(jspwiki) 20/33: JSPWIKI-1284 see jira for details

[ju...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

juanpablo-santos pushed a commit to branch master-2.x
in repository https://gitbox.apache.org/repos/asf/jspwiki.git

commit 8a4dc6001a21c979ec29635c277ee676e30bb0fe
Author: Juan Pablo Santos Rodríguez <ju...@gmail.com>
AuthorDate: Thu Sep 24 16:25:25 2026 +0200

    JSPWIKI-1284 see jira for details
---
 jspwiki-war/src/main/webapp/templates/default/PageTab.jsp | 2 +-
 jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp b/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp
index 8e7660a2b..1c11deec7 100644
--- a/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp
+++ b/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp
@@ -47,7 +47,7 @@
   <form action="<wiki:Link format='url' jsp='Wiki.jsp'/>"
         method="get"  accept-charset='UTF-8'>
 
-    <input type="hidden" name="page" value="${param.page}" />
+    <input type="hidden" name="page" value="${fn:escapeXml(param.page)}" />
     <wiki:CsrfProtection/>
     <div class="error center">
       <label>
diff --git a/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp b/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp
index fd79e854b..a53b43c68 100644
--- a/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp
+++ b/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp
@@ -20,6 +20,7 @@
 <%@ taglib uri="http://jspwiki.apache.org/tags" prefix="wiki" %>
 <%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
 <%@ taglib uri="http://java.sun.com/jsp/jstl/fmt" prefix="fmt" %>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>
 <%@ page import="javax.servlet.jsp.jstl.fmt.*" %>
 <fmt:setLocale value="${prefs.Language}" />
 <fmt:setBundle basename="templates.default"/>
@@ -29,8 +30,8 @@
 
   <c:set var="isweblog"><%= ( String )Context.findContext( pageContext ).getPage().getAttribute( /*ATTR_ISWEBLOG*/ "weblogplugin.isweblog" ) %></c:set>
   <c:if test="${isweblog}">
-  <wiki:Calendar pageformat="'${param.page}_blogentry_'ddMMyy'_'" addindex="true"
-                 urlformat="'Wiki.jsp?page=${param.page}&weblog.startDate='ddMMyy'&weblog.days=1'"/>
+  <wiki:Calendar pageformat="'${fn:escapeXml(param.page)}_blogentry_'ddMMyy'_'" addindex="true"
+                 urlformat="'Wiki.jsp?page=${fn:escapeXml(param.page)}&weblog.startDate='ddMMyy'&weblog.days=1'"/>
   </c:if>
 
   <wiki:Permission permission="view">