From 60285cd6650e055b999c05e23cdca101b829036d Mon Sep 17 00:00:00 2001
From: Crack <piotrprz@gmail.com>
Date: Wed, 14 Jul 2010 17:07:19 +0200
Subject: [PATCH] add missing string escapes don't create <a> tag if
 LeftLogoLink is empty

---
 libraries/header_scripts.inc.php    |  2 +-
 libraries/navigation_header.inc.php | 34 ++++++++++++++++-------------
 2 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/libraries/header_scripts.inc.php b/libraries/header_scripts.inc.php
index cb366b5e7..e6b8f7385 100644
--- a/libraries/header_scripts.inc.php
+++ b/libraries/header_scripts.inc.php
@@ -82,7 +82,7 @@ foreach ($GLOBALS['js_include'] as $js_script_file) {
 // Updates the title of the frameset if possible (ns4 does not allow this)
 if (typeof(parent.document) != 'undefined' && typeof(parent.document) != 'unknown'
     && typeof(parent.document.title) == 'string') {
-    parent.document.title = '<?php echo PMA_sanitize(PMA_escapeJsString($title)); ?>';
+    parent.document.title = '<?php echo PMA_sanitize(PMA_escapeJsString(htmlspecialchars($title))); ?>';
 }
 
 <?php
diff --git a/libraries/navigation_header.inc.php b/libraries/navigation_header.inc.php
index 969d86ad8..05c831462 100644
--- a/libraries/navigation_header.inc.php
+++ b/libraries/navigation_header.inc.php
@@ -30,22 +30,26 @@ if ($GLOBALS['cfg']['LeftDisplayLogo']) {
             .'alt="' . $logo . '" id="imgpmalogo" />';
     }
 
-    echo '<div id="pmalogo">' . "\n"
-        .'<a href="' . $GLOBALS['cfg']['LeftLogoLink'];
-    switch ($GLOBALS['cfg']['LeftLogoLinkWindow']) {
-        case 'new':
-            echo '" target="_blank"';
-            break;
-        case 'main':
-            // do not add our parameters for an external link
-            if (substr(strtolower($GLOBALS['cfg']['LeftLogoLink']), 0, 4) !== 'http') {
-                echo '?' . $query_url . '" target="frame_content"';
-            } else {
-                echo '"';
-            }
+    echo '<div id="pmalogo">' . "\n";
+    if ($GLOBALS['cfg']['LeftLogoLink']) {
+        echo '<a href="' . htmlspecialchars($GLOBALS['cfg']['LeftLogoLink']);
+        switch ($GLOBALS['cfg']['LeftLogoLinkWindow']) {
+            case 'new':
+                echo '" target="_blank"';
+                break;
+            case 'main':
+                // do not add our parameters for an external link
+                if (substr(strtolower($GLOBALS['cfg']['LeftLogoLink']), 0, 4) !== '://') {
+                    echo '?' . $query_url . '" target="frame_content"';
+                } else {
+                    echo '" target="_blank"';
+                }
+        }
+        echo '>' . $logo . '</a>' . "\n";
+    } else {
+        echo $logo . "\n";
     }
-    echo '>' . $logo . '</a>' . "\n"
-        .'</div>' . "\n";
+    echo '</div>' . "\n";
 } // end of display logo
 ?>
 <div id="leftframelinks">