You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by le...@apache.org on 2009/12/10 01:53:47 UTC
svn commit: r889040 - in /ofbiz/trunk:
applications/content/src/org/ofbiz/content/survey/
applications/order/src/org/ofbiz/order/shoppingcart/
applications/order/webapp/ordermgr/WEB-INF/
applications/order/webapp/ordermgr/WEB-INF/actions/entry/catalog/...
Author: lektran
Date: Thu Dec 10 00:53:47 2009
New Revision: 889040
URL: http://svn.apache.org/viewvc?rev=889040&view=rev
Log:
Reverted previous temporary security fix for request parameters being directly inserted into survey forms and changed all SurveyWrapper instances using this method to instead store the parameter map in the session temporarily.
Modified:
ofbiz/trunk/applications/content/src/org/ofbiz/content/survey/SurveyWrapper.java
ofbiz/trunk/applications/order/src/org/ofbiz/order/shoppingcart/ShoppingCartEvents.java
ofbiz/trunk/applications/order/webapp/ordermgr/WEB-INF/actions/entry/catalog/ProductDetail.groovy
ofbiz/trunk/applications/order/webapp/ordermgr/WEB-INF/controller.xml
ofbiz/trunk/applications/product/src/org/ofbiz/product/store/ProductStoreWorker.java
ofbiz/trunk/specialpurpose/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
Modified: ofbiz/trunk/applications/content/src/org/ofbiz/content/survey/SurveyWrapper.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/content/src/org/ofbiz/content/survey/SurveyWrapper.java?rev=889040&r1=889039&r2=889040&view=diff
==============================================================================
--- ofbiz/trunk/applications/content/src/org/ofbiz/content/survey/SurveyWrapper.java (original)
+++ ofbiz/trunk/applications/content/src/org/ofbiz/content/survey/SurveyWrapper.java Thu Dec 10 00:53:47 2009
@@ -101,13 +101,10 @@
* @param passThru
*/
public void setPassThru(Map passThru) {
- /* Creates an XSS vulnerability, by passing incoming parameters straight back out to the browser
- * commented until someone decides either cleanse the parameters or find an alternative solution
if (passThru != null) {
this.passThru = FastMap.newInstance();
this.passThru.putAll(passThru);
}
- */
}
/**
Modified: ofbiz/trunk/applications/order/src/org/ofbiz/order/shoppingcart/ShoppingCartEvents.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/order/src/org/ofbiz/order/shoppingcart/ShoppingCartEvents.java?rev=889040&r1=889039&r2=889040&view=diff
==============================================================================
--- ofbiz/trunk/applications/order/src/org/ofbiz/order/shoppingcart/ShoppingCartEvents.java (original)
+++ ofbiz/trunk/applications/order/src/org/ofbiz/order/shoppingcart/ShoppingCartEvents.java Thu Dec 10 00:53:47 2009
@@ -464,7 +464,8 @@
if (surveyResponseId != null) {
surveyResponses = UtilMisc.toList(surveyResponseId);
} else {
- Map surveyContext = UtilHttp.getParameterMap(request);
+ String origParamMapId = UtilHttp.stashParameterMap(request);
+ Map<String, Object> surveyContext = UtilMisc.<String, Object>toMap("_ORIG_PARAM_MAP_ID_", origParamMapId);
GenericValue userLogin = cart.getUserLogin();
String partyId = null;
if (userLogin != null) {
Modified: ofbiz/trunk/applications/order/webapp/ordermgr/WEB-INF/actions/entry/catalog/ProductDetail.groovy
URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/order/webapp/ordermgr/WEB-INF/actions/entry/catalog/ProductDetail.groovy?rev=889040&r1=889039&r2=889040&view=diff
==============================================================================
--- ofbiz/trunk/applications/order/webapp/ordermgr/WEB-INF/actions/entry/catalog/ProductDetail.groovy (original)
+++ ofbiz/trunk/applications/order/webapp/ordermgr/WEB-INF/actions/entry/catalog/ProductDetail.groovy Thu Dec 10 00:53:47 2009
@@ -150,7 +150,8 @@
productSurvey = ProductStoreWorker.getProductSurveys(delegator, productStoreId, productId, "CART_ADD");
if (productSurvey) {
survey = EntityUtil.getFirst(productSurvey);
- surveyContext = UtilHttp.getParameterMap(request);
+ origParamMapId = UtilHttp.stashParameterMap(request);
+ surveyContext = ["_ORIG_PARAM_MAP_ID_" : origParamMapId];
surveyPartyId = userLogin?.partyId;
wrapper = new ProductStoreSurveyWrapper(survey, surveyPartyId, surveyContext);
context.surveyWrapper = wrapper;
Modified: ofbiz/trunk/applications/order/webapp/ordermgr/WEB-INF/controller.xml
URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/order/webapp/ordermgr/WEB-INF/controller.xml?rev=889040&r1=889039&r2=889040&view=diff
==============================================================================
--- ofbiz/trunk/applications/order/webapp/ordermgr/WEB-INF/controller.xml (original)
+++ ofbiz/trunk/applications/order/webapp/ordermgr/WEB-INF/controller.xml Thu Dec 10 00:53:47 2009
@@ -428,7 +428,7 @@
</request-map>
<request-map uri="additemsurvey">
<security https="true" auth="true"/>
- <event type="service" invoke="createSurveyResponse"/>
+ <event type="java" invoke="createSurveyResponseAndRestoreParameters" path="org.ofbiz.content.survey.SurveyEvents"/>
<response name="success" type="request" value="additem"/>
<response name="error" type="request" value="orderentry"/>
</request-map>
