You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by de...@apache.org on 2019/06/04 10:50:02 UTC
svn commit: r1860598 - in /ofbiz/ofbiz-framework/branches/release18.12: ./
themes/common-theme/template/macro/ themes/rainbowstone/template/macro/
Author: deepak
Date: Tue Jun 4 10:50:02 2019
New Revision: 1860598
URL: http://svn.apache.org/viewvc?rev=1860598&view=rev
Log:
Applied fix from trunk for revision: 1860597
===
Fixed: Html escaping missing for renderLink parameters
(OFBIZ-11090)
Parameters vlaue should be escaped to avoid any kind of corss site scripting issue.
Modified:
ofbiz/ofbiz-framework/branches/release18.12/ (props changed)
ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlFormMacroLibrary.ftl
ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlMenuMacroLibrary.ftl
ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlScreenMacroLibrary.ftl
ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/macro/HtmlMenuMacroLibrary.ftl
Propchange: ofbiz/ofbiz-framework/branches/release18.12/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Tue Jun 4 10:50:02 2019
@@ -10,4 +10,4 @@
/ofbiz/branches/json-integration-refactoring:1634077-1635900
/ofbiz/branches/multitenant20100310:921280-927264
/ofbiz/branches/release13.07:1547657
-/ofbiz/ofbiz-framework/trunk:1849931,1850015,1850023,1850530,1850647,1850685,1850694,1850711,1850914,1850918,1850921,1850948,1850953,1851006,1851013,1851068,1851074,1851130,1851158,1851200,1851224,1851247,1851254,1851315,1851319,1851350,1851353,1851433,1851500,1851805,1851885,1851998,1852503,1852587,1852818,1852882,1853070,1853109,1853691,1853745,1853750,1854306,1854457,1854683,1855078,1855083,1855287,1855371,1855403,1855488,1855492,1855497,1855501,1855898,1856212,1856405,1856455,1856459-1856460,1856484,1856598,1856610,1856613,1856617,1856667,1857088,1857099,1857152,1857154,1857173,1857180,1857213,1857392,1857617,1857692,1857813,1858035,1858092,1858180,1858250,1858256,1858275,1858319,1858347,1858432,1858444,1858483,1858523,1858539,1858965,1858980,1859033,1859055,1859087,1859255,1859263,1859268,1859543,1859571,1859576,1859691,1859694,1859698,1859704,1859708,1859735,1859796,1859800,1859807,1859871,1859877,1859882,1859909,1859911,1859915,1859931,1859968,1859972,1859981,1860082,1860141,
1860274,1860357,1860526,1860592
+/ofbiz/ofbiz-framework/trunk:1849931,1850015,1850023,1850530,1850647,1850685,1850694,1850711,1850914,1850918,1850921,1850948,1850953,1851006,1851013,1851068,1851074,1851130,1851158,1851200,1851224,1851247,1851254,1851315,1851319,1851350,1851353,1851433,1851500,1851805,1851885,1851998,1852503,1852587,1852818,1852882,1853070,1853109,1853691,1853745,1853750,1854306,1854457,1854683,1855078,1855083,1855287,1855371,1855403,1855488,1855492,1855497,1855501,1855898,1856212,1856405,1856455,1856459-1856460,1856484,1856598,1856610,1856613,1856617,1856667,1857088,1857099,1857152,1857154,1857173,1857180,1857213,1857392,1857617,1857692,1857813,1858035,1858092,1858180,1858250,1858256,1858275,1858319,1858347,1858432,1858444,1858483,1858523,1858539,1858965,1858980,1859033,1859055,1859087,1859255,1859263,1859268,1859543,1859571,1859576,1859691,1859694,1859698,1859704,1859708,1859735,1859796,1859800,1859807,1859871,1859877,1859882,1859909,1859911,1859915,1859931,1859968,1859972,1859981,1860082,1860141,
1860274,1860357,1860526,1860592,1860597
Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlFormMacroLibrary.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlFormMacroLibrary.ftl?rev=1860598&r1=1860597&r2=1860598&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlFormMacroLibrary.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlFormMacroLibrary.ftl Tue Jun 4 10:50:02 2019
@@ -682,7 +682,7 @@ Parameter: delegatorName, String, option
<#macro makeHiddenFormLinkForm actionUrl name parameters targetWindow="">
<form method="post" action="${actionUrl}" <#if targetWindow?has_content>target="${targetWindow}"</#if> onsubmit="javascript:submitFormDisableSubmits(this)" name="${name}">
<#list parameters as parameter>
- <input name="${parameter.name}" value="${parameter.value}" type="hidden"/>
+ <input name="${parameter.name}" value="${parameter.value?html}" type="hidden"/>
</#list>
</form>
</#macro>
Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlMenuMacroLibrary.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlMenuMacroLibrary.ftl?rev=1860598&r1=1860597&r2=1860598&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlMenuMacroLibrary.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlMenuMacroLibrary.ftl Tue Jun 4 10:50:02 2019
@@ -50,7 +50,7 @@ under the License.
