nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix XSS on tablename and pred_tablename.

Browse Source
This commit is contained in:
Michal Čihař
2010-08-18 12:09:13 +02:00
parent 6028221d97
commit 7dc6cea065
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
server_privileges.php
View File

@@ -1923,7 +1923,7 @@ if (empty($_REQUEST['adduser']) && (! isset($checkprivs) || ! strlen($checkprivs
if (isset($tablename)) { if (isset($tablename)) {
echo ' [ ' . $GLOBALS['strTable'] . ' <a href="' echo ' [ ' . $GLOBALS['strTable'] . ' <a href="'
. $GLOBALS['cfg']['DefaultTabTable'] . '?' . $GLOBALS['url_query'] . $GLOBALS['cfg']['DefaultTabTable'] . '?' . $GLOBALS['url_query']
. '&amp;db=' . $url_dbname . '&amp;table=' . urlencode($tablename) . '&amp;db=' . $url_dbname . '&amp;table=' . htmlspecialchars(urlencode($tablename))
. '&amp;reload=1">' . htmlspecialchars($tablename) . ': ' . '&amp;reload=1">' . htmlspecialchars($tablename) . ': '
. PMA_getTitleForTarget($GLOBALS['cfg']['DefaultTabTable']) . PMA_getTitleForTarget($GLOBALS['cfg']['DefaultTabTable'])
. "</a> ]\n"; . "</a> ]\n";