You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by de...@apache.org on 2019/02/03 09:36:07 UTC
svn commit: r1852819 - in /ofbiz/ofbiz-framework/branches/release18.12: ./
themes/bluelight/template/Header.ftl themes/flatgrey/template/Header.ftl
themes/rainbowstone/template/includes/TopAppBar.ftl
themes/tomahawk/template/AppBarClose.ftl
Author: deepak
Date: Sun Feb 3 09:36:07 2019
New Revision: 1852819
URL: http://svn.apache.org/viewvc?rev=1852819&view=rev
Log:
Applied fix from trunk for revision: 1852818
===
Fixed: Html escaping missing for portalPageId parameter of Help button
(OFBIZ-10828)
Thanks, Niels Heinen of the Google security team for reporting the issue.
Modified:
ofbiz/ofbiz-framework/branches/release18.12/ (props changed)
ofbiz/ofbiz-framework/branches/release18.12/themes/bluelight/template/Header.ftl
ofbiz/ofbiz-framework/branches/release18.12/themes/flatgrey/template/Header.ftl
ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/includes/TopAppBar.ftl
ofbiz/ofbiz-framework/branches/release18.12/themes/tomahawk/template/AppBarClose.ftl
Propchange: ofbiz/ofbiz-framework/branches/release18.12/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Sun Feb 3 09:36:07 2019
@@ -10,4 +10,4 @@
/ofbiz/branches/json-integration-refactoring:1634077-1635900
/ofbiz/branches/multitenant20100310:921280-927264
/ofbiz/branches/release13.07:1547657
-/ofbiz/ofbiz-framework/trunk:1850015,1850023,1850530,1850647,1850685,1850694,1850711,1850914,1850918,1850921,1850948,1850953,1851006,1851013,1851068,1851074,1851130,1851158,1851200,1851224,1851247,1851254,1851315,1851319,1851350,1851353,1851433,1851500,1851805,1851885,1851998,1852503,1852587
+/ofbiz/ofbiz-framework/trunk:1850015,1850023,1850530,1850647,1850685,1850694,1850711,1850914,1850918,1850921,1850948,1850953,1851006,1851013,1851068,1851074,1851130,1851158,1851200,1851224,1851247,1851254,1851315,1851319,1851350,1851353,1851433,1851500,1851805,1851885,1851998,1852503,1852587,1852818
Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/bluelight/template/Header.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/bluelight/template/Header.ftl?rev=1852819&r1=1852818&r2=1852819&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/bluelight/template/Header.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/bluelight/template/Header.ftl Sun Feb 3 09:36:07 2019
@@ -194,7 +194,7 @@ under the License.
<#--if webSiteId?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??-->
<#if parameters.componentName?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??>
<#include "component://common-theme/template/includes/HelpLink.ftl" />
- <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${parameters.portalPageId!}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
+ <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
</#if>
<#if userLogin??>
<#if "Y" == (userPreferences.COMPACT_HEADER)?default("N")>
Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/flatgrey/template/Header.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/flatgrey/template/Header.ftl?rev=1852819&r1=1852818&r2=1852819&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/flatgrey/template/Header.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/flatgrey/template/Header.ftl Sun Feb 3 09:36:07 2019
@@ -156,7 +156,7 @@ under the License.
<#---if webSiteId?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??-->
<#if parameters.componentName?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??>
<#include "component://common-theme/template/includes/HelpLink.ftl" />
- <li><a <#if pageAvail?has_content>class="alert"</#if> href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${parameters.portalPageId!}','help' ,500,500);">${uiLabelMap.CommonHelp}</a></li>
+ <li><a <#if pageAvail?has_content>class="alert"</#if> href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);">${uiLabelMap.CommonHelp}</a></li>
</#if>
</ul>
</li>
Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/includes/TopAppBar.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/includes/TopAppBar.ftl?rev=1852819&r1=1852818&r2=1852819&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/includes/TopAppBar.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/includes/TopAppBar.ftl Sun Feb 3 09:36:07 2019
@@ -238,7 +238,7 @@ under the License.
<div id="main-nav-bar-right">
<div id="company-logo"></div>
<#if parameters.componentName?exists && requestAttributes._CURRENT_VIEW_?exists && helpTopic?exists>
- <a class="dark-color" title="${uiLabelMap.CommonHelp}" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${parameters.portalPageId!}','help' ,500,500);"><img class="appbar-btn-img" id="help-btn" src="/rainbowstone/images/help.svg" alt="Help"></a>
+ <a class="dark-color" title="${uiLabelMap.CommonHelp}" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);"><img class="appbar-btn-img" id="help-btn" src="/rainbowstone/images/help.svg" alt="Help"></a>
</#if>
<#include "component://rainbowstone/template/includes/Avatar.ftl"/>
Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/tomahawk/template/AppBarClose.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/tomahawk/template/AppBarClose.ftl?rev=1852819&r1=1852818&r2=1852819&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/tomahawk/template/AppBarClose.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/tomahawk/template/AppBarClose.ftl Sun Feb 3 09:36:07 2019
@@ -75,7 +75,7 @@ under the License.
<#--if webSiteId?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??-->
<#if parameters.componentName?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??>
<#include "component://common-theme/template/includes/HelpLink.ftl" />
- <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${parameters.portalPageId!}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
+ <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
</#if>
<li><a href="<@o...@ofbizUrl>">${uiLabelMap.CommonLogout}</a></li>
<li><a href="<@o...@ofbizUrl>">${uiLabelMap.CommonVisualThemes}</a></li>