You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by dk...@apache.org on 2022/10/26 00:17:29 UTC

[sling-org-apache-sling-app-cms] branch master updated: Improving handling of paths

This is an automated email from the ASF dual-hosted git repository.

dklco pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-app-cms.git


The following commit(s) were added to refs/heads/master by this push:
     new 3475697e Improving handling of paths
3475697e is described below

commit 3475697e7a0556fdf0dc6dad1ff5d2a0c0a03e24
Author: Dan Klco <kl...@adobe.com>
AuthorDate: Tue Oct 25 20:17:22 2022 -0400

    Improving handling of paths
---
 reference/bnd.bnd                                      |  6 ++----
 .../apps/reference/components/forms/form/form.jsp      |  2 +-
 .../components/general/breadcrumb/breadcrumb.jsp       |  2 +-
 .../apps/reference/components/general/list/item.jsp    |  2 +-
 .../reference/components/general/search/result.jsp     |  4 ++--
 .../apps/reference/components/general/tags/tags.jsp    |  2 +-
 .../apps/reference/components/pages/base/body.jsp      |  8 +++-----
 .../components/caconfig/policy/config/config.jsp       |  2 +-
 .../components/caconfig/scripts/policyOptions.jsp      |  2 +-
 .../components/caconfig/template/config/config.jsp     |  2 +-
 .../sling-cms/components/cms/actions/basic/basic.jsp   |  2 +-
 .../sling-cms/components/cms/actions/modal/modal.jsp   |  2 +-
 .../sling-cms/components/cms/columns/name/name.jsp     |  4 ++--
 .../components/cms/columns/publish/publish.jsp         |  4 ++--
 .../components/cms/contentgrid/contentgrid.jsp         | 18 +++++++++---------
 .../components/cms/contenttable/contenttable.jsp       |  6 +++---
 .../components/cms/i18ncontainer/i18ncontainer.jsp     |  4 ++--
 .../components/cms/includeconfig/includeconfig.jsp     |  2 +-
 .../sling-cms/components/cms/pageeditor/pageeditor.jsp |  2 +-
 .../sling-cms/components/cms/querydebug/querydebug.jsp |  4 ++--
 .../components/cms/searchresults/searchresults.jsp     |  4 ++--
 .../sling-cms/components/cms/startcontent/search.jsp   |  2 +-
 .../components/cms/startcontent/startcontent.jsp       |  2 +-
 .../sling-cms/components/cms/tilecard/tilecard.jsp     |  2 +-
 .../sling-cms/components/editor/fields/base/base.jsp   |  2 +-
 .../sling-cms/components/editor/fields/path/path.jsp   |  4 ++--
 .../editor/scripts/componentConfigOptions.jsp          |  8 ++++----
 .../components/general/container/container.jsp         |  4 ++--
 .../components/jobs/configuration/configuration.jsp    |  2 +-
 .../libs/sling-cms/components/jobs/list/list.jsp       |  2 +-
 .../libs/sling-cms/components/pages/base/nav.jsp       |  2 +-
 31 files changed, 55 insertions(+), 59 deletions(-)

diff --git a/reference/bnd.bnd b/reference/bnd.bnd
index 0bc4047f..42444565 100644
--- a/reference/bnd.bnd
+++ b/reference/bnd.bnd
@@ -1,8 +1,6 @@
 Sling-Initial-Content: jcr_root/apps/reference;overwrite:=true;uninstall:=true;path:=/apps/reference,\
     jcr_root/conf/asf.json;overwrite:=true;ignoreImportProviders:=xml;path:=/conf/asf,\
-    jcr_root/content/apache.json;overwrite:=false;uninstall:=false;path:=/content/apache,\
-    jcr_root/etc/taxonomy/reference.json;overwrite:=false;uninstall:=false;path:=/etc/taxonomy/reference,\
-    jcr_root/oak:index/slingPage/indexRules/sling:Page/properties/hideInSitemap.json;overwrite:=true;path:=/oak:index/slingPage/indexRules/sling:Page/properties/hideInSitemap,\
-    jcr_root/oak:index/slingPage/indexRules/sling:Page/properties/publishDate.json;overwrite:=true;path:=/oak:index/slingPage/indexRules/sling:Page/properties/publishDate,\
+    jcr_root/content/apache.json;overwrite:=true;path:=/content/apache,\
+    jcr_root/etc/taxonomy/reference.json;overwrite:=true;path:=/etc/taxonomy/reference,\
     jcr_root/static/clientlibs/reference;overwrite:=true;ignoreImportProviders:=xml;path:=/static/clientlibs/reference
 Sling-Model-Packages: org.apache.sling.cms.reference.models,org.apache.sling.cms.reference.forms.impl
\ No newline at end of file
diff --git a/reference/src/main/resources/jcr_root/apps/reference/components/forms/form/form.jsp b/reference/src/main/resources/jcr_root/apps/reference/components/forms/form/form.jsp
index 2f628bbe..c388f353 100644
--- a/reference/src/main/resources/jcr_root/apps/reference/components/forms/form/form.jsp
+++ b/reference/src/main/resources/jcr_root/apps/reference/components/forms/form/form.jsp
@@ -19,7 +19,7 @@
  <%@include file="/libs/sling-cms/global.jsp"%>
 <c:set var="formConfig" value="${sling:adaptTo(resource,'org.apache.sling.cms.ComponentConfiguration').properties}" scope="request" />
 <c:set var="formData" value="${sling:adaptTo(slingRequest,'org.apache.sling.cms.reference.forms.FormRequest').formData}" scope="request" />
-<form class="${formConfig.formClass}" action="${resource.path}.allowpost.html" method="post" data-analytics-id="${sling:encode(properties.formId,'HTML_ATTR')}" enctype="multipart/form-data">
