You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by mo...@apache.org on 2009/05/27 12:42:21 UTC
svn commit: r779099 -
/ofbiz/trunk/applications/product/webapp/facility/shipment/EditShipmentItems.ftl
Author: mor
Date: Wed May 27 10:42:21 2009
New Revision: 779099
URL: http://svn.apache.org/viewvc?rev=779099&view=rev
Log:
Securing URLs in FTL. Patch from Pranay Pandey, part of OFBIZ-2528 (https://issues.apache.org/jira/browse/OFBIZ-2528)
Modified:
ofbiz/trunk/applications/product/webapp/facility/shipment/EditShipmentItems.ftl
Modified: ofbiz/trunk/applications/product/webapp/facility/shipment/EditShipmentItems.ftl
URL: http://svn.apache.org/viewvc/ofbiz/trunk/applications/product/webapp/facility/shipment/EditShipmentItems.ftl?rev=779099&r1=779098&r2=779099&view=diff
==============================================================================
--- ofbiz/trunk/applications/product/webapp/facility/shipment/EditShipmentItems.ftl (original)
+++ ofbiz/trunk/applications/product/webapp/facility/shipment/EditShipmentItems.ftl Wed May 27 10:42:21 2009
@@ -50,8 +50,12 @@
<td colspan="2">${(product.internalName)?if_exists} <a href="/catalog/control/EditProduct?productId=${shipmentItem.productId?if_exists}" class="buttontext">${shipmentItem.productId?if_exists}</a></td>
<td>${shipmentItem.quantity?default(" ")}</td>
<td colspan="2">${shipmentItem.shipmentContentDescription?default(" ")}</td>
- <td><a href="<@o...@ofbizUrl>" class="buttontext">${uiLabelMap.CommonDelete}</a></td>
+ <td><a href="javascript:document.deleteShipmentItem${shipmentItemData_index}.submit();" class="buttontext">${uiLabelMap.CommonDelete}</a></td>
</tr>
+ <form name="deleteShipmentItem${shipmentItemData_index}" method="post" action="<@o...@ofbizUrl>">
+ <input type="hidden" name="shipmentId" value="${shipmentId}"/>
+ <input type="hidden" name="shipmentItemSeqId" value=${shipmentItem.shipmentItemSeqId}"/>
+ </form>
<#list orderShipments as orderShipment>
<tr valign="middle"<#if alt_row> class="alternate-row"</#if>>
<td> </td>
@@ -85,12 +89,17 @@
<#else>
<td colspan="2"> </td>
</#if>
- <td><a href="<@o...@ofbizUrl>" class="buttontext">${uiLabelMap.CommonDelete}</a></td>
+ <td><a href="javascript:document.deleteShipmentItemPackageContent${shipmentItemData_index}${shipmentPackageContent_index}.submit();" class="buttontext">${uiLabelMap.CommonDelete}</a></td>
</tr>
+ <form name="deleteShipmentItemPackageContent${shipmentItemData_index}${shipmentPackageContent_index}" method="post" action="<@o...@ofbizUrl>">
+ <input type="hidden" name="shipmentId" value="${shipmentId}"/>
+ <input type="hidden" name="shipmentItemSeqId" value=${shipmentPackageContent.shipmentItemSeqId}"/>
+ <input type="hidden" name="shipmentPackageSeqId" value="${shipmentPackageContent.shipmentPackageSeqId}"/>
+ </form>
</#list>
<#if (totalQuantityToPackage > 0)>
<tr valign="middle"<#if alt_row> class="alternate-row"</#if>>
- <form action="<@o...@ofbizUrl>" name="createShipmentPackageContentForm${shipmentItemData_index}">
+ <form action="<@o...@ofbizUrl>" method="post" name="createShipmentPackageContentForm${shipmentItemData_index}">
<input type="hidden" name="shipmentId" value="${shipmentId}"/>
<input type="hidden" name="shipmentItemSeqId" value="${shipmentItem.shipmentItemSeqId}"/>
<td> </td>
@@ -119,7 +128,7 @@
<#assign alt_row = !alt_row>
</#list>
<tr>
- <form action="<@o...@ofbizUrl>" name="createShipmentItemForm">
+ <form action="<@o...@ofbizUrl>" method="post" name="createShipmentItemForm">
<input type="hidden" name="shipmentId" value="${shipmentId}"/>
<td><span class="label">${uiLabelMap.ProductNewItem}</span></td>
<td colspan="2"><span class="label">${uiLabelMap.ProductProductId}</span> <input type="text" name="productId" size="15" maxlength="20"/></td>