[security] XSS in a Designer component

2008-10-30 12:47:24 +00:00
parent 7a958e11a2
commit f1a0d3d2da
2 changed files with 5 additions and 1 deletions
--- a/3
+++ b/3
@@ -5,6 +5,9 @@ phpMyAdmin - ChangeLog
 $Id$
 $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/ChangeLog $

+2.11.9.3 (2008-10-30)
+- [security] XSS in a Designer component 
+
 2.11.9.2 (2008-09-22)
 - [security] XSS in MSIE using NUL byte, thanks to JPCERT.

--- a/pmd_pdf.php
+++ b/pmd_pdf.php
@@ -60,7 +60,8 @@ if (isset($scale)) {
 <body>
 <br>
 <div style="text-align:center; font-weight:bold;">
-  <form name="form1" method="post" action="pmd_pdf.php?server=<?php echo $server; ?>&db=<?php echo $db; ?>&token=<?php echo $token; ?>">
+  <form name="form1" method="post" action="pmd_pdf.php">
+<?php echo PMA_generate_common_hidden_inputs($db); ?>
    <p><?php echo $strExportImportToScale; ?>:
      <select name="scale">
        <option value="1">1:1</option>