+<form class="${formConfig.formClass}" action="${sling:encode(resource.path,'HTML_ATTR')}.allowpost.html" method="post" data-analytics-id="${sling:encode(properties.formId,'HTML_ATTR')}" enctype="multipart/form-data">
     <c:if test="${param.message == 'success'}">
         <div class="${formConfig.alertClass}">
             ${properties.successMessage}
diff --git a/reference/src/main/resources/jcr_root/apps/reference/components/general/breadcrumb/breadcrumb.jsp b/reference/src/main/resources/jcr_root/apps/reference/components/general/breadcrumb/breadcrumb.jsp
index 59f57842..cc223bd2 100644
--- a/reference/src/main/resources/jcr_root/apps/reference/components/general/breadcrumb/breadcrumb.jsp
+++ b/reference/src/main/resources/jcr_root/apps/reference/components/general/breadcrumb/breadcrumb.jsp
@@ -23,7 +23,7 @@
 <c:if test="${not empty properties.level}">
     <c:forEach var="parent" items="${sling:getParents(currentPage.resource,properties.level)}">
         <c:if test="${parent.path != page.resource.path}">
-            <a href="${parent.path}.html">
+            <a href="${sling:encode(parent.path,'HTML_ATTR')}.html">
                 <sling:encode value="${parent.valueMap['jcr:content/jcr:title']}" default="${parent.name}" mode="HTML" />
             </a>&nbsp;&#xbb;&nbsp;
         </c:if>
diff --git a/reference/src/main/resources/jcr_root/apps/reference/components/general/list/item.jsp b/reference/src/main/resources/jcr_root/apps/reference/components/general/list/item.jsp
index 93ed50ea..f5ece878 100644
--- a/reference/src/main/resources/jcr_root/apps/reference/components/general/list/item.jsp
+++ b/reference/src/main/resources/jcr_root/apps/reference/components/general/list/item.jsp
@@ -26,7 +26,7 @@
             <c:set var="url" value="${item.path}.html" />
         </c:otherwise>
     </c:choose>
-    <a href="${url}">
+    <a href="${sling:encode(url,'HTML_ATTR')}">
         <sling:encode value="${item.valueMap['jcr:content/jcr:title']}" default="${item.name}" mode="HTML" />
     </a>
 </li>
\ No newline at end of file
diff --git a/reference/src/main/resources/jcr_root/apps/reference/components/general/search/result.jsp b/reference/src/main/resources/jcr_root/apps/reference/components/general/search/result.jsp
index 6b4176ce..eaa2c1a0 100644
--- a/reference/src/main/resources/jcr_root/apps/reference/components/general/search/result.jsp
+++ b/reference/src/main/resources/jcr_root/apps/reference/components/general/search/result.jsp
@@ -19,14 +19,14 @@
 <%@include file="/libs/sling-cms/global.jsp"%>
 <div class="searchresult ${searchConfig.resultClass}">
     <div class="searchresult__header ${searchConfig.resultHeaderClass}">
-        <a href="${result.path}.html" class="searchresult__link">
+        <a href="${sling:encode(result.path,'HTML_ATTR')}.html" class="searchresult__link">
             <sling:encode value="${result.valueMap['jcr:content/jcr:title']}" mode="HTML" />
         </a>
     </div>
     <p class="searchresult__body">
         <sling:encode value="${result.valueMap['jcr:content/jcr:description']}" mode="HTML" />
     </p>
-    <a href="${result.path}.html" class="searchresult__link">
+    <a href="${sling:encode(result.path,'HTML_ATTR')}.html" class="searchresult__link">
         ${fn:replace(result.path,sling:getAbsoluteParent(result,3).path,'')}.html
     </a>
 </div>
\ No newline at end of file
diff --git a/reference/src/main/resources/jcr_root/apps/reference/components/general/tags/tags.jsp b/reference/src/main/resources/jcr_root/apps/reference/components/general/tags/tags.jsp
index f5081d94..cd49bdd5 100644
--- a/reference/src/main/resources/jcr_root/apps/reference/components/general/tags/tags.jsp
+++ b/reference/src/main/resources/jcr_root/apps/reference/components/general/tags/tags.jsp
@@ -27,7 +27,7 @@
     <c:forEach var="tagPath" items="${contentResource.valueMap['sling:taxonomy']}">
         <c:set var="tag" value="${sling:getResource(resourceResolver,tagPath)}" />
         <${itemTag} class="${config.itemClass}">
-            <a href="${config.tagPage}.html${tag.path}">
+            <a href="${config.tagPage}.html${sling:encode(tag.path,'HTML_ATTR')}">
                 <sling:encode value="${tag.valueMap['jcr:title']}" default="${tag.name}" mode="HTML" />
             </a>
         </${itemTag}>
diff --git a/reference/src/main/resources/jcr_root/apps/reference/components/pages/base/body.jsp b/reference/src/main/resources/jcr_root/apps/reference/components/pages/base/body.jsp
index 2999798d..39cbdc3b 100644
--- a/reference/src/main/resources/jcr_root/apps/reference/components/pages/base/body.jsp
+++ b/reference/src/main/resources/jcr_root/apps/reference/components/pages/base/body.jsp
@@ -16,10 +16,8 @@
  * specific language governing permissions and limitations
  * under the License.
