You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by mr...@apache.org on 2026/10/04 04:37:45 UTC
(ofbiz-framework) branch trunk updated: Fixed: Do not evaluate a request parameter as an expression in the return-user-message from-field (OFBIZ-13640)
This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 42a05c9fa7 Fixed: Do not evaluate a request parameter as an expression in the return-user-message from-field (OFBIZ-13640)
42a05c9fa7 is described below
commit 42a05c9fa7c8e940613124dad5d858942d70c60a
Author: Mridul Pathak <mr...@gmail.com>
AuthorDate: Sat Oct 3 23:15:46 2026 +0530
Fixed: Do not evaluate a request parameter as an expression in the return-user-message from-field (OFBIZ-13640)
With return-user-message from-field in a controller, RequestHandler.setUserMessageResponseToRequest looked the field up in the combined map of the request, where the request parameters are the fallback when no attribute with that name exists, and evaluated the value as a FlexibleStringExpander, so a request parameter with the name of the field was evaluated as an expression, while a message that comes from the request through _CUSTOM_ERROR_MESSAGE_ or _CUSTOM_EVENT_MESSAGE_ is deliber [...]
The field is now read from the request attributes only, which is where the results of events and services are, so request parameters are never evaluated, and the documentation of from-field in site-conf.xsd says so. No controller delivered with OFBiz uses return-user-message.
---
framework/webapp/dtd/site-conf.xsd | 3 ++-
.../org/apache/ofbiz/webapp/control/RequestHandler.java | 16 +++++++++-------
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/framework/webapp/dtd/site-conf.xsd b/framework/webapp/dtd/site-conf.xsd
index 79a02b7986..3b36d18267 100644
--- a/framework/webapp/dtd/site-conf.xsd
+++ b/framework/webapp/dtd/site-conf.xsd
@@ -410,7 +410,8 @@ under the License.
<xs:attribute name="from-field" type="xs:string">
<xs:annotation>
<xs:documentation>
- Set from what field in context we can found the response user message. This field can contain a flexible string
+ Set from what request attribute (for example set by an event or a service) we can found the response user message.
+ This attribute can contain a flexible string, a request parameter is never used
</xs:documentation>
</xs:annotation>
</xs:attribute>
diff --git a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
index 4dc7024a25..9ed6e27eb2 100644
--- a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
+++ b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
@@ -1096,13 +1096,15 @@ public final class RequestHandler {
responseMessage.getRessource(), value,
context, UtilHttp.getLocale(request))
: value;
- } else if (responseMessage.getFromField() != null
- && context.containsKey(responseMessage.getFromField())) {
-
- // now analyze each field to found a flexible string to expand
- userMessage = FlexibleStringExpander.getInstance(
- (String) context.get(responseMessage.getFromField()))
- .expandString(context);
+ } else if (responseMessage.getFromField() != null) {
+
+ // The message is looked up in the request attributes only, where events and services put their results, and not in
+ // the request parameters, so that what the client sends is never evaluated as an expression.
+ Object fieldValue = request.getAttribute(responseMessage.getFromField());
+ if (fieldValue instanceof String) {
+ // now analyze the field to found a flexible string to expand
+ userMessage = FlexibleStringExpander.getInstance((String) fieldValue).expandString(context);
+ }
}
if (UtilValidate.isNotEmpty(userMessage)) {