bug #4517 [security] XSS in relation view

Signed-off-by: Marc Delisle <marc@infomarc.info>
phpmyadmin · Aug 17, 2014 · 3ffc967 · 3ffc967
1 parent 90ddeec
commit 3ffc967
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/ChangeLog b/ChangeLog
@@ -7,6 +7,7 @@ phpMyAdmin - ChangeLog
 - bug #4503 [security] Self-XSSes in monitor
 - bug #4504 [security] Self-XSS in query charts
 - bug #4505 [security] XSS in view operations page
+- bug #4517 [security] XSS in relation view
 
 4.2.7.0 (2014-07-31)
 - bug       Broken links on home page

diff --git a/libraries/tbl_relation.lib.php b/libraries/tbl_relation.lib.php
@@ -554,7 +554,7 @@ function PMA_getHtmlForForeignKey($save_row, $i, $existrel_foreign, $myfield, $d
         $html_output .= __('Constraint name');
         $html_output .= '<input type="text" name="constraint_name['
             . $myfield_md5 . ']"'
-            . ' value="' . $constraint_name . '"/>';
+            . ' value="' . htmlspecialchars($constraint_name) . '"/>';
         $html_output .= '</span>' . "\n";
 
         $html_output .= '<span class="formelement clearfloat">';