  */ --%>
- <%@include file="/libs/sling-cms/global.jsp"%>
-
- <h1>site=${sling:adaptTo(resource,'org.apache.sling.cms.SiteManager').site}</h1>
- <c:set var="site" value="${sling:adaptTo(resource,'org.apache.sling.cms.SiteManager').site}" />
+<%@include file="/libs/sling-cms/global.jsp"%>
+<c:set var="site" value="${sling:adaptTo(resource,'org.apache.sling.cms.SiteManager').site}" />
 <body>
 	<sling:call script="/libs/sling-cms/components/editor/scripts/init.jsp" />
 	<div class="title">
@@ -35,7 +33,7 @@
 		</div>
 	</div>
 	<div class="menu">
-		<sling:include path="${site.path}/index/jcr:content/menu" resourceType="sling-cms/components/general/container" />
+		<sling:include path="${sling:encode(site.path,'HTML_ATTR')}/index/jcr:content/menu" resourceType="sling-cms/components/general/container" />
 		<a href="http://apache.org/foundation/contributing.html">
             <img border="0" alt="Support the Apache Software Foundation!" src="/static/clientlibs/reference/img/SupportApache-small.png" width="115px">
         </a>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/policy/config/config.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/policy/config/config.jsp
index 42d4c3e1..c2a659d1 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/policy/config/config.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/policy/config/config.jsp
@@ -18,7 +18,7 @@
  */ --%>
 <%@include file="/libs/sling-cms/global.jsp"%>
 <br/>
-<h3><sling:encode value="${properties['jcr:title']}" mode="HTML" /> (${resource.path})</h3>
+<h3><sling:encode value="${properties['jcr:title']}" mode="HTML" /> (${sling:encode(resource.path,'HTML_ATTR')})</h3>
 <hr/>
 <div class="panel">
     <h4 class="panel-heading">
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/scripts/policyOptions.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/scripts/policyOptions.jsp
index dd1bfea5..7dee92a5 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/scripts/policyOptions.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/scripts/policyOptions.jsp
@@ -21,5 +21,5 @@
 <sling:getParent var="parent" resource="${slingRequest.requestPathInfo.suffixResource}" level="5" />
 <c:set var="query" value="SELECT * FROM [nt:unstructured] WHERE [sling:resourceType] = 'sling-cms/components/caconfig/policy' AND ISDESCENDANTNODE([${parent.path}]) ORDER BY [jcr:title]" />
 <c:forEach var="policy" items="${sling:findResources(resourceResolver,query,'JCR-SQL2')}">
-    <option value="${policy.path}" ${policy.path == editProperties.policyPath ? 'selected' : ''}><sling:encode value="${policy.valueMap['jcr:title']}" mode="HTML" /></option>
+    <option value="${sling:encode(policy.path,'HTML_ATTR')}" ${policy.path == editProperties.policyPath ? 'selected' : ''}><sling:encode value="${policy.valueMap['jcr:title']}" mode="HTML" /></option>
 </c:forEach>
\ No newline at end of file
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/template/config/config.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/template/config/config.jsp
index 792056aa..3daf497f 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/template/config/config.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/caconfig/template/config/config.jsp
@@ -18,7 +18,7 @@
  */ --%>
 <%@include file="/libs/sling-cms/global.jsp"%>
 <br/>
-<h3><sling:encode value="${properties['jcr:title']}" mode="HTML" /> (${resource.path})</h3>
+<h3><sling:encode value="${properties['jcr:title']}" mode="HTML" /> (${sling:encode(resource.path,'HTML_ATTR')})</h3>
 <div class="panel">
     <h4 class="panel-heading"><fmt:message key="Allowed Paths" /></h4>
     <div class="panel-body p-2">
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/actions/basic/basic.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/actions/basic/basic.jsp
index 7e1a6d8a..623ed558 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/actions/basic/basic.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/actions/basic/basic.jsp
@@ -17,7 +17,7 @@
  * under the License.
  */ --%>
 <%@include file="/libs/sling-cms/global.jsp"%>
-<a class="button" ${actionConfig.valueMap.new != false ? 'target="_blank"' : ''} href="${actionConfig.valueMap.prefix}${resource.path}${actionConfig.valueMap.suffix}" title="${sling:encode(actionConfig.valueMap.title,'HTML_ATTR')}">
+<a class="button" ${actionConfig.valueMap.new != false ? 'target="_blank"' : ''} href="${actionConfig.valueMap.prefix}${sling:encode(resource.path,'HTML_ATTR')}${actionConfig.valueMap.suffix}" title="${sling:encode(actionConfig.valueMap.title,'HTML_ATTR')}">
     <span class="jam jam-${actionConfig.valueMap.icon}">
         <span class="is-sr-only">
             ${sling:encode(actionConfig.valueMap.title,'HTML')}
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/actions/modal/modal.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/actions/modal/modal.jsp
index f44edfea..fe3a01b9 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/actions/modal/modal.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/actions/modal/modal.jsp
@@ -17,7 +17,7 @@
  * under the License.
