diff --git a/ChangeLog b/ChangeLog index f36cc671f..1f101fe84 100644 --- a/ChangeLog +++ b/ChangeLog @@ -23,6 +23,7 @@ phpMyAdmin - ChangeLog - patch #3314626 [display] CharTextareaRows is not respected - bug #3417089 [synchronize] Extraneous db choices - [security] Fixed local path disclosure vulnerability, see PMASA-2011-15 +- [security] Fixed XSS in setup (verbose parameter) 3.4.5.0 (2011-09-14) - bug #3375325 [interface] Page list in navigation frame looks odd diff --git a/libraries/config/ConfigFile.class.php b/libraries/config/ConfigFile.class.php index 20369f1ef..9e1690c07 100644 --- a/libraries/config/ConfigFile.class.php +++ b/libraries/config/ConfigFile.class.php @@ -422,7 +422,7 @@ class ConfigFile } $verbose = $this->get("Servers/$id/verbose"); if (!empty($verbose)) { - return $verbose; + return htmlspecialchars($verbose); } $host = $this->get("Servers/$id/host"); return empty($host) ? 'localhost' : $host; @@ -508,4 +508,4 @@ class ConfigFile return $c; } } -?> \ No newline at end of file +?>