svn commit: r1852818 - in /ofbiz/ofbiz-framework/trunk/themes: bluelight/template/Header.ftl flatgrey/template/Header.ftl rainbowstone/template/includes/TopAppBar.ftl tomahawk/template/AppBarClose.ftl

[Deepak Dixit-5]

Author: deepak
Date: Sun Feb  3 09:34:47 2019
New Revision: 1852818

URL: http://svn.apache.org/viewvc?rev=1852818&view=rev
Log:
Fixed: Html escaping missing for portalPageId parameter of Help button
(OFBIZ-10828)
 Thanks, Niels Heinen of the Google security team for reporting the issue.

Modified:
    ofbiz/ofbiz-framework/trunk/themes/bluelight/template/Header.ftl
    ofbiz/ofbiz-framework/trunk/themes/flatgrey/template/Header.ftl
    ofbiz/ofbiz-framework/trunk/themes/rainbowstone/template/includes/TopAppBar.ftl
    ofbiz/ofbiz-framework/trunk/themes/tomahawk/template/AppBarClose.ftl

Modified: ofbiz/ofbiz-framework/trunk/themes/bluelight/template/Header.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/themes/bluelight/template/Header.ftl?rev=1852818&r1=1852817&r2=1852818&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/themes/bluelight/template/Header.ftl (original)
+++ ofbiz/ofbiz-framework/trunk/themes/bluelight/template/Header.ftl Sun Feb  3 09:34:47 2019
@@ -194,7 +194,7 @@ under the License.
             <#--if webSiteId?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??-->
             <#if parameters.componentName?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??>
               <#include "component://common-theme/template/includes/HelpLink.ftl" />
-              <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${parameters.portalPageId!}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
+              <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
             </#if>
             <#if userLogin??>
               <#if "Y" == (userPreferences.COMPACT_HEADER)?default("N")>

Modified: ofbiz/ofbiz-framework/trunk/themes/flatgrey/template/Header.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/themes/flatgrey/template/Header.ftl?rev=1852818&r1=1852817&r2=1852818&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/themes/flatgrey/template/Header.ftl (original)
+++ ofbiz/ofbiz-framework/trunk/themes/flatgrey/template/Header.ftl Sun Feb  3 09:34:47 2019
@@ -156,7 +156,7 @@ under the License.
           <#---if webSiteId?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??-->
           <#if parameters.componentName?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??>
             <#include "component://common-theme/template/includes/HelpLink.ftl" />
-            <li><a <#if pageAvail?has_content>class="alert"</#if> href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${parameters.portalPageId!}','help' ,500,500);">${uiLabelMap.CommonHelp}</a></li>
+            <li><a <#if pageAvail?has_content>class="alert"</#if> href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);">${uiLabelMap.CommonHelp}</a></li>
           </#if>
           </ul>
       </li>

Modified: ofbiz/ofbiz-framework/trunk/themes/rainbowstone/template/includes/TopAppBar.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/themes/rainbowstone/template/includes/TopAppBar.ftl?rev=1852818&r1=1852817&r2=1852818&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/themes/rainbowstone/template/includes/TopAppBar.ftl (original)
+++ ofbiz/ofbiz-framework/trunk/themes/rainbowstone/template/includes/TopAppBar.ftl Sun Feb  3 09:34:47 2019
@@ -238,7 +238,7 @@ under the License.
         <div id="main-nav-bar-right">
             <div id="company-logo"></div>
             <#if parameters.componentName?exists && requestAttributes._CURRENT_VIEW_?exists && helpTopic?exists>
-                <a class="dark-color" title="${uiLabelMap.CommonHelp}" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${parameters.portalPageId!}','help' ,500,500);"><img class="appbar-btn-img" id="help-btn" src="/rainbowstone/images/help.svg" alt="Help"></a>
+                <a class="dark-color" title="${uiLabelMap.CommonHelp}" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);"><img class="appbar-btn-img" id="help-btn" src="/rainbowstone/images/help.svg" alt="Help"></a>
             </#if>
 
             <#include "component://rainbowstone/template/includes/Avatar.ftl"/>

Modified: ofbiz/ofbiz-framework/trunk/themes/tomahawk/template/AppBarClose.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/themes/tomahawk/template/AppBarClose.ftl?rev=1852818&r1=1852817&r2=1852818&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/themes/tomahawk/template/AppBarClose.ftl (original)
+++ ofbiz/ofbiz-framework/trunk/themes/tomahawk/template/AppBarClose.ftl Sun Feb  3 09:34:47 2019
@@ -75,7 +75,7 @@ under the License.
       <#--if webSiteId?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??-->
       <#if parameters.componentName?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??>
         <#include "component://common-theme/template/includes/HelpLink.ftl" />
-        <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${parameters.portalPageId!}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
+        <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
       </#if>
       <li><a href="<@ofbizUrl>logout</@ofbizUrl>">${uiLabelMap.CommonLogout}</a></li>
       <li><a href="<@ofbizUrl>ListVisualThemes</@ofbizUrl>">${uiLabelMap.CommonVisualThemes}</a></li>