  */ --%>
 <%@include file="/libs/sling-cms/global.jsp"%>
-<a class="button Fetch-Modal" data-title="${sling:encode(actionConfig.valueMap.title,'HTML_ATTR')}" data-path="${actionConfig.valueMap.ajaxPath != null ? actionConfig.valueMap.ajaxPath : '.Main-Content form'}" href="${actionConfig.valueMap.prefix}${resource.path}${actionConfig.valueMap.suffix}" title="${sling:encode(actionConfig.valueMap.title,'HTML_ATTR')}">
+<a class="button Fetch-Modal" data-title="${sling:encode(actionConfig.valueMap.title,'HTML_ATTR')}" data-path="${actionConfig.valueMap.ajaxPath != null ? actionConfig.valueMap.ajaxPath : '.Main-Content form'}" href="${actionConfig.valueMap.prefix}${sling:encode(resource.path,'HTML_ATTR')}${actionConfig.valueMap.suffix}" title="${sling:encode(actionConfig.valueMap.title,'HTML_ATTR')}">
     <span class="jam jam-${actionConfig.valueMap.icon}">
         <span class="is-sr-only">
             ${sling:encode(actionConfig.valueMap.title,'HTML')}
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/columns/name/name.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/columns/name/name.jsp
index 0c233d6b..6b0d10a8 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/columns/name/name.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/columns/name/name.jsp
@@ -17,11 +17,11 @@
  * under the License.
  */ --%>
 <%@include file="/libs/sling-cms/global.jsp"%>
-<td data-value="${resource.path}">
+<td data-value="${sling:encode(resource.path,'HTML_ATTR')}">
     <c:set var="colValue" value="${resource.name}" />
     <c:choose>
         <c:when test="${colConfig.valueMap.link}">
-            <a class="item-link" href="${colConfig.valueMap.prefix}${resource.path}">
+            <a class="item-link" href="${colConfig.valueMap.prefix}${sling:encode(resource.path,'HTML_ATTR')}">
                 <sling:encode value="${colValue}" mode="HTML" />
             </a>
         </c:when>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/columns/publish/publish.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/columns/publish/publish.jsp
index 8a97f4f3..acdcaed3 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/columns/publish/publish.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/columns/publish/publish.jsp
@@ -22,7 +22,7 @@
     <c:choose>
         <c:when test="${publishableResource.published}">
             <fmt:message key="Content Published" var="publishedMessage" />
-            <a class="button is-success is-outlined Fetch-Modal" href="/cms/shared/unpublish.html${resource.path}" title="${publishedMessage}" data-title="Unpublish" data-path=".Main-Content form">
+            <a class="button is-success is-outlined Fetch-Modal" href="/cms/shared/unpublish.html${sling:encode(resource.path,'HTML_ATTR')}" title="${publishedMessage}" data-title="Unpublish" data-path=".Main-Content form">
                 <i class="jam jam-check">
                     <span class="is-sr-only">${publishedMessage}</span>
                 </i>
@@ -30,7 +30,7 @@
         </c:when>
         <c:otherwise>
             <fmt:message key="Content Not Published" var="notPublishedMessage" />
-            <a class="button is-warning is-outlined Fetch-Modal" href="/cms/shared/publish.html${resource.path}" title="${notPublishedMessage}" data-title="Publish" data-path=".Main-Content form">
+            <a class="button is-warning is-outlined Fetch-Modal" href="/cms/shared/publish.html${sling:encode(resource.path,'HTML_ATTR')}" title="${notPublishedMessage}" data-title="Publish" data-path=".Main-Content form">
                 <i class="jam jam-close">
                     <span class="is-sr-only">${notPublishedMessage}</span>
                 </i>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/contentgrid/contentgrid.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/contentgrid/contentgrid.jsp
index ef948709..4ff0f56c 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/contentgrid/contentgrid.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/contentgrid/contentgrid.jsp
@@ -26,7 +26,7 @@
     </c:otherwise>
 </c:choose>
 <c:set var="PAGE_SIZE" value="${60}" />
-<div class="reload-container scroll-container contentnav" data-path="${resource.path}.grid.html${sling:encode(slingRequest.requestPathInfo.suffix,'HTML_ATTR')}">
+<div class="reload-container scroll-container contentnav" data-path="${sling:encode(resource.path,'HTML_ATTR')}.grid.html${sling:encode(slingRequest.requestPathInfo.suffix,'HTML_ATTR')}">
     <div class="columns is-multiline">
         <c:forEach var="child" items="${sling:listChildren(slingRequest.requestPathInfo.suffixResource)}" varStatus="status" begin="${paginationPage * PAGE_SIZE}" end="${(paginationPage * PAGE_SIZE + PAGE_SIZE) - 1}">
             <c:set var="showCard" value="${false}" />
@@ -49,12 +49,12 @@
                             <c:set var="title" value="${child.name}" />
                         </c:otherwise>
                     </c:choose>
-                    <div class="card is-linked" title="${sling:encode(child.name,'HTML_ATTR')}" data-value="${child.path}">
+                    <div class="card is-linked" title="${sling:encode(child.name,'HTML_ATTR')}" data-value="${sling:encode(child.path,'HTML_ATTR')}">
                         <div class="card-image">
                             <figure class="image is-5by4">
                                 <c:choose>
                                     <c:when test="${child.resourceType == 'sling:File' || child.resourceType == 'nt:file'}">
-                                        <img src="/cms/file/preview.html${child.path}.transform/sling-cms-thumbnail.png" loading="lazy" alt="${child.name}">
+                                        <img src="/cms/file/preview.html${sling:encode(child.path,'HTML_ATTR')}.transform/sling-cms-thumbnail.png" loading="lazy" alt="${child.name}">
                                     </c:when>
                                     <c:when test="${child.resourceType == 'sling:Site'}">
                                         <img src="/cms/file/preview.html${branding.gridIconsBase}/site.png" loading="lazy" alt="${sling:encode(child.name, 'HTML_ATTR')}">
@@ -82,7 +82,7 @@
                                 <sling:getResource base="${resource}" path="types/${child.valueMap['jcr:primaryType']}/columns/actions" var="colConfig" />
                                 <c:forEach var="ac" items="${sling:listChildren(colConfig)}">
                                     <c:set var="actionConfig" value="${ac}" scope="request" />
-                                    <sling:include path="${child.path}" resourceType="${actionConfig.resourceType}" />
+                                    <sling:include path="${sling:encode(child.path,'HTML_ATTR')}" resourceType="${actionConfig.resourceType}" />
                                 </c:forEach>
                             </div>
                         </div>
@@ -99,7 +99,7 @@
