Fix merge conflicts

ibennetch · ibennetch · commit 43de7826e1d3 · 2023-02-07T21:45:13.000-05:00
Signed-off-by: Isaac Bennetch &lt;bennetch@gmail.com&gt;
diff --git a/ChangeLog b/ChangeLog
@@ -5,7 +5,7 @@ phpMyAdmin - ChangeLog
 - issue #17842 Change js.cookie.js to js.cookie.min.js
 - issue #17632 Improve tab keypress to text fields on the login form
 
-5.2.1 (not yet released)
+5.2.1 (2023-02-07)
 - issue #17522 Fix case where the routes cache file is invalid
 - issue #17506 Fix error when configuring 2FA without XMLWriter or Imagick
 - issue        Fix blank page when some error occurs
@@ -88,6 +88,7 @@ phpMyAdmin - ChangeLog
 - issue        Fix silent JSON parse error on upload progress
 - issue #17833 Fix "Add Parameter" button not working for Add Routine Screen
 - issue #17365 Fixed "Uncaught Error: regexp too big" on server status variables page
+- issue        [security] Fix an XSS attack through the drag-and-drop upload feature (PMASA-2023-01)
 
 5.2.0 (2022-05-10)
 - issue #16521 Upgrade Bootstrap to version 5
diff --git a/js/src/drag_drop_import.js b/js/src/drag_drop_import.js
@@ -134,7 +134,7 @@ var DragDropImport = {
                                 var filename = $this.parent('span').attr('data-filename');
                                 $('body').append('<div class="pma_drop_result"><h2>' +
                                     window.Messages.dropImportImportResultHeader + ' - ' +
-                                    filename + '<span class="close">x</span></h2>' + value.message + '</div>');
+                                    Functions.escapeHtml(filename) + '<span class="close">x</span></h2>' + value.message + '</div>');
                                 $('.pma_drop_result').draggable();  // to make this dialog draggable
                             }
                         });

Original file line number	Diff line number	Diff line change
`@@ -134,7 +134,7 @@ var DragDropImport = {`
`134`	`134`	`var filename = $this.parent('span').attr('data-filename');`
`135`	`135`	`$('body').append('<div class="pma_drop_result"><h2>' +`
`136`	`136`	`window.Messages.dropImportImportResultHeader + ' - ' +`
`137`		`- filename + '<span class="close">x</span></h2>' + value.message + '</div>');`
	`137`	`+ Functions.escapeHtml(filename) + '<span class="close">x</span></h2>' + value.message + '</div>');`
`138`	`138`	`$('.pma_drop_result').draggable(); // to make this dialog draggable`
`139`	`139`	`}`
`140`	`140`	`});`