<div class="label"><label><p>'