[myfaces-tobago] branch tobago-4.x updated: TOBAGO-1958: CommandRenderer may not escape links correctly

[lo...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lofwyr pushed a commit to branch tobago-4.x
in repository https://gitbox.apache.org/repos/asf/myfaces-tobago.git


The following commit(s) were added to refs/heads/tobago-4.x by this push:
     new ee07709  TOBAGO-1958: CommandRenderer may not escape links correctly
ee07709 is described below

commit ee077092f91b4b5a91ce65cf817f7a373946ab4d
Author: Udo Schnurpfeil <lo...@apache.org>
AuthorDate: Wed Nov 21 14:27:18 2018 +0100

    TOBAGO-1958: CommandRenderer may not escape links correctly
    
    (cherry picked from commit 263a291828797cd0867a5225072fdc18980fb1f5)
---
 .../tobago/internal/renderkit/renderer/CommandRendererBase.java       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/renderkit/renderer/CommandRendererBase.java b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/renderkit/renderer/CommandRendererBase.java
index e173245..560930a 100644
--- a/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/renderkit/renderer/CommandRendererBase.java
+++ b/tobago-core/src/main/java/org/apache/myfaces/tobago/internal/renderkit/renderer/CommandRendererBase.java
@@ -88,8 +88,8 @@ public abstract class CommandRendererBase extends DecodingCommandRendererBase {
     if (!disabled) {
       if (anchor) {
         final String href = RenderUtils.generateUrl(facesContext, command);
-        writer.writeAttribute(HtmlAttributes.HREF, href, false);
-        writer.writeAttribute(HtmlAttributes.TARGET, target, false);
+        writer.writeAttribute(HtmlAttributes.HREF, href, true);
+        writer.writeAttribute(HtmlAttributes.TARGET, target, true);
 
         command.setOmit(true);
       }