                             <sling:adaptTo adaptable="${resourceResolver}" adaptTo="org.apache.sling.cms.publication.PublicationManager" var="publicationManager" />
                             <sling:adaptTo adaptable="${child}" adaptTo="org.apache.sling.cms.PublishableResource" var="publishableResource" />
                             <c:if test="${child.resourceType == 'sling:Site' || child.resourceType == 'sling:OrderedFolder' || child.resourceType == 'sling:Folder' || child.resourceType == 'nt:folder' || child.resourceType == 'sling:Page'}">
-                                <a href="${nameConfig.valueMap.prefix}${child.path}" class="card-footer-item item-link"><fmt:message key="Open" /></a>
+                                <a href="${nameConfig.valueMap.prefix}${sling:encode(child.path,'HTML_ATTR')}" class="card-footer-item item-link"><fmt:message key="Open" /></a>
                             </c:if>
                             <c:if test="${child.resourceType == 'sling:Page' || child.resourceType == 'sling:File' || child.resourceType == 'nt:file'}">
                                 <fmt:message key="Content Published" var="publishedMessage" />
@@ -108,20 +108,20 @@
                                 <fmt:message key="Publish" var="publishMessage" />
                                 <c:choose>
                                     <c:when test="${publishableResource.published && publicationManager.publicationMode == 'CONTENT_DISTRIBUTION'}">
-                                        <a class="Fetch-Modal card-footer-item" href="/cms/shared/publish.html${child.path}" title="${publishedMessage}" data-title="${publishMessage}" data-path=".Main-Content form">
+                                        <a class="Fetch-Modal card-footer-item" href="/cms/shared/publish.html${sling:encode(child.path,'HTML_ATTR')}" title="${publishedMessage}" data-title="${publishMessage}" data-path=".Main-Content form">
                                             <fmt:message key="Republish" />
                                         </a>
-                                        <a class="Fetch-Modal card-footer-item" href="/cms/shared/unpublish.html${child.path}" title="${publishedMessage}" data-title="${unpublishMessage}" data-path=".Main-Content form">
+                                        <a class="Fetch-Modal card-footer-item" href="/cms/shared/unpublish.html${sling:encode(child.path,'HTML_ATTR')}" title="${publishedMessage}" data-title="${unpublishMessage}" data-path=".Main-Content form">
                                             ${unpublishMessage}
                                         </a>
                                     </c:when>
                                     <c:when test="${publishableResource.published}">
-                                        <a class="Fetch-Modal card-footer-item" href="/cms/shared/unpublish.html${child.path}" title="${publishedMessage}" data-title="${unpublishMessage}" data-path=".Main-Content form">
+                                        <a class="Fetch-Modal card-footer-item" href="/cms/shared/unpublish.html${sling:encode(child.path,'HTML_ATTR')}" title="${publishedMessage}" data-title="${unpublishMessage}" data-path=".Main-Content form">
                                             ${unpublishMessage}
                                         </a>
                                     </c:when>
                                     <c:otherwise>
-                                        <a class="Fetch-Modal card-footer-item" href="/cms/shared/publish.html${child.path}" title="${notPublishedMessage}" data-title="${publishMessage}" data-path=".Main-Content form">
+                                        <a class="Fetch-Modal card-footer-item" href="/cms/shared/publish.html${sling:encode(child.path,'HTML_ATTR')}" title="${notPublishedMessage}" data-title="${publishMessage}" data-path=".Main-Content form">
                                             ${publishMessage}
                                         </a>
                                     </c:otherwise>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/contenttable/contenttable.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/contenttable/contenttable.jsp
index 02b11471..64ee4cff 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/contenttable/contenttable.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/contenttable/contenttable.jsp
@@ -26,7 +26,7 @@
     </c:otherwise>
 </c:choose>
 <c:set var="PAGE_SIZE" value="${60}" />
- <div class="reload-container table__wrapper scroll-container contentnav" data-path="${resource.path}.table.html${sling:encode(slingRequest.requestPathInfo.suffix,'HTML_ATTR')}">
+ <div class="reload-container table__wrapper scroll-container contentnav" data-path="${sling:encode(resource.path,'HTML_ATTR')}.table.html${sling:encode(slingRequest.requestPathInfo.suffix,'HTML_ATTR')}">
     <table class="table is-fullwidth is-striped sortable">
         <thead>
             <tr>
@@ -48,7 +48,7 @@
                 <c:set var="type" value="${not empty child.valueMap['jcr:primaryType'] ? child.valueMap['jcr:primaryType'] : fn:replace(child.resourceType,'/','-')}" />
                 <sling:getResource var="typeConfig" base="${resource}" path="types/${type}" />
                 <c:if test="${typeConfig != null && !fn:contains(child.name,':')}">
-                    <tr class="contentnav__item sortable__row" data-resource="${child.path}" data-type="${typeConfig.path}">
+                    <tr class="contentnav__item sortable__row" data-resource="${sling:encode(child.path,'HTML_ATTR')}" data-type="${sling:encode(typeConfig.path,'HTML_ATTR')}">
                         <td class="Cell-Static" title="# ${status.index + 1}" data-sort-value="<fmt:formatNumber pattern="0000" value="${count}" />">
                             ${count}
                         </td>
@@ -56,7 +56,7 @@
                             <c:set var="configPath" value="columns/${column.name}"/>
                             <c:set var="colConfig" value="${sling:getRelativeResource(typeConfig,configPath)}" scope="request" />
                             <c:if test="${colConfig != null}">
-                                <sling:include path="${child.path}" resourceType="${colConfig.valueMap['sling:resourceType']}" />
+                                <sling:include path="${sling:encode(child.path,'HTML_ATTR')}" resourceType="${colConfig.valueMap['sling:resourceType']}" />
                             </c:if>
                         </c:forEach>
                     </tr>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/i18ncontainer/i18ncontainer.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/i18ncontainer/i18ncontainer.jsp
index 5bbdec25..120656a2 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/i18ncontainer/i18ncontainer.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/i18ncontainer/i18ncontainer.jsp
@@ -17,7 +17,7 @@
  * under the License.
