bug #4503 [security] Self-XSSes in monitor

Signed-off-by: Marc Delisle <marc@infomarc.info>
phpmyadmin · Aug 17, 2014 · cd9f302 · cd9f302
1 parent 2c45d7c
commit cd9f302
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/ChangeLog b/ChangeLog
@@ -4,6 +4,7 @@ phpMyAdmin - ChangeLog
 4.2.7.1 (2014-08-17)
 - bug #4501 [security] XSS in table browse page
 - bug #4502 [security] Self-XSS in enum value editor
+- bug #4503 [security] Self-XSSes in monitor
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)

diff --git a/js/server_status_monitor.js b/js/server_status_monitor.js
@@ -908,7 +908,7 @@ AJAX.registerOnload('server_status_monitor.js', function () {
             label: $('#variableInput').val().replace(/_/g, " ")
         };
         newChart.series.push(newSeries);
-        $('#seriesPreview').append('- ' + newSeries.label + str + '<br/>');
+        $('#seriesPreview').append('- ' + escapeHtml(newSeries.label + str) + '<br/>');
         newChart.nodes.push(serie);
         $('#variableInput').val('');
         $('input[name="differentialValue"]').prop('checked', true);