Fix XSS with $cfg['SQP']['fmtType'] = 'text'.

2010-08-20 10:38:32 +02:00
parent 30c83acddb
commit 4a50055d52
1 changed files with 1 additions and 1 deletions
--- a/libraries/sqlparser.lib.php
+++ b/libraries/sqlparser.lib.php
@@ -2425,7 +2425,7 @@ if (! defined('PMA_MINIMUM_COMMON')) {
            }
            $after                 .= "\n";
 */
-            $str .= $before . ($mode=='color' ? PMA_SQP_formatHTML_colorize($arr[$i]) : $arr[$i]['data']). $after;
+            $str .= $before . ($mode=='color' ? PMA_SQP_formatHTML_colorize($arr[$i]) : htmlspecialchars($arr[$i]['data'])). $after;
        } // end for
        if ($mode=='color') {
            $str .= '</span>';