  */ --%>
  <%@include file="/libs/sling-cms/global.jsp"%>
-<div class="scroll-container reload-container" data-path="${resource.path}.html${sling:encode(slingRequest.requestPathInfo.suffix,'HTML_ATTR')}">
+<div class="scroll-container reload-container" data-path="${sling:encode(resource.path,'HTML_ATTR')}.html${sling:encode(slingRequest.requestPathInfo.suffix,'HTML_ATTR')}">
     <sling:include path="${resource.path}" resourceType="sling-cms/components/general/container" />
     <c:forEach var="language" items="${sling:listChildren(slingRequest.requestPathInfo.suffixResource)}">
         <c:if test="${firstChild == null && not empty language.valueMap['jcr:language']}">
@@ -27,7 +27,7 @@
     <nav class="level">
         <div class="level-left">
             <div class="level-item">
-                <a class="Button Fetch-Modal" data-title="Add Entry" data-path=".Main-Content form" href="/cms/i18n/entry/create.html${firstChild.path}">
+                <a class="Button Fetch-Modal" data-title="Add Entry" data-path=".Main-Content form" href="/cms/i18n/entry/create.html${sling:encode(firstChild.path,'HTML_ATTR')}">
                     <fmt:message key="+ Entry" />
                 </a>
             </div>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/includeconfig/includeconfig.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/includeconfig/includeconfig.jsp
index f62ab8ef..92a37b10 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/includeconfig/includeconfig.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/includeconfig/includeconfig.jsp
@@ -17,5 +17,5 @@
  * under the License.
  */ --%>
 <%@include file="/libs/sling-cms/global.jsp"%>
-<div class="sling-cms-include-config field" data-path="${resource.path}.html" data-source="select[name=type]">
+<div class="sling-cms-include-config field" data-path="${sling:encode(resource.path,'HTML_ATTR')}.html" data-source="select[name=type]">
 </div>
\ No newline at end of file
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/pageeditor/pageeditor.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/pageeditor/pageeditor.jsp
index b5d175cb..68d116b5 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/pageeditor/pageeditor.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/pageeditor/pageeditor.jsp
@@ -17,6 +17,6 @@
  * under the License.
  */ --%>
 <%@include file="/libs/sling-cms/global.jsp"%>
-<div class="sling-cms-editor reload-container" data-path="${resource.path}.html${sling:encode(slingRequest.requestPathInfo.suffix,'HTML_ATTR')}">
+<div class="sling-cms-editor reload-container" data-path="${sling:encode(resource.path,'HTML_ATTR')}.html${sling:encode(slingRequest.requestPathInfo.suffix,'HTML_ATTR')}">
 	<iframe class="page-wrapper-frame" src="/cms/page/pagewrapper.html${sling:encode(slingRequest.requestPathInfo.suffix,'HTML_ATTR')}" title="Page Wrapper Frame"></iframe>
 </div>
\ No newline at end of file
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/querydebug/querydebug.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/querydebug/querydebug.jsp
index 14e4612d..4900a086 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/querydebug/querydebug.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/querydebug/querydebug.jsp
@@ -42,8 +42,8 @@
             <dd>
                 <nav class="panel fixed-box">
                     <c:forEach var="result" items="${queryDebugger.results}">
-                        <a class="panel-block" href="/bin/browser.html${result.path}" target="_blank">
-                            ${result.path} [${result.resourceType}]
+                        <a class="panel-block" href="/bin/browser.html${sling:encode(result.path,'HTML_ATTR')}" target="_blank">
+                            ${sling:encode(result.path,'HTML_ATTR')} [${result.resourceType}]
                         </a>
                     </c:forEach>
                 </nav>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/searchresults/searchresults.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/searchresults/searchresults.jsp
index 489ebe6b..e4990759 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/searchresults/searchresults.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/searchresults/searchresults.jsp
@@ -50,7 +50,7 @@
                         </c:otherwise>
                     </c:choose>
                     <c:if test="${icon == 'file'}">
-                        <img src="${result.path}.transform/sling-cms-thumbnail.png" loading="lazy" alt="${sling:encode(title,'HTML_ATTR')}" />
+                        <img src="${sling:encode(result.path,'HTML_ATTR')}.transform/sling-cms-thumbnail.png" loading="lazy" alt="${sling:encode(title,'HTML_ATTR')}" />
                     </c:if>
                     <h5 title="${sling:encode(title,'HTML_ATTR')}">
                         <span class="jam jam-${icon}"></span>&nbsp;${sling:encode(title,'HTML')}
@@ -58,7 +58,7 @@
                     <small class="is-size-7">
                         <em title="${sling:encode(result.path,'HTML_ATTR')}">${sling:encode(result.path,'HTML')}</em>
                     </small><br/>
-                    <a href="#" class="button search-select-button is-pulled-right" data-path="${result.path}"><fmt:message key="Select" /></a>
+                    <a href="#" class="button search-select-button is-pulled-right" data-path="${sling:encode(result.path,'HTML_ATTR')"><fmt:message key="Select" /></a>
                     <br class="clearfix" />
                 </div>
             </div>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/startcontent/search.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/startcontent/search.jsp
index 2569c6cc..efd663fd 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/startcontent/search.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/startcontent/search.jsp
