bug #4501 [security] XSS in table browse page

Signed-off-by: Marc Delisle <marc@infomarc.info>
phpmyadmin · Aug 17, 2014 · 647c9d1 · 647c9d1
1 parent 0cd293f
commit 647c9d1
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/ChangeLog b/ChangeLog
@@ -2,6 +2,7 @@ phpMyAdmin - ChangeLog
 ======================
 
 4.2.7.1 (2014-08-17)
+- bug #4501 [security] XSS in table browse page
 - bug #4505 [security] XSS in view operations page
 
 4.2.7.0 (2014-07-31)

diff --git a/js/sql.js b/js/sql.js
@@ -119,7 +119,7 @@ AJAX.registerOnload('sql.js', function () {
     // Delete row from SQL results
     $('a.delete_row.ajax').live('click', function (e) {
         e.preventDefault();
-        var question = $.sprintf(PMA_messages.strDoYouReally, $(this).closest('td').find('div').text());
+        var question = $.sprintf(PMA_messages.strDoYouReally, escapeHtml($(this).closest('td').find('div').text()));
         var $link = $(this);
         $link.PMA_confirm(question, $link.attr('href'), function (url) {
             $msgbox = PMA_ajaxShowMessage();