svn commit: r1860598 - in /ofbiz/ofbiz-framework/branches/release18.12: ./ themes/common-theme/template/macro/ themes/rainbowstone/template/macro/

[Deepak Dixit-5]

Author: deepak
Date: Tue Jun  4 10:50:02 2019
New Revision: 1860598

URL: http://svn.apache.org/viewvc?rev=1860598&view=rev
Log:
Applied fix from trunk for revision: 1860597
===

Fixed: Html escaping missing for renderLink parameters
(OFBIZ-11090)
Parameters vlaue should be escaped to avoid any kind of corss site scripting issue.

Modified:
    ofbiz/ofbiz-framework/branches/release18.12/   (props changed)
    ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlFormMacroLibrary.ftl
    ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlMenuMacroLibrary.ftl
    ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlScreenMacroLibrary.ftl
    ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/macro/HtmlMenuMacroLibrary.ftl

Propchange: ofbiz/ofbiz-framework/branches/release18.12/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Tue Jun  4 10:50:02 2019
@@ -10,4 +10,4 @@
 /ofbiz/branches/json-integration-refactoring:1634077-1635900
 /ofbiz/branches/multitenant20100310:921280-927264
 /ofbiz/branches/release13.07:1547657
-/ofbiz/ofbiz-framework/trunk:1849931,1850015,1850023,1850530,1850647,1850685,1850694,1850711,1850914,1850918,1850921,1850948,1850953,1851006,1851013,1851068,1851074,1851130,1851158,1851200,1851224,1851247,1851254,1851315,1851319,1851350,1851353,1851433,1851500,1851805,1851885,1851998,1852503,1852587,1852818,1852882,1853070,1853109,1853691,1853745,1853750,1854306,1854457,1854683,1855078,1855083,1855287,1855371,1855403,1855488,1855492,1855497,1855501,1855898,1856212,1856405,1856455,1856459-1856460,1856484,1856598,1856610,1856613,1856617,1856667,1857088,1857099,1857152,1857154,1857173,1857180,1857213,1857392,1857617,1857692,1857813,1858035,1858092,1858180,1858250,1858256,1858275,1858319,1858347,1858432,1858444,1858483,1858523,1858539,1858965,1858980,1859033,1859055,1859087,1859255,1859263,1859268,1859543,1859571,1859576,1859691,1859694,1859698,1859704,1859708,1859735,1859796,1859800,1859807,1859871,1859877,1859882,1859909,1859911,1859915,1859931,1859968,1859972,1859981,1860082,1860141,
 1860274,1860357,1860526,1860592
+/ofbiz/ofbiz-framework/trunk:1849931,1850015,1850023,1850530,1850647,1850685,1850694,1850711,1850914,1850918,1850921,1850948,1850953,1851006,1851013,1851068,1851074,1851130,1851158,1851200,1851224,1851247,1851254,1851315,1851319,1851350,1851353,1851433,1851500,1851805,1851885,1851998,1852503,1852587,1852818,1852882,1853070,1853109,1853691,1853745,1853750,1854306,1854457,1854683,1855078,1855083,1855287,1855371,1855403,1855488,1855492,1855497,1855501,1855898,1856212,1856405,1856455,1856459-1856460,1856484,1856598,1856610,1856613,1856617,1856667,1857088,1857099,1857152,1857154,1857173,1857180,1857213,1857392,1857617,1857692,1857813,1858035,1858092,1858180,1858250,1858256,1858275,1858319,1858347,1858432,1858444,1858483,1858523,1858539,1858965,1858980,1859033,1859055,1859087,1859255,1859263,1859268,1859543,1859571,1859576,1859691,1859694,1859698,1859704,1859708,1859735,1859796,1859800,1859807,1859871,1859877,1859882,1859909,1859911,1859915,1859931,1859968,1859972,1859981,1860082,1860141,
 1860274,1860357,1860526,1860592,1860597

Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlFormMacroLibrary.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlFormMacroLibrary.ftl?rev=1860598&r1=1860597&r2=1860598&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlFormMacroLibrary.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlFormMacroLibrary.ftl Tue Jun  4 10:50:02 2019
@@ -682,7 +682,7 @@ Parameter: delegatorName, String, option
 <#macro makeHiddenFormLinkForm actionUrl name parameters targetWindow="">
   <form method="post" action="${actionUrl}" <#if targetWindow?has_content>target="${targetWindow}"</#if> onsubmit="javascript:submitFormDisableSubmits(this)" name="${name}">
     <#list parameters as parameter>
-      <input name="${parameter.name}" value="${parameter.value}" type="hidden"/>
+      <input name="${parameter.name}" value="${parameter.value?html}" type="hidden"/>
     </#list>
   </form>
 </#macro>

Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlMenuMacroLibrary.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlMenuMacroLibrary.ftl?rev=1860598&r1=1860597&r2=1860598&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlMenuMacroLibrary.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlMenuMacroLibrary.ftl Tue Jun  4 10:50:02 2019
@@ -50,7 +50,7 @@ under the License.
   <#if linkType?has_content && "hidden-form" == linkType>
 <form method="post" action="${actionUrl}"<#if targetWindow?has_content> target="${targetWindow}"</#if> onsubmit="javascript:submitFormDisableSubmits(this)" name="${uniqueItemName}"><#rt/>
     <#list parameterList as parameter>
-<input name="${parameter.name}" value="${parameter.value}" type="hidden"/><#rt/>
+<input name="${parameter.name}" value="${parameter.value?html}" type="hidden"/><#rt/>
     </#list>
 </form><#rt/>
   </#if>
@@ -58,7 +58,7 @@ under the License.
     <#local params = "{&quot;presentation&quot;:&quot;layer&quot; ">
     <#if parameterList?has_content>
       <#list parameterList as parameter>
-        <#local params += ",&quot;${parameter.name}&quot;: &quot;${parameter.value}&quot;">
+        <#local params += ",&quot;${parameter.name}&quot;: &quot;${parameter.value?html}&quot;">
       </#list>
     </#if>
     <#local params += "}">

Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlScreenMacroLibrary.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlScreenMacroLibrary.ftl?rev=1860598&r1=1860597&r2=1860598&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlScreenMacroLibrary.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/common-theme/template/macro/HtmlScreenMacroLibrary.ftl Tue Jun  4 10:50:02 2019
@@ -95,7 +95,7 @@ under the License.
         <#if "hidden-form" == linkType>
             <form method="post" action="${actionUrl}" <#if targetWindow?has_content>target="${targetWindow}"</#if> onsubmit="javascript:submitFormDisableSubmits(this)" name="${uniqueItemName}"><#rt/>
                 <#list parameterList as parameter>
-                <input name="${parameter.name}" value="${parameter.value}" type="hidden"/><#rt/>
+                <input name="${parameter.name}" value="${parameter.value?html}" type="hidden"/><#rt/>
                 </#list>
             </form><#rt/>
         </#if>
@@ -111,7 +111,7 @@ under the License.
         <#local params = "{&quot;presentation&quot;:&quot;layer&quot; ">
         <#if parameterList?has_content>
           <#list parameterList as parameter>
-            <#local params += ",&quot;${parameter.name}&quot;: &quot;${parameter.value}&quot;">
+            <#local params += ",&quot;${parameter.name}&quot;: &quot;${parameter.value?html}&quot;">
           </#list>
         </#if>
         <#local params += "}">

Modified: ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/macro/HtmlMenuMacroLibrary.ftl
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/macro/HtmlMenuMacroLibrary.ftl?rev=1860598&r1=1860597&r2=1860598&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/macro/HtmlMenuMacroLibrary.ftl (original)
+++ ofbiz/ofbiz-framework/branches/release18.12/themes/rainbowstone/template/macro/HtmlMenuMacroLibrary.ftl Tue Jun  4 10:50:02 2019
@@ -23,7 +23,7 @@ under the License.
     <#if linkType?has_content && "hidden-form" == linkType>
     <form method="post" action="${actionUrl}"<#if targetWindow?has_content> target="${targetWindow}"</#if> onsubmit="javascript:submitFormDisableSubmits(this)" name="${uniqueItemName}"><#rt/>
         <#list parameterList as parameter>
-            <input name="${parameter.name}" value="${parameter.value}" type="hidden"/><#rt/>
+            <input name="${parameter.name}" value="${parameter.value?html}" type="hidden"/><#rt/>
         </#list>
     </form><#rt/>
     </#if>
@@ -31,7 +31,7 @@ under the License.
       <#local params = "{&quot;presentation&quot;:&quot;layer&quot; ">
       <#if parameterList?has_content>
         <#list parameterList as parameter>
-          <#local params += ",&quot;${parameter.name}&quot;: &quot;${parameter.value}&quot;">
+          <#local params += ",&quot;${parameter.name}&quot;: &quot;${parameter.value?html}&quot;">
         </#list>
       </#if>
       <#local params += "}">