@@ -22,7 +22,7 @@
     <c:set var="results" value="${false}" />
     <c:forEach var="item" items="${startContent.relatedContent}">
         <c:set var="results" value="${true}" />
-        <a class="panel-block" title="${item.path}" href="/cms/site/content.html${item.parent.path}?resource=${item.path}">
+        <a class="panel-block" title="${sling:encode(item.path,'HTML_ATTR')}" href="/cms/site/content.html${item.parent.path}?resource=${sling:encode(item.path,'HTML_ATTR')}">
             <span class="panel-icon">
                 <c:choose>
                     <c:when test="${item.resourceType == 'sling:Page'}">
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/startcontent/startcontent.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/startcontent/startcontent.jsp
index fc9e719f..7a749e57 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/startcontent/startcontent.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/startcontent/startcontent.jsp
@@ -57,7 +57,7 @@
                 <fmt:message key="Find Content" />
             </p>
             <div class="panel-block">
-                <form method="get" class="get-form" data-target=".search-result-container" data-load="div" action="${resource.path}.search.html">
+                <form method="get" class="get-form" data-target=".search-result-container" data-load="div" action="${sling:encode(resource.path,'HTML_ATTR')}.search.html">
                     <p class="control has-icons-left">
                         <label class="is-sr-only" for="search-term"><fmt:message key="Search" /></label>
                         <input class="input is-small" type="text" name="q" id="search-term" />
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/tilecard/tilecard.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/tilecard/tilecard.jsp
index 9172df44..a5c464ea 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/tilecard/tilecard.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/cms/tilecard/tilecard.jsp
@@ -20,7 +20,7 @@
 <fmt:message key="${properties.title}" var="title" />
 <div class="tile is-parent is-3 contentnav__item">
     <div class="tile is-child">
-        <div class="card is-linked" title="${sling:encode(properties.title,'HTML_ATTR')}" data-value="${resource.path}">
+        <div class="card is-linked" title="${sling:encode(properties.title,'HTML_ATTR')}" data-value="${sling:encode(resource.path,'HTML_ATTR')}">
             <div class="card-image">
                 <figure class="image is-5by4">
                     <img src="/cms/file/preview.html${branding.gridIconsBase}${sling:encode(properties.icon,'HTML_ATTR')}" loading="lazy" alt="${sling:encode(title,'HTML_ATTR')}">
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/fields/base/base.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/fields/base/base.jsp
index a9f3246a..5fd0c719 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/fields/base/base.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/fields/base/base.jsp
@@ -53,7 +53,7 @@
         <c:set var="events" value="${events},${event.key}" />
     </c:if>
 </c:forEach>
-<div class="field" data-events="${events}" data-path="${resource.path}">
+<div class="field" data-events="${events}" data-path="${sling:encode(resource.path,'HTML_ATTR')}">
     <c:if test="${not empty properties.label}">
         <label class="label" for="${properties.name}">
             <fmt:message key="${properties.label}" var="label" />
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/fields/path/path.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/fields/path/path.jsp
index 4f186957..ffb0f06f 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/fields/path/path.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/fields/path/path.jsp
@@ -62,7 +62,7 @@
 </c:forEach>
 <c:choose>
     <c:when test="${properties.hidesearch != true}">
-        <div class="field has-addons" data-events="${events}" data-path="${resource.path}">
+        <div class="field has-addons" data-events="${events}" data-path="${sling:encode(resource.path,'HTML_ATTR')}">
           <div class="control is-expanded">
               <input class="input pathfield" type="text" id="${sling:encode(properties.name,'HTML_ATTR')}" name="${sling:encode(properties.name,'HTML_ATTR')}" value="${sling:encode(value,'HTML_ATTR')}" ${required} ${disabled} data-type="${sling:encode(properties.type,'HTML_ATTR')}" data-base="${sling:encode(properties.basePath,'HTML_ATTR')}" autocomplete="off" />
           </div>
@@ -77,7 +77,7 @@
          </div>
     </c:when>
     <c:otherwise>
-        <div class="field" data-events="${events}" data-path="${resource.path}">
+        <div class="field" data-events="${events}" data-path="${sling:encode(resource.path,'HTML_ATTR')}">
             <div class="control">
                 <input class="input pathfield" type="text" name="${sling:encode(properties.name,'HTML_ATTR')}" value="${sling:encode(value,'HTML_ATTR')}" ${required} ${disabled} data-type="${sling:encode(properties.type,'HTML_ATTR')}" data-base="${sling:encode(properties.basePath,'HTML_ATTR')}" autocomplete="off" />
             </div>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/scripts/componentConfigOptions.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/scripts/componentConfigOptions.jsp
index 069733ed..63af915e 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/scripts/componentConfigOptions.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/editor/scripts/componentConfigOptions.jsp
@@ -21,13 +21,13 @@
 <c:forEach var="component" items="${sling:findResources(resourceResolver,'SELECT * FROM [sling:Component] WHERE [componentType] IS NOT NULL ORDER BY [jcr:title]','JCR-SQL2')}">
