Fix XSS in indexes (non-MySQL only)

vrana · Nov 8, 2015 · 4be0b66 · 4be0b66
1 parent 6c6bb45
commit 4be0b66
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/adminer/indexes.inc.php b/adminer/indexes.inc.php
@@ -117,7 +117,7 @@
 		$i = 1;
 		foreach ($index["columns"] as $key => $column) {
 			echo "<span>" . select_input(
-				" name='indexes[$j][columns][$i]' onchange=\"" . ($i == count($index["columns"]) ? "indexesAddColumn" : "indexesChangeColumn") . "(this, '" . js_escape($jush == "sql" ? "" : $_GET["indexes"] . "_") . "');\"",
+				" name='indexes[$j][columns][$i]' onchange=\"" . ($i == count($index["columns"]) ? "indexesAddColumn" : "indexesChangeColumn") . "(this, '" . h(js_escape($jush == "sql" ? "" : $_GET["indexes"] . "_")) . "');\"",
 				($fields ? array_combine($fields, $fields) : $fields),
 				$column
 			);

diff --git a/changes.txt b/changes.txt
@@ -1,4 +1,5 @@
 Adminer 4.2.3-dev:
+Fix XSS in indexes (non-MySQL only)
 Support PHP 7
 Greek translation
 Galician translation