svn commit: r1852819 - in /ofbiz/ofbiz-framework/branches/release18.12: ./ themes/bluelight/template/Header.ftl themes/flatgrey/template/Header.ftl themes/rainbowstone/template/includes/TopAppBar.ftl themes/tomahawk/template/AppBarClose.ftl

[Deepak Dixit-5]

Author: deepak
Date: Sun Feb  3 09:36:07 2019
New Revision: 1852819

URL: http://svn.apache.org/viewvc?rev=1852819&view=rev
Log:
Applied fix from trunk for revision: 1852818
===

Fixed: Html escaping missing for portalPageId parameter of Help button
(OFBIZ-10828)
 Thanks, Niels Heinen of the Google security team for reporting the issue.

Modified:
    ofbiz/ofbiz-framework/branches/release18.12/   (props changed)
    ofbiz/ofbiz-framework/branches/release18.12/themes/bluelight/template/Header.ftl
    ofbiz/ofbiz-framework/branches/release18.12/themes/flatgrey/template/Header.ftl
    ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/includes/TopAppBar.ftl
    ofbiz/ofbiz-framework/branches/release18.12/themes/tomahawk/template/AppBarClose.ftl

Propchange: ofbiz/ofbiz-framework/branches/release18.12/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Sun Feb  3 09:36:07 2019
@@ -10,4 +10,4 @@
 /ofbiz/branches/json-integration-refactoring:1634077-1635900
 /ofbiz/branches/multitenant20100310:921280-927264
 /ofbiz/branches/release13.07:1547657
-/ofbiz/ofbiz-framework/trunk:1850015,1850023,1850530,1850647,1850685,1850694,1850711,1850914,1850918,1850921,1850948,1850953,1851006,1851013,1851068,1851074,1851130,1851158,1851200,1851224,1851247,1851254,1851315,1851319,1851350,1851353,1851433,1851500,1851805,1851885,1851998,1852503,1852587
+/ofbiz/ofbiz-framework/trunk:1850015,1850023,1850530,1850647,1850685,1850694,1850711,1850914,1850918,1850921,1850948,1850953,1851006,1851013,1851068,1851074,1851130,1851158,1851200,1851224,1851247,1851254,1851315,1851319,1851350,1851353,1851433,1851500,1851805,1851885,1851998,1852503,1852587,1852818

Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/bluelight/template/Header.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/bluelight/template/Header.ftl?rev=1852819&r1=1852818&r2=1852819&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/bluelight/template/Header.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/bluelight/template/Header.ftl Sun Feb  3 09:36:07 2019
@@ -194,7 +194,7 @@ under the License.
             <#--if webSiteId?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??-->
             <#if parameters.componentName?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??>
               <#include "component://common-theme/template/includes/HelpLink.ftl" />
-              <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${parameters.portalPageId!}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
+              <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
             </#if>
             <#if userLogin??>
               <#if "Y" == (userPreferences.COMPACT_HEADER)?default("N")>

Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/flatgrey/template/Header.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/flatgrey/template/Header.ftl?rev=1852819&r1=1852818&r2=1852819&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/flatgrey/template/Header.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/flatgrey/template/Header.ftl Sun Feb  3 09:36:07 2019
@@ -156,7 +156,7 @@ under the License.
           <#---if webSiteId?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??-->
           <#if parameters.componentName?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??>
             <#include "component://common-theme/template/includes/HelpLink.ftl" />
-            <li><a <#if pageAvail?has_content>class="alert"</#if> href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${parameters.portalPageId!}','help' ,500,500);">${uiLabelMap.CommonHelp}</a></li>
+            <li><a <#if pageAvail?has_content>class="alert"</#if> href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);">${uiLabelMap.CommonHelp}</a></li>
           </#if>
           </ul>
       </li>

Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/includes/TopAppBar.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/includes/TopAppBar.ftl?rev=1852819&r1=1852818&r2=1852819&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/includes/TopAppBar.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/includes/TopAppBar.ftl Sun Feb  3 09:36:07 2019
@@ -238,7 +238,7 @@ under the License.
         <div id="main-nav-bar-right">
             <div id="company-logo"></div>
             <#if parameters.componentName?exists && requestAttributes._CURRENT_VIEW_?exists && helpTopic?exists>
-                <a class="dark-color" title="${uiLabelMap.CommonHelp}" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${parameters.portalPageId!}','help' ,500,500);"><img class="appbar-btn-img" id="help-btn" src="/rainbowstone/images/help.svg" alt="Help"></a>
+                <a class="dark-color" title="${uiLabelMap.CommonHelp}" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);"><img class="appbar-btn-img" id="help-btn" src="/rainbowstone/images/help.svg" alt="Help"></a>
             </#if>
 
             <#include "component://rainbowstone/template/includes/Avatar.ftl"/>

Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/tomahawk/template/AppBarClose.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/tomahawk/template/AppBarClose.ftl?rev=1852819&r1=1852818&r2=1852819&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/tomahawk/template/AppBarClose.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/tomahawk/template/AppBarClose.ftl Sun Feb  3 09:36:07 2019
@@ -75,7 +75,7 @@ under the License.
       <#--if webSiteId?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??-->
       <#if parameters.componentName?? && requestAttributes._CURRENT_VIEW_?? && helpTopic??>
         <#include "component://common-theme/template/includes/HelpLink.ftl" />
-        <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${parameters.portalPageId!}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
+        <li><a class="help-link <#if pageAvail?has_content> alert</#if>" href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&amp;portalPageId=${(parameters.portalPageId!)?html}','help' ,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
       </#if>
       <li><a href="<@ofbizUrl>logout</@ofbizUrl>">${uiLabelMap.CommonLogout}</a></li>
       <li><a href="<@ofbizUrl>ListVisualThemes</@ofbizUrl>">${uiLabelMap.CommonVisualThemes}</a></li>