Secure URLs in Freemarker templates files
----------------------------------------- Key: OFBIZ-2260 URL: https://issues.apache.org/jira/browse/OFBIZ-2260 Project: OFBiz Issue Type: Improvement Components: ALL COMPONENTS Affects Versions: Release Branch 4.0, Release Branch 9.3 Reporter: Jacques Le Roux Fix For: Release Branch 4.0, Release Branch 9.3 Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Jacques Le Roux updated OFBIZ-2260: ----------------------------------- Attachment: OFBIZ-2256.patch Here is Pranay's comment about this patch {quote} Thanks Pratik, but this patch needs little rework. The forms to send hidden parameters you created having name "test" at all the places, this should be something appropriate base on the hyperlink purpose. Also there few few small things like way of giving request in action of the form. This can be improved. {quote} > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12693689#action_12693689 ] Pranay Pandey commented on OFBIZ-2260: -------------------------------------- Thanks Jacques. We needed a separate issue for this. > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12693840#action_12693840 ] Jacques Le Roux commented on OFBIZ-2260: ---------------------------------------- I commited a modified usefull snippet of Pratik's OFBIZ-2256.patch in revision 760041. Please don't use this patch anymore (only kept for history) > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Ashish Nagar updated OFBIZ-2260: -------------------------------- Attachment: OFBIZ-2260.patch This is the patch, for the URLs mentioned in OFBIZ-2256. Added few more pages, than the previous patch. The parameters that were sent as url parameters are sent as form parameters in this patch. Thanks to Pranay for bringing this task up & thanks to Pratik Khera for starting this task. Regards, -- Ashish Nagar > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12694055#action_12694055 ] Ashish Nagar edited comment on OFBIZ-2260 at 3/31/09 3:37 AM: -------------------------------------------------------------- Have improved the patch, for the URLs mentioned in OFBIZ-2256. Added few more pages, than the previous patch. The parameters that were sent as url parameters are sent as form parameters in this patch. Thanks to Pranay for bringing this task up & thanks to Pratik Khera for starting this task. Regards, -- Ashish Nagar was (Author: ashish.nagar): This is the patch, for the URLs mentioned in OFBIZ-2256. Added few more pages, than the previous patch. The parameters that were sent as url parameters are sent as form parameters in this patch. Thanks to Pranay for bringing this task up & thanks to Pratik Khera for starting this task. Regards, -- Ashish Nagar > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Jacques Le Roux reassigned OFBIZ-2260: -------------------------------------- Assignee: Jacques Le Roux > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12694182#action_12694182 ] Jacques Le Roux commented on OFBIZ-2260: ---------------------------------------- Ashish, and all, I was reviewing your patch, which seamed good so far, and then I questionned myself. You are systematically using the scheme <a href="javascript:document.(.*).submit()" class="buttontext">${(.*)}</a> which means that to work it would need javascript. Are we all agreeing about that ? I.e. OFBiz needs javascript to work ? > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12694260#action_12694260 ] David E. Jones commented on OFBIZ-2260: --------------------------------------- Yes, JavaScript is kind of the only way to do this (unless there is an image or we have a highly styled form submit button). So far all of these links use JavaScript this way, including the Form/Screen/Menu widget changes that I did (just take a look at the HTML that is generated on any of those widgets you've been working on for examples). > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12694391#action_12694391 ] Ashish Nagar commented on OFBIZ-2260: ------------------------------------- Thanks Jacques, David, for reviewing & appreciating the patch so far. Yes, I have used it using javascript, so that I had not to change the existing links to submit buttons. However, I think the CSS classes, applied on these links, can be applied on submit button as well. But there might be some change (though very small), in the layouts of both. Regards, -- Ashish Nagar > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12694406#action_12694406 ] Jacques Le Roux commented on OFBIZ-2260: ---------------------------------------- Thanks Ashish, I did not look into details yet, but this is interesting because we might want to degrade gracefully... > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12695160#action_12695160 ] CJ Horton commented on OFBIZ-2260: ---------------------------------- Here is one more as of rev. 761450 Page: https://localhost:8443/myportal/control/ManagePortalPages Link: https://localhost:8443/myportal/control/updatePortalPageColumn?portalPageId=10001&columnSeqId=00002&columnWidthPercentage=20&parentPortalPageId=MYPORTAL_NONE **problematic file is: component://common/webcommon/portal/editPortalPage.ftl** > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
fixed in revision 761526.
