nettika/phpmyadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'MAINT_3_4_5' into QA_3_4

Browse Source
This commit is contained in:
Marc Delisle
2011-09-08 15:41:40 -04:00
parent c02bd600ee bda213c58a
commit c5a6419618
4 changed files with 18 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@@ -14,6 +14,8 @@ phpMyAdmin - ChangeLog
- [export] Remove native Excel export modules (xls and xlsx formats) - [export] Remove native Excel export modules (xls and xlsx formats)
- [import] Remove native Excel import modules (xls and xlsx formats) - [import] Remove native Excel import modules (xls and xlsx formats)
- bug #3392920 [edit] BLOB emptied after editing another column - bug #3392920 [edit] BLOB emptied after editing another column
- [security] Fixed XSS in Inline Edit on save action, see PMASA-2011-14
- [security] Fixed XSS with db/table/column names, see PMASA-2011-14
3.4.4.0 (2011-08-24) 3.4.4.0 (2011-08-24)
- bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes - bug #3323060 [parser] SQL parser breaks AJAX requests if query has unclosed quotes

15
js/functions.js
View File

@@ -172,7 +172,7 @@ function selectContent( element, lock, only_once ) {
} }
/** /**
* Displays a confirmation box before to submit a "DROP/DELETE/ALTER" query. * Displays a confirmation box before submitting a "DROP/DELETE/ALTER" query.
* This function is called while clicking links * This function is called while clicking links
* *
* @param object the link * @param object the link
@@ -1657,7 +1657,7 @@ $(document).ready(function() {
/** /**
* @var question String containing the question to be asked for confirmation * @var question String containing the question to be asked for confirmation
*/ */
var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + window.parent.db; var question = PMA_messages['strDropDatabaseStrongWarning'] + '\n' + PMA_messages['strDoYouReally'] + ' :\n' + 'DROP DATABASE ' + escapeHtml(window.parent.db);
$(this).PMA_confirm(question, $(this).attr('href') ,function(url) { $(this).PMA_confirm(question, $(this).attr('href') ,function(url) {
@@ -2287,3 +2287,14 @@ $(document).ready(function() {
}) // end of $(document).ready() }) // end of $(document).ready()
/**
* HTML escaping
*/
function escapeHtml(unsafe) {
return unsafe
.replace(/&/g, "&")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#039;");
}

2
js/sql.js
View File

@@ -1111,7 +1111,7 @@ function PMA_unInlineEditRow($del_hide, $chg_submit, $this_td, $input_siblings,
} }
} }
} }
$this_sibling.html(new_html); $this_sibling.text(new_html);
} }
}) })
} }

4
js/tbl_structure.js
View File

@@ -44,7 +44,7 @@ $(document).ready(function() {
/** /**
* @var question String containing the question to be asked for confirmation * @var question String containing the question to be asked for confirmation
*/ */
var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` DROP `' + curr_column_name + '`'; var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` DROP `' + escapeHtml(curr_column_name) + '`';
$(this).PMA_confirm(question, $(this).attr('href'), function(url) { $(this).PMA_confirm(question, $(this).attr('href'), function(url) {
@@ -83,7 +83,7 @@ $(document).ready(function() {
/** /**
* @var question String containing the question to be asked for confirmation * @var question String containing the question to be asked for confirmation
*/ */
var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + curr_table_name + '` ADD PRIMARY KEY(`' + curr_column_name + '`)'; var question = PMA_messages['strDoYouReally'] + ' :\n ALTER TABLE `' + escapeHtml(curr_table_name) + '` ADD PRIMARY KEY(`' + escapeHtml(curr_column_name) + '`)';
$(this).PMA_confirm(question, $(this).attr('href'), function(url) { $(this).PMA_confirm(question, $(this).attr('href'), function(url) {