From bbccc368173294f8d713a0f4dbfca28560811b33 Mon Sep 17 00:00:00 2001
From: Herman van Rink <rink@initfour.nl>
Date: Fri, 10 Jun 2011 21:38:43 +0200
Subject: [PATCH 1/3] Minor xss reported by Aung Khant

---
 enum_editor.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/enum_editor.php b/enum_editor.php
index 088275f88..cec36dcfd 100644
--- a/enum_editor.php
+++ b/enum_editor.php
@@ -58,7 +58,7 @@ require_once './libraries/header_meta_style.inc.php';
                </a>
             </p>
              <input type="hidden" name="token" value="<?php echo $_GET['token']; ?>" />
-             <input type="hidden" name="field" value="<?php echo $_GET['field']; ?>" />
+             <input type="hidden" name="field" value="<?php echo htmlspecialchars($_GET['field']); ?>" />
              <input type="hidden" name="num_fields" value="<?php echo $total_fields; ?>" />
              <input type="submit" value="<?php echo __('Go'); ?>" />
         </form>

From e49ab1bfe13119633c6bf94eb7439ecb0d28841d Mon Sep 17 00:00:00 2001
From: Herman van Rink <rink@initfour.nl>
Date: Fri, 10 Jun 2011 21:43:16 +0200
Subject: [PATCH 2/3] Minor xss reported by Aung Khant

---
 server_replication.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server_replication.php b/server_replication.php
index 9b7724d28..a52459106 100644
--- a/server_replication.php
+++ b/server_replication.php
@@ -53,7 +53,7 @@ if (isset($GLOBALS['sr_take_action'])) {
 
         if (! $link_to_master) {
             $_SESSION['replication']['sr_action_status'] = 'error';
-            $_SESSION['replication']['sr_action_info'] = sprintf(__('Unable to connect to master %s.'), $sr['hostname']);
+            $_SESSION['replication']['sr_action_info'] = sprintf(__('Unable to connect to master %s.'), htmlspecialchars($sr['hostname']));
         } else {
             // Read the current master position
             $position = PMA_replication_slave_bin_log_master($link_to_master);
@@ -70,6 +70,7 @@ if (isset($GLOBALS['sr_take_action'])) {
                 } else {
                     $_SESSION['replication']['sr_action_status'] = 'success';
                     $_SESSION['replication']['sr_action_info'] = sprintf(__('Master server changed succesfully to %s'), $sr['hostname']);
+                    $_SESSION['replication']['sr_action_info'] = sprintf(__('Master server changed succesfully to %s'), htmlspecialchars($sr['hostname']));
                 }
             }
         }

From 7602e1593c1565b4dbd90df13fd162cee6546798 Mon Sep 17 00:00:00 2001
From: Herman van Rink <rink@initfour.nl>
Date: Sun, 12 Jun 2011 21:41:54 +0200
Subject: [PATCH 3/3] Minor xss reported by Aung Khant

---
 enum_editor.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/enum_editor.php b/enum_editor.php
index cec36dcfd..586e85e7f 100644
--- a/enum_editor.php
+++ b/enum_editor.php
@@ -57,7 +57,7 @@ require_once './libraries/header_meta_style.inc.php';
 <?php echo __('+ Restart insertion and add a new value'); ?>
                </a>
             </p>
-             <input type="hidden" name="token" value="<?php echo $_GET['token']; ?>" />
+             <input type="hidden" name="token" value="<?php echo htmlspecialchars($_GET['token']); ?>" />
              <input type="hidden" name="field" value="<?php echo htmlspecialchars($_GET['field']); ?>" />
              <input type="hidden" name="num_fields" value="<?php echo $total_fields; ?>" />
              <input type="submit" value="<?php echo __('Go'); ?>" />
@@ -66,7 +66,7 @@ require_once './libraries/header_meta_style.inc.php';
         <div id="enum_editor_output">
         <h3><?php echo __('Output'); ?></h3>
         <p><?php echo __('Copy and paste the joined values into the "Length/Values" field'); ?></p>
-            <textarea id="joined_values" cols="95" rows="5"><?php echo join(",", $values); ?></textarea>
+            <textarea id="joined_values" cols="95" rows="5"><?php echo htmlspecialchars(join(",", $values)); ?></textarea>
         </div>
     </div>
 </body>