bug #4492 [security] XSS in AJAX confirmation messages

Signed-off-by: Marc Delisle <marc@infomarc.info>
phpmyadmin · Jul 17, 2014 · cd56970 · cd56970
1 parent 511c596
commit cd56970
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 2 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -3,6 +3,7 @@ phpMyAdmin - ChangeLog
 
 4.1.14.2 (2014-07-17)
 - bug #4488 [security] XSS injection due to unescaped table name (triggers)
+- bug #4492 [security] XSS in AJAX confirmation messages
 
 4.1.14.1 (2014-06-21)
 - bug #4464 [security] XSS injection due to unescaped db/table name in navigation hiding

diff --git a/js/functions.js b/js/functions.js
@@ -3519,7 +3519,7 @@ AJAX.registerOnload('functions.js', function () {
         var question = PMA_messages.strDropTableStrongWarning + ' ';
         question += $.sprintf(
             PMA_messages.strDoYouReally,
-            'DROP TABLE ' + PMA_commonParams.get('table')
+            'DROP TABLE ' + escapeHtml(PMA_commonParams.get('table'))
         );
 
         $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
@@ -3585,7 +3585,7 @@ AJAX.registerOnload('functions.js', function () {
         var question = PMA_messages.strTruncateTableStrongWarning + ' ';
         question += $.sprintf(
             PMA_messages.strDoYouReally,
-            'TRUNCATE ' + PMA_commonParams.get('table')
+            'TRUNCATE ' + escapeHtml(PMA_commonParams.get('table'))
         );
         $(this).PMA_confirm(question, $(this).attr('href'), function (url) {
             PMA_ajaxShowMessage(PMA_messages.strProcessingRequest);

diff --git a/js/tbl_structure.js b/js/tbl_structure.js
@@ -197,6 +197,7 @@ AJAX.registerOnload('tbl_structure.js', function () {
          * @var curr_column_name    String containing name of the field referred to by {@link curr_row}
          */
         var curr_column_name = $curr_row.children('th').children('label').text();
+        curr_column_name = escapeHtml(curr_column_name);
         /**
          * @var $after_field_item    Corresponding entry in the 'After' field.
          */