     <c:if test="${sling:getRelativeResource(component,'config') != null && sling:getRelativeResource(component,'config').resourceType != 'sling:Folder' && sling:getRelativeResource(component,'config').resourceType != 'sling:Component'}">
         <c:choose>
-            <c:when test="${fn:startsWith(component.path,'/apps/')}">
-                <c:set var="rt" value="${fn:substringAfter(component.path,'/apps/')}" />
+            <c:when test="${fn:startsWith(sling:encode(component.path,'HTML_ATTR'),'/apps/')}">
+                <c:set var="rt" value="${fn:substringAfter(sling:encode(component.path,'HTML_ATTR'),'/apps/')}" />
             </c:when>
             <c:otherwise>
-                <c:set var="rt" value="${fn:substringAfter(component.path,'/libs/')}" />
+                <c:set var="rt" value="${fn:substringAfter(sling:encode(component.path,'HTML_ATTR'),'/libs/')}" />
             </c:otherwise>
         </c:choose>
-        <option value="${rt}" ${rt == editProperties.type ? 'selected' : ''} data-config="${component.path}/config.html"><sling:encode value="${component.valueMap['jcr:title']}" mode="HTML" /></option>
+        <option value="${rt}" ${rt == editProperties.type ? 'selected' : ''} data-config="${sling:encode(component.path,'HTML_ATTR')}/config.html"><sling:encode value="${component.valueMap['jcr:title']}" mode="HTML" /></option>
     </c:if>
 </c:forEach>
\ No newline at end of file
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/general/container/container.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/general/container/container.jsp
index 81763768..13e6c59b 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/general/container/container.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/general/container/container.jsp
@@ -33,13 +33,13 @@
     <sling:include resource="${child}" />
 </c:forEach>
 <c:if test="${cmsEditEnabled == 'true'}">
-    <div class="sling-cms-droptarget" data-create="${sling:getResource(resourceResolver, resource.path) == null}" data-path="${resource.path}" data-order="last"></div>
+    <div class="sling-cms-droptarget" data-create="${sling:getResource(resourceResolver, resource.path) == null}" data-path="${sling:encode(resource.path,'HTML_ATTR')}" data-order="last"></div>
     <div class="sling-cms-editor">
         <fmt:message key="Add Components" var="addComponentsMessage" />
         <div class="level has-background-light has-text-black-ter">
             <div class="level-left">
                 <div class="level-item">
-                    <a href="/cms/editor/add.html${resource.path}?availableTypes=${availableTypes}" class="button action-button is-small" data-sling-cms-action="add" data-sling-cms-path="${resource.path}" data-sling-cms-available-types="${availableTypes}" title="${addComponentsMessage}">
+                    <a href="/cms/editor/add.html${sling:encode(resource.path,'HTML_ATTR')}?availableTypes=${availableTypes}" class="button action-button is-small" data-sling-cms-action="add" data-sling-cms-path="${sling:encode(resource.path,'HTML_ATTR')}" data-sling-cms-available-types="${availableTypes}" title="${addComponentsMessage}">
                         &#43;
                     </a>
                 </div>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/jobs/configuration/configuration.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/jobs/configuration/configuration.jsp
index bc773c82..a3dfb242 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/jobs/configuration/configuration.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/jobs/configuration/configuration.jsp
@@ -17,5 +17,5 @@
  * under the License.
  */ --%>
 <%@include file="/libs/sling-cms/global.jsp"%>
-<div class="job-properties-container field" data-path="${resource.path}.include.html" data-source="select[name=_job]">
+<div class="job-properties-container field" data-path="${sling:encode(resource.path,'HTML_ATTR')}.include.html" data-source="select[name=_job]">
 </div>
\ No newline at end of file
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/jobs/list/list.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/jobs/list/list.jsp
index 2548717f..34d53484 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/jobs/list/list.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/jobs/list/list.jsp
@@ -17,7 +17,7 @@
  * under the License.
  */ --%>
  <%@include file="/libs/sling-cms/global.jsp"%>
- <div class="reload-container" data-path="${resource.path}.html">
+ <div class="reload-container" data-path="${sling:encode(resource.path,'HTML_ATTR')}.html">
     <table class="table is-fullwidth is-striped">
         <thead>
             <tr>
diff --git a/ui/src/main/resources/jcr_root/libs/sling-cms/components/pages/base/nav.jsp b/ui/src/main/resources/jcr_root/libs/sling-cms/components/pages/base/nav.jsp
index 4fa24943..4bb5c339 100644
--- a/ui/src/main/resources/jcr_root/libs/sling-cms/components/pages/base/nav.jsp
+++ b/ui/src/main/resources/jcr_root/libs/sling-cms/components/pages/base/nav.jsp
@@ -43,7 +43,7 @@
                 <sling:getResource path="${auth.authorizable.path}/profile" var="profile" />
                 <span class="navbar-link">
                     <c:if test="${sling:getRelativeResource(profile,'thumbnail') != null}">
-                        <img src="${profile.path}/thumbnail.transform/sling-cms-thumbnail32.png" alt="${resourceResolver.userID}" />
+                        <img src="${sling:encode(profile.path,'HTML_ATTR')}/thumbnail.transform/sling-cms-thumbnail32.png" alt="${resourceResolver.userID}" />
                     </c:if>&nbsp;
                     <sling:encode value="${profile.valueMap.name}" default="${resourceResolver.userID}" mode="HTML" />
                 </span>