In my patch, use URLEncoder.encode while rendering a link, and use StringUtil.htmlEncoder.encode while rendering a form field.
> "Value" attribute of hidden form field is overridden by same name value in context
> ----------------------------------------------------------------------------------
>
> Key: OFBIZ-5904
> URL:
https://issues.apache.org/jira/browse/OFBIZ-5904> Project: OFBiz
> Issue Type: Bug
> Components: framework
> Affects Versions: Trunk
> Reporter: Leon
> Fix For: Trunk
>
> Attachments: OFBIZ-5904.patch
>
>
> e.g.
> {quote}
> <field ...>
> <hyperlink target="..." link-type="hidden-form" >
> <parameter param-name="partyId" value="Company" />
> ...
> </hyperlink>
> </field>
> {quote}
> If there's a "partyId" key in context, then, the value set here will be overridden.
> This problem is caused by commit [r1392766|
https://fisheye6.atlassian.com/changelog/ofbiz?cs=1392766] :
> {quote}
> for (Map.Entry<String, String> parameter: parameterMap.entrySet()) {
> if (parameter.getValue() != null) {
> + String key = parameter.getKey();
> +
> writer.append("<input name=\"");
> - writer.append(parameter.getKey());
> + writer.append(key);
> writer.append("\" value=\"");
> - writer.append(parameter.getValue());
> +
> + String valueFromContext = context.containsKey(key) ?
> + context.get(key).toString() : parameter.getValue();
> + writer.append(valueFromContext);
> writer.append("\" type=\"hidden\"/>");
> }
> }
> {quote}
> In this commit, it got context value in preceding of "value" attribute. It's not reasonable.
> This defect mentioned above was caused by trying fix the problem introduced by commit [1298454|
https://fisheye6.atlassian.com/changelog/ofbiz?cs=1298454]:
> {quote}
> - return this.value.expandString(context);
> + try {
> + return URLEncoder.encode(this.value.expandString(context), Charset.forName("UTF-8").displayName());
> + } catch (UnsupportedEncodingException e) {
> + Debug.logError(e, module);
> + return this.value.expandString(context);
> + }
> {quote}
> In this commit, it called URLEncoder.encode to encode parameter value no matter where the value would be used. Actually, if use this value as the "value" attribute of html form field, it should be encoded by HtmlEncoder not URLEncoder.
Locked
