Skip to content
Permalink
Browse files Browse the repository at this point in the history
Escape HTML in js-generated confirmation messages
  • Loading branch information
lem9 committed Sep 8, 2011
1 parent 2f28ce9 commit bda213c
Show file tree
Hide file tree
Showing 3 changed files with 17 additions and 5 deletions.
3 changes: 2 additions & 1 deletion ChangeLog
Expand Up @@ -11,6 +11,8 @@ phpMyAdmin - ChangeLog
- [export] Remove native Excel export modules (xls and xlsx formats)
- [import] Remove native Excel import modules (xls and xlsx formats)
- bug #3392920 [edit] BLOB emptied after editing another column
- [security] Fixed XSS in Inline Edit on save action, see PMASA-2011-14
- [security] Fixed XSS with db/table/column names, see PMASA-2011-14

3.4.4.0 (2011-08-24)
- bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes
Expand All @@ -31,7 +33,6 @@ phpMyAdmin - ChangeLog
- bug #3374347 [display] Backquotes in normal text on import page
- bug #3358750 [core] With Suhosin, urls are too long in edit links
- [security] Missing sanitization on the table, column and index names leads to XSS vulnerabilities, see PMASA-2011-13
- [security] Fixed XSS in Inline Edit on save action

3.4.3.2 (2011-07-23)
- [security] Fixed XSS vulnerability, see PMASA-2011-9
Expand Down
15 changes: 13 additions & 2 deletions js/functions.js
Expand Up @@ -172,7 +172,7 @@ function selectContent( element, lock, only_once ) {
}

/**
* Displays a confirmation box before to submit a "DROP/DELETE/ALTER" query.
* Displays a confirmation box before submitting a "DROP/DELETE/ALTER" query.
* This function is called while clicking links
*
* @param object the link
Expand Down Expand Up @@ -1657,7 +1657,7 @@ $(document).ready(function() {
/**
* @var question String containing the question to be asked for confirmation
*/
var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + window.parent.db;
var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + escapeHtml(window.parent.db);

$(this).PMA_confirm(question, $(this).attr('href') ,function(url) {

Expand Down Expand Up @@ -2287,3 +2287,14 @@ $(document).ready(function() {

}) // end of $(document).ready()

/**
* HTML escaping
*/
function escapeHtml(unsafe) {
return unsafe
.replace(/&/g, "&")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#039;");
}
4 changes: 2 additions & 2 deletions js/tbl_structure.js
Expand Up @@ -44,7 +44,7 @@ $(document).ready(function() {
/**
* @var question String containing the question to be asked for confirmation
*/
var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` DROP `' + curr_column_name + '`';
var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` DROP `' + escapeHtml(curr_column_name) + '`';

$(this).PMA_confirm(question, $(this).attr('href'), function(url) {

Expand Down Expand Up @@ -83,7 +83,7 @@ $(document).ready(function() {
/**
* @var question String containing the question to be asked for confirmation
*/
var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` ADD PRIMARY KEY(`' + curr_column_name + '`)';
var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` ADD PRIMARY KEY(`' + escapeHtml(curr_column_name) + '`)';

$(this).PMA_confirm(question, $(this).attr('href'), function(url) {

Expand Down

0 comments on commit bda213c

Please sign in to comment.