Fix XSS in browsers which don't encode URL parameters (bug #775)

vrana · Feb 6, 2021 · 5c395af · 5c395af
1 parent cde9888
commit 5c395af
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/adminer/sql.inc.php b/adminer/sql.inc.php
@@ -222,7 +222,7 @@
 	}
 	echo "<p>";
 	textarea("query", $q, 20);
-	echo script(($_POST ? "" : "qs('textarea').focus();\n") . "qs('#form').onsubmit = partial(sqlSubmit, qs('#form'), '" . remove_from_uri("sql|limit|error_stops|only_errors") . "');");
+	echo script(($_POST ? "" : "qs('textarea').focus();\n") . "qs('#form').onsubmit = partial(sqlSubmit, qs('#form'), '" . js_escape(remove_from_uri("sql|limit|error_stops|only_errors|history")) . "');");
 	echo "<p>$execute\n";
 	echo lang('Limit rows') . ": <input type='number' name='limit' class='size' value='" . h($_POST ? $_POST["limit"] : $_GET["limit"]) . "'>\n";
 

diff --git a/changes.txt b/changes.txt
@@ -1,4 +1,5 @@
 Adminer 4.7.9-dev:
+Fix XSS in browsers which don't encode URL parameters (bug #775, regression from 4.7.0)
 Elasticsearch, ClickHouse: Do not print response if HTTP code is not 200
 Don't syntax highlight during IME composition (bug #747)
 MySQL: Do not export names in quotes with sql_mode='ANSI_QUOTES' (bug #749)