bug #4488 [security] XSS injection due to unescaped table name (trigg…

…ers) Signed-off-by: Marc Delisle <marc@infomarc.info>
phpmyadmin · Jul 17, 2014 · 1b55924 · 1b55924
1 parent 82161a6
commit 1b55924
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -1,6 +1,9 @@
 phpMyAdmin - ChangeLog
 ======================
 
+4.0.10.1 (2014-07-17)
+- bug #4488 [security] XSS injection due to unescaped table name (triggers)
+
 4.0.10.0 (2013-12-04)
 - bug #4150 Clicking database name in query window opens a new tab
 - bug #4141 Wrong page is shown after editing; also, do not show a modal

diff --git a/libraries/rte/rte_list.lib.php b/libraries/rte/rte_list.lib.php
@@ -248,9 +248,9 @@ function PMA_TRI_getRowForList($trigger, $rowclass = '')
     $retval .= "            </td>\n";
     if (empty($table)) {
         $retval .= "            <td>\n";
-        $retval .= "                <a href='db_triggers.php?{$url_query}"
-                                     . "&amp;table={$trigger['table']}'>"
-                                     . $trigger['table'] . "</a>\n";
+        $retval .= "<a href='db_triggers.php?{$url_query}"
+            . "&amp;table=" . urlencode($trigger['table']) . "'>"
+            . urlencode($trigger['table']) . "</a>";
         $retval .= "            </td>\n";
     }
     $retval .= "            <td>\n";