From 0bd26222d82d7a1e022ab8ce637f6ddc47f66397 Mon Sep 17 00:00:00 2001
From: Aditya Toshniwal <aditya.toshniwal@enterprisedb.com>
Date: Thu, 5 Dec 2019 13:13:33 +0530
Subject: [PATCH] Fix query tool launch error if user name contains HTML
 characters. It's a regression. Fixes #4674.

---
 docs/en_US/release_notes_4_16.rst                | 1 +
 web/pgadmin/tools/datagrid/static/js/datagrid.js | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/en_US/release_notes_4_16.rst b/docs/en_US/release_notes_4_16.rst
index 823d59943..a3179fd07 100644
--- a/docs/en_US/release_notes_4_16.rst
+++ b/docs/en_US/release_notes_4_16.rst
@@ -28,6 +28,7 @@ Bug fixes
 
 | `Issue #3538 <https://redmine.postgresql.org/issues/3538>`_ -  Fix issue where the Reset button does not get enabled till all the mandatory fields are provided in the dialog.
 | `Issue #4659 <https://redmine.postgresql.org/issues/4659>`_ -  Updated documentation for default privileges to clarify more on the grantor.
+| `Issue #4674 <https://redmine.postgresql.org/issues/4674>`_ -  Fix query tool launch error if user name contains HTML characters. It's a regression.
 | `Issue #4724 <https://redmine.postgresql.org/issues/4724>`_ -  Fix network disconnect issue while establishing the connection via SSH Tunnel and it impossible to expand the Servers node.
 | `Issue #4761 <https://redmine.postgresql.org/issues/4761>`_ -  Fix an issue where the wrong type is displayed when changing the datatype from timestamp with time zone to timestamp without time zone.
 | `Issue #4792 <https://redmine.postgresql.org/issues/4792>`_ -  Ensure that the superuser should be able to create database, as the superuser overrides all the access restrictions.
diff --git a/web/pgadmin/tools/datagrid/static/js/datagrid.js b/web/pgadmin/tools/datagrid/static/js/datagrid.js
index b4258ee59..1df617386 100644
--- a/web/pgadmin/tools/datagrid/static/js/datagrid.js
+++ b/web/pgadmin/tools/datagrid/static/js/datagrid.js
@@ -227,7 +227,7 @@ define('pgadmin.datagrid', [
         queryToolForm +=`
           </form>
             <script>
-              document.getElementById("title").value = "${panel_title}";
+              document.getElementById("title").value = "${_.escape(panel_title)}";
               document.getElementById("queryToolForm").submit();
             </script>
           `;