@@ -528,7 +528,7 @@
</request-map>
<request-map uri="addGiftCertificateSurvey">
<security https="true" auth="false"/>
- <event type="service" invoke="createSurveyResponse"/>
+ <event type="java" invoke="createSurveyResponseAndRestoreParameters" path="org.ofbiz.content.survey.SurveyEvents"/>
<response name="success" type="request" value="additem"/>
<response name="error" type="view" value="AddGiftCertificate"/>
</request-map>
Modified: ofbiz/trunk/applications/product/src/org/ofbiz/product/store/ProductStoreWorker.java
URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/product/src/org/ofbiz/product/store/ProductStoreWorker.java?rev=889040&r1=889039&r2=889040&view=diff
==============================================================================
--- ofbiz/trunk/applications/product/src/org/ofbiz/product/store/ProductStoreWorker.java (original)
+++ ofbiz/trunk/applications/product/src/org/ofbiz/product/store/ProductStoreWorker.java Thu Dec 10 00:53:47 2009
@@ -421,9 +421,9 @@
return returnShippingMethods;
}
- public static ProductStoreSurveyWrapper getRandomSurveyWrapper(ServletRequest request, String groupName) {
+ public static ProductStoreSurveyWrapper getRandomSurveyWrapper(HttpServletRequest request, String groupName) {
GenericValue productStore = getProductStore(request);
- HttpSession session = ((HttpServletRequest)request).getSession();
+ HttpSession session = request.getSession();
if (productStore == null) {
return null;
}
@@ -434,7 +434,8 @@
}
String partyId = userLogin != null ? userLogin.getString("partyId") : null;
- Map<String, Object> passThruFields = UtilHttp.getParameterMap(((HttpServletRequest)request));
+ String origParamMapId = UtilHttp.stashParameterMap(request);
+ Map<String, Object> passThruFields = UtilMisc.<String, Object>toMap("_ORIG_PARAM_MAP_ID_", origParamMapId);
return getRandomSurveyWrapper(productStore.getDelegator(), productStore.getString("productStoreId"), groupName, partyId, passThruFields);
}
Modified: ofbiz/trunk/specialpurpose/ecommerce/webapp/ecommerce/WEB-INF/controller.xml
URL: http://svn.apache.org/viewvc/ofbiz/trunk/specialpurpose/ecommerce/webapp/ecommerce/WEB-INF/controller.xml?rev=889040&r1=889039&r2=889040&view=diff
==============================================================================
--- ofbiz/trunk/specialpurpose/ecommerce/webapp/ecommerce/WEB-INF/controller.xml (original)
+++ ofbiz/trunk/specialpurpose/ecommerce/webapp/ecommerce/WEB-INF/controller.xml Thu Dec 10 00:53:47 2009
@@ -247,7 +247,7 @@
<request-map uri="additemsurvey">
<security https="false" auth="false"/>
- <event type="service" invoke="createSurveyResponse"/>
+ <event type="java" invoke="createSurveyResponseAndRestoreParameters" path="org.ofbiz.content.survey.SurveyEvents"/>
<response name="success" type="request" value="additem"/>
<response name="error" type="view" value="main"/>
</request-map>
@@ -1245,13 +1245,13 @@
</request-map>
<request-map uri="profilesurvey">
<security https="true" auth="true"/>
- <event type="service" invoke="createSurveyResponse"/>
+ <event type="java" invoke="createSurveyResponseAndRestoreParameters" path="org.ofbiz.content.survey.SurveyEvents"/>
<response name="success" type="view" value="profilesurvey"/>
<response name="error" type="view" value="profilesurvey"/>
</request-map>
<request-map uri="minipoll">
<security https="false" auth="false"/>
- <event type="service" invoke="createSurveyResponse"/>
+ <event type="java" invoke="createSurveyResponseAndRestoreParameters" path="org.ofbiz.content.survey.SurveyEvents"/>
<response name="success" type="view" value="main"/>
<response name="error" type="view" value="main"/>
</request-map>
Re: svn commit: r889040 - in /ofbiz/trunk: applications/content/src/org/ofbiz/content/survey/ applications/order/src/org/ofbiz/order/shoppingcart/ applications/order/webapp/ordermgr/WEB-INF/ applications/order/webapp/ordermgr/WEB-INF/actions/entry/catalog/...
Posted by Scott Gray <sc...@hotwaxmedia.com>.
On 10/12/2009, at 1:57 PM, Adam Heath wrote:
> lektran@apache.org wrote:
>> Author: lektran
>> Date: Thu Dec 10 00:53:47 2009
>> New Revision: 889040
>>
>> URL: http://svn.apache.org/viewvc?rev=889040&view=rev
>> Log:
>> Reverted previous temporary security fix for request parameters
>> being directly inserted into survey forms and changed all
>> SurveyWrapper instances using this method to instead store the
>> parameter map in the session temporarily.
>
> I like.
I'm glad.
Re: svn commit: r889040 - in /ofbiz/trunk: applications/content/src/org/ofbiz/content/survey/
applications/order/src/org/ofbiz/order/shoppingcart/ applications/order/webapp/ordermgr/WEB-INF/
applications/order/webapp/ordermgr/WEB-INF/actions/entry/catalog/...
Posted by Adam Heath <do...@brainfood.com>.
lektran@apache.org wrote:
> Author: lektran
> Date: Thu Dec 10 00:53:47 2009
> New Revision: 889040
>
> URL: http://svn.apache.org/viewvc?rev=889040&view=rev
> Log:
> Reverted previous temporary security fix for request parameters being directly inserted into survey forms and changed all SurveyWrapper instances using this method to instead store the parameter map in the session temporarily.
I like.