bug #4492 [security] XSS in AJAX confirmation messages

Signed-off-by: Marc Delisle <marc@infomarc.info>
phpmyadmin · Jul 17, 2014 · a92753b · a92753b
1 parent 1b55924
commit a92753b
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 2 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog
 
 4.0.10.1 (2014-07-17)
 - bug #4488 [security] XSS injection due to unescaped table name (triggers)
+- bug #4492 [security] XSS in AJAX confirmation messages 
 
 4.0.10.0 (2013-12-04)
 - bug #4150 Clicking database name in query window opens a new tab

diff --git a/js/functions.js b/js/functions.js
@@ -3368,7 +3368,7 @@ AJAX.registerOnload('functions.js', function() {
         var question = PMA_messages.strDropTableStrongWarning + ' ';
         question += $.sprintf(
             PMA_messages.strDoYouReally,
-            'DROP TABLE ' + PMA_commonParams.get('table')
+            'DROP TABLE ' + escapeHtml(PMA_commonParams.get('table'))
         );
 
         $(this).PMA_confirm(question, $(this).attr('href'), function(url) {
@@ -3401,7 +3401,7 @@ AJAX.registerOnload('functions.js', function() {
         var question = PMA_messages.strTruncateTableStrongWarning + ' ';
         question += $.sprintf(
             PMA_messages.strDoYouReally,
-            'TRUNCATE ' + PMA_commonParams.get('table')
+            'TRUNCATE ' + escapeHtml(PMA_commonParams.get('table'))
         );
         $(this).PMA_confirm(question, $(this).attr('href'), function(url) {
             PMA_ajaxShowMessage(PMA_messages['strProcessingRequest']);

diff --git a/js/tbl_structure.js b/js/tbl_structure.js
@@ -144,6 +144,7 @@ AJAX.registerOnload('tbl_structure.js', function() {
          * @var curr_column_name    String containing name of the field referred to by {@link curr_row}
          */
         var curr_column_name = $curr_row.children('th').children('label').text();
+        curr_column_name = escapeHtml(curr_column_name);
         /**
          * @var $after_field_item    Corresponding entry in the 'After' field.
          */