<#if linkType?has_content && "hidden-form" == linkType>
<form method="post" action="${actionUrl}"<#if targetWindow?has_content> target="${targetWindow}"</#if> onsubmit="javascript:submitFormDisableSubmits(this)" name="${uniqueItemName}"><#rt/>
<#list parameterList as parameter>
-<input name="${parameter.name}" value="${parameter.value}" type="hidden"/><#rt/>
+<input name="${parameter.name}" value="${parameter.value?html}" type="hidden"/><#rt/>
</#list>
</form><#rt/>
</#if>
@@ -58,7 +58,7 @@ under the License.
<#local params = "{"presentation":"layer" ">
<#if parameterList?has_content>
<#list parameterList as parameter>
- <#local params += ","${parameter.name}": "${parameter.value}"">
+ <#local params += ","${parameter.name}": "${parameter.value?html}"">
</#list>
</#if>
<#local params += "}">
Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlScreenMacroLibrary.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlScreenMacroLibrary.ftl?rev=1860598&r1=1860597&r2=1860598&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlScreenMacroLibrary.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlScreenMacroLibrary.ftl Tue Jun 4 10:50:02 2019
@@ -95,7 +95,7 @@ under the License.
<#if "hidden-form" == linkType>
<form method="post" action="${actionUrl}" <#if targetWindow?has_content>target="${targetWindow}"</#if> onsubmit="javascript:submitFormDisableSubmits(this)" name="${uniqueItemName}"><#rt/>
<#list parameterList as parameter>
- <input name="${parameter.name}" value="${parameter.value}" type="hidden"/><#rt/>
+ <input name="${parameter.name}" value="${parameter.value?html}" type="hidden"/><#rt/>
</#list>
</form><#rt/>
</#if>
@@ -111,7 +111,7 @@ under the License.
<#local params = "{"presentation":"layer" ">
<#if parameterList?has_content>
<#list parameterList as parameter>
- <#local params += ","${parameter.name}": "${parameter.value}"">
+ <#local params += ","${parameter.name}": "${parameter.value?html}"">
</#list>
</#if>
<#local params += "}">
Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/macro/HtmlMenuMacroLibrary.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/macro/HtmlMenuMacroLibrary.ftl?rev=1860598&r1=1860597&r2=1860598&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/macro/HtmlMenuMacroLibrary.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/macro/HtmlMenuMacroLibrary.ftl Tue Jun 4 10:50:02 2019
@@ -23,7 +23,7 @@ under the License.
<#if linkType?has_content && "hidden-form" == linkType>
<form method="post" action="${actionUrl}"<#if targetWindow?has_content> target="${targetWindow}"</#if> onsubmit="javascript:submitFormDisableSubmits(this)" name="${uniqueItemName}"><#rt/>
<#list parameterList as parameter>
- <input name="${parameter.name}" value="${parameter.value}" type="hidden"/><#rt/>
+ <input name="${parameter.name}" value="${parameter.value?html}" type="hidden"/><#rt/>
</#list>
</form><#rt/>
</#if>
@@ -31,7 +31,7 @@ under the License.
<#local params = "{"presentation":"layer" ">
<#if parameterList?has_content>
<#list parameterList as parameter>
- <#local params += ","${parameter.name}": "${parameter.value}"">
+ <#local params += ","${parameter.name}": "${parameter.value?html}"">
</#list>
</#if>
<#local params += "}">