[Phpmyadmin-git] [SCM] phpMyAdmin branch, MAINT_3_3_8, updated. RELEASE_3_3_8-2-g38547be

[Marc Delisle]

The branch, MAINT_3_3_8 has been updated
       via  38547bea51e3ee1b84564dc111c64cc476d2e73c (commit)
       via  4341818d73d454451f024950a4ce0141608ac7f8 (commit)
      from  cdf76774d1773c5ceea8686a8c4ea1352ebc1ca5 (commit)


- Log -----------------------------------------------------------------
commit 38547bea51e3ee1b84564dc111c64cc476d2e73c
Author: Marc Delisle <marc at infomarc.info>
Date:   Fri Nov 26 09:03:22 2010 -0500

    ChangeLog for XSS fix

commit 4341818d73d454451f024950a4ce0141608ac7f8
Author: Herman van Rink <rink at initfour.nl>
Date:   Thu Nov 25 11:50:50 2010 +0100

    bug #3115519: fixed XSS on search

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                |    6 +++---
 libraries/common.lib.php |    2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 4827fb6..6a10607 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,9 @@ phpMyAdmin - ChangeLog
 $Id$
 $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyAdmin/ChangeLog $
 
+3.3.8.1 (2010-10-26)
+- bug #3115519 (private) [security] XSS on db search
+
 3.3.8.0 (2010-10-25)
 - bug #3059311 [import] BIGINT field type added to table analysis
 - [core] Update library PHPExcel to version 1.7.4
@@ -18,9 +21,6 @@ $HeadURL: https://phpmyadmin.svn.sourceforge.net/svnroot/phpmyadmin/trunk/phpMyA
 3.3.7.0 (2010-09-07)
 - patch #3050492 [PDF scratchboard] Cannot drag table box to the edge after
   a page size increase, thanks to Martin Schönberger - mad05
-- bug #3054458 [core] Fixed displaying number of rows.
-- bug #3035300 [parser] Fixed wrong definition of keywords.
-- [setup] Fixed escaping of server name.
 
 3.3.6.0 (2010-08-28)
 - bug #3033063 [core] Navi gets wrong db name
diff --git a/libraries/common.lib.php b/libraries/common.lib.php
index 610438c..b926e92 100644
--- a/libraries/common.lib.php
+++ b/libraries/common.lib.php
@@ -1634,7 +1634,7 @@ function PMA_linkOrButton($url, $message, $tag_params = array(),
         $tmp = $tag_params;
         $tag_params = array();
         if (!empty($tmp)) {
-            $tag_params['onclick'] = 'return confirmLink(this, \'' . $tmp . '\')';
+            $tag_params['onclick'] = 'return confirmLink(this, \'' . PMA_escapeJsString($tmp) . '\')';
         }
         unset($tmp);
     }


hooks/post-receive
-- 
phpMyAdmin