Thanks for reporting Hans On Thu, 2009-04-02 at 15:57 -0700, CJ Horton (JIRA) wrote: > [ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12695160#action_12695160 ] > > CJ Horton commented on OFBIZ-2260: > ---------------------------------- > > Here is one more as of rev. 761450 > > Page: > > https://localhost:8443/myportal/control/ManagePortalPages > > Link: > > https://localhost:8443/myportal/control/updatePortalPageColumn?portalPageId=10001&columnSeqId=00002&columnWidthPercentage=20&parentPortalPageId=MYPORTAL_NONE > > **problematic file is: component://common/webcommon/portal/editPortalPage.ftl** > > > > > Secure URLs in Freemarker templates files > > ----------------------------------------- > > > > Key: OFBIZ-2260 > > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > > Project: OFBiz > > Issue Type: Improvement > > Components: ALL COMPONENTS > > Affects Versions: Release Branch 4.0, Release Branch 9.3 > > Reporter: Jacques Le Roux > > Assignee: Jacques Le Roux > > Fix For: Release Branch 4.0, Release Branch 9.3 > > > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > > > > Follow OFBIZ-2256 but for FTL files only > Antwebsystems.com: Quality OFBiz services for competitive rates |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12695908#action_12695908 ] Jacques Le Roux commented on OFBIZ-2260: ---------------------------------------- Hi Ashish, I reviewed your patch and found only these errors {code} - <td colspan="4" align="right"><a href="javascript:document.addCommonToCartForm.method='post';document.addCommonToCartForm.action='<@ofbizUrl>cancelOrderItem?orderItemSeqId=${orderItem.orderItemSeqId}</@ofbizUrl>';document.addCommonToCartForm.submit()" class="buttontext">${uiLabelMap.CommonCancel}</a></td> + <td colspan="4" align="right"><a href="javascript:document.addCommonToCartForm.method='post';document.addCommonToCartForm.action='<@ofbizUrl>cancelOrderItem</@ofbizUrl>';document.addCommonToCartForm.submit()" class="buttontext">${uiLabelMap.CommonCancel}</a> + <input type="hidden" name="orderItem.orderItemSeqId" value="${orderId}"/> + </td> {code} {code} - <a href="<@ofbizUrl>readmessage?communicationEventId=${communicationEvent.communicationEventId}</@ofbizUrl>" class="buttontext">${uiLabelMap.EcommerceRead}</a> + <form name="readMessage" method="post" action="<@ofbizUrl>readmessage</@ofbizUrl>"> + <input type="hidden" name="communicationEventId" value="{communicationEvent.communicationEventId?if_exists}"> + <a href="javascript:document.readMessage.submit()" class="buttontext">${uiLabelMap.EcommerceRead}</a> + </form> <#if isSentMessage> - <a href="<@ofbizUrl>newmessage?communicationEventId=${communicationEvent.communicationEventId}</@ofbizUrl>" class="buttontext">${uiLabelMap.PartyReply}</a> + <form name="newMessage" method="post" action="<@ofbizUrl>newmessage</@ofbizUrl>"> + <input type="hidden" name="communicationEventId" value="{communicationEvent.communicationEventId?if_exists}"> + <a href="javascript:document.newMessage.submit()"class="buttontext">${uiLabelMap.PartyReply}</a> {code} I fixed them and commited in r762149 I had also to merge specialpurpose/ecommerce/webapp/ecommerce/order/orderitems.ftl by hand, not sure exactly why Thanks for your work! I keep this issue open as there are certainly more to do... > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12695965#action_12695965 ] David E. Jones commented on OFBIZ-2260: --------------------------------------- A couple of quick notes: 1. there is no need to change links that do not result in a service call... they should just stay as anchor (a) tags 2. please keep the javascript in the link simple, ie don't include things like "document.addCommonToCartForm.method='post'", that should be on the form element (ie the method="post") > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12695968#action_12695968 ] Jacques Le Roux commented on OFBIZ-2260: ---------------------------------------- Thanks David, It was not clear to me. > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12695970#action_12695970 ] Jacques Le Roux commented on OFBIZ-2260: ---------------------------------------- CJay, At r762208, I commited a fix for the last issue you reported just above. Could you please test if it really fix it ? Thanks > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12695975#action_12695975 ] Ashish Nagar commented on OFBIZ-2260: ------------------------------------- Thank you Jacques, for fixing up those issues, and appreciating my work. Will check why orderitems.ftl could not be merged. Surely this issue should be kept opened. Thanks Again, > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
In reply to this post by Nicolas Malin (Jira)
[ https://issues.apache.org/jira/browse/OFBIZ-2260?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12695977#action_12695977 ] Ashish Nagar commented on OFBIZ-2260: ------------------------------------- Thanks David, for your straight-forward comment on this. > Secure URLs in Freemarker templates files > ----------------------------------------- > > Key: OFBIZ-2260 > URL: https://issues.apache.org/jira/browse/OFBIZ-2260 > Project: OFBiz > Issue Type: Improvement > Components: ALL COMPONENTS > Affects Versions: Release Branch 4.0, Release Branch 9.3 > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Fix For: Release Branch 4.0, Release Branch 9.3 > > Attachments: OFBIZ-2256.patch, OFBIZ-2260.patch, OFBIZ-2260.patch > > > Follow OFBIZ-2256 but for FTL files only -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online. |
Free forum by Nabble | Edit this page |