(jspwiki) 01/01: JSPWIKI-1284 see jira for details

[al...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

spyhunter99 pushed a commit to branch bug/JSPWIKI-1284
in repository https://gitbox.apache.org/repos/asf/jspwiki.git

commit a4d6f8ff6618ee58e7704e627c509d15009e045b
Author: Alex O'Ree <al...@apache.org>
AuthorDate: Sun Aug 23 10:34:50 2026 -0400

    JSPWIKI-1284 see jira for details
---
 jspwiki-war/src/main/webapp/templates/default/PageTab.jsp | 2 +-
 jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp b/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp
index 01e9cb43c..db27c3747 100644
--- a/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp
+++ b/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp
@@ -47,7 +47,7 @@
   <form action="<wiki:Link format='url' jsp='Wiki.jsp'/>"
         method="get"  accept-charset='UTF-8'>
 
-    <input type="hidden" name="page" value="${param.page}" />
+    <input type="hidden" name="page" value="${fn:escapeXml(param.page)}" />
     <wiki:CsrfProtection/>
     <div class="error center">
       <label>
diff --git a/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp b/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp
index 1f9e00a08..9a43c3bb2 100644
--- a/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp
+++ b/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp
@@ -20,6 +20,7 @@
 <%@ taglib uri="http://jspwiki.apache.org/tags" prefix="wiki" %>
 <%@ taglib prefix="c" uri="jakarta.tags.core" %>
 <%@ taglib prefix="fmt" uri="jakarta.tags.fmt" %>
+<%@ taglib prefix="fn" uri="jakarta.tags.functions" %>
 <%@ page import="jakarta.servlet.jsp.jstl.fmt.*" %>
 <fmt:setLocale value="${prefs.Language}" />
 <fmt:setBundle basename="templates.default"/>
@@ -29,8 +30,8 @@
 
   <c:set var="isweblog"><%= ( String )Context.findContext( pageContext ).getPage().getAttribute( /*ATTR_ISWEBLOG*/ "weblogplugin.isweblog" ) %></c:set>
   <c:if test="${isweblog}">
-  <wiki:Calendar pageformat="'${param.page}_blogentry_'ddMMyy'_'" addindex="true"
-                 urlformat="'Wiki.jsp?page=${param.page}&weblog.startDate='ddMMyy'&weblog.days=1'"/>
+  <wiki:Calendar pageformat="'${fn:escapeXml(param.page)}_blogentry_'ddMMyy'_'" addindex="true"
+                 urlformat="'Wiki.jsp?page=${fn:escapeXml(param.page)}&weblog.startDate='ddMMyy'&weblog.days=1'"/>
   </c:if>
 
   <wiki:Permission permission="view">