Fix two security fix about XSS, reported by Mateusz Goik, fixed by ioguix.

diff --git a/HISTORY b/HISTORY
index 28a1b211d5a30a82d96ed72c0c7884618909d4bd..bf9f0f847cb3dfaac944fe584db43fc701b9130b 100644 (file)
--- a/HISTORY
+++ b/HISTORY
@@ -41,7 +41,7 @@ Bugs
 * Fix multiple bugs about quoting and escaping database objects names with special chars
 * Fix multiple bugs in the browser tree
 * Fix multiple bugs on the SQL and script file import form
-* One security fix about code injection
+* Three security fix about code injection
 * Don't allow inserting on a table without fields
 * Some fix about commenting databases
 * removed deprecated functions from PHP 5.3

diff --git a/classes/Misc.php b/classes/Misc.php
index 6a15c0dd0d39ef0e655350aac40e87f44965dedf..3a04ddc7d3f23d728286d88b079e6d059d742c3c 100644 (file)
--- a/classes/Misc.php
+++ b/classes/Misc.php
@@ -398,7 +398,7 @@
                                echo "<link rel=\"shortcut icon\" href=\"images/themes/{$conf['theme']}/Favicon.ico\" type=\"image/vnd.microsoft.icon\" />\n";
                                echo "<link rel=\"icon\" type=\"image/png\" href=\"images/themes/{$conf['theme']}/Introduction.png\" />\n";
                                echo "<title>", htmlspecialchars($appName);
-                               if ($title != '') echo " - {$title}";
+                               if ($title != '') echo htmlspecialchars(" - {$title}");
                                echo "</title>\n";
 
                                if ($script) echo "{$script}\n";

diff --git a/display.php b/display.php
index c36739ae4eb87c9beca1076a587e2783270fb3ed..b7a31ceda72efd23d1a40016ce13afb58251775a 100644 (file)
--- a/display.php
+++ b/display.php
@@ -578,7 +578,7 @@
 
                // Return
                if (isset($_REQUEST['return_url']) && isset($_REQUEST['return_desc']))
-                       echo "\t<li><a href=\"{$_REQUEST['return_url']}\">{$_REQUEST['return_desc']}</a></li>\n";
+                       echo "\t<li><a href=\"". htmlspecialchars($_REQUEST['return_url']) ."\">". htmlspecialchars($_REQUEST['return_desc']) ."</a></li>\n";
 
                // Edit SQL link
                if (isset($_REQUEST['query']))