Escape attributes when showing images in javascript

Signed-off-by: Michal Čihař <michal@cihar.com>
phpmyadmin · Jun 20, 2016 · 7966161 · 7966161
1 parent 1e5716c
commit 7966161
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/js/get_image.js.php b/js/get_image.js.php
@@ -109,15 +109,15 @@ function PMA_getImage(image, alternate, attributes) {
     }
     // set alt
     if (attributes.alt != undefined) {
-        retval.attr('alt', attributes.alt);
+        retval.attr('alt', escapeHtml(attributes.alt));
     } else {
-        retval.attr('alt', alternate);
+        retval.attr('alt', escapeHtml(alternate));
     }
     // set title
     if (attributes.title != undefined) {
-        retval.attr('title', attributes.title);
+        retval.attr('title', escapeHtml(attributes.title));
     } else {
-        retval.attr('title', alternate);
+        retval.attr('title', escapeHtml(alternate));
     }
     // set src
     var klass = image.replace('.gif', '').replace('.png', '');