svn commit: r833687 - in /ofbiz/branches/release09.04: ./ applications/product/webapp/catalog/store/EditProductStoreRoles.ftl

Author: jleroux
Date: Sat Nov  7 14:38:16 2009
New Revision: 833687

URL: http://svn.apache.org/viewvc?rev=833687&view=rev
Log:
"Applied fix from trunk for revision: 833686"
------------------------------------------------------------------------
r833686 | jleroux | 2009-11-07 15:34:07 +0100 (sam. 07 nov. 2009) | 1 ligne

Fix an FTL security bug "Remove productstore role from store" reported by Willem Janssen at https://issues.apache.org/jira/browse/OFBIZ-3174 - OFBIZ-3174
------------------------------------------------------------------------


Modified:
    ofbiz/branches/release09.04/   (props changed)
    ofbiz/branches/release09.04/applications/product/webapp/catalog/store/EditProductStoreRoles.ftl

Propchange: ofbiz/branches/release09.04/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Sat Nov  7 14:38:16 2009
@@ -1 +1 @@
-/ofbiz/trunk:765933,766011,766015,766293,766307,766316,766325,766462,766522,766800,767060,767072,767093,767098-767099,767102,767123,767125,767127,767279,767287,767671,767688,767694,767822,767845,768358,768490,768550,768675,768686,768705,768811,768815,768960,769030,769500,770272,770308,770997,771073,772401,772464-772465,773076,773557,773628,773659,773697,774014,774632,774661,774995,775292,775667,776227,776594,776620,776922,777004,777020,777768,777792,777893,777947,778078,778094,778107,778273,778278,778280,778364,778374,778402,778576,778594,778628,779020,779477,779496,779639,779834,779856,779866,779873,780111,780138,780180,780199,780203,780906,780945,781201,781534,781549,781669,781680,781694,782663,783257,783266,783833,783913,783917,785123,785764,785967,786778,787126,787435-787436,787442,787520,788965,788983,788987,789329,789337,789506,789548,796769,799185,800461,800846,801023,802346,804364,805307,806127,806377,808786-808787,808792,809141,810370,810438,810465,810807,810809,810
 814,810832,810836,810878,810917,811020,811280,811297,811419,811528,811708,811714,811716,811793,811838,811860,811865,811870,812159,812182,812192,812456,812540,813126,813131,813283,813672,813702,814168,814205,814251,814349,814531,814576,814681,814731,815158,815165,815350,815687,815977,816255,816863,818030,818049,818150,818494,818500,818716,818976,819275-819276,819282,819337,821263,821270,822659,823877-823878,823883,823888,823892,824511,825181-825182,826253,827730,828971,829085,829376,829412,829416,829527,830091,830112,830366,830528,830677,830874,830880,831238,831801,832361,832698,832776,832908,833324
+/ofbiz/trunk:765933,766011,766015,766293,766307,766316,766325,766462,766522,766800,767060,767072,767093,767098-767099,767102,767123,767125,767127,767279,767287,767671,767688,767694,767822,767845,768358,768490,768550,768675,768686,768705,768811,768815,768960,769030,769500,770272,770308,770997,771073,772401,772464-772465,773076,773557,773628,773659,773697,774014,774632,774661,774995,775292,775667,776227,776594,776620,776922,777004,777020,777768,777792,777893,777947,778078,778094,778107,778273,778278,778280,778364,778374,778402,778576,778594,778628,779020,779477,779496,779639,779834,779856,779866,779873,780111,780138,780180,780199,780203,780906,780945,781201,781534,781549,781669,781680,781694,782663,783257,783266,783833,783913,783917,785123,785764,785967,786778,787126,787435-787436,787442,787520,788965,788983,788987,789329,789337,789506,789548,796769,799185,800461,800846,801023,802346,804364,805307,806127,806377,808786-808787,808792,809141,810370,810438,810465,810807,810809,810
 814,810832,810836,810878,810917,811020,811280,811297,811419,811528,811708,811714,811716,811793,811838,811860,811865,811870,812159,812182,812192,812456,812540,813126,813131,813283,813672,813702,814168,814205,814251,814349,814531,814576,814681,814731,815158,815165,815350,815687,815977,816255,816863,818030,818049,818150,818494,818500,818716,818976,819275-819276,819282,819337,821263,821270,822659,823877-823878,823883,823888,823892,824511,825181-825182,826253,827730,828971,829085,829376,829412,829416,829527,830091,830112,830366,830528,830677,830874,830880,831238,831801,832361,832698,832776,832908,833324,833686

Modified: ofbiz/branches/release09.04/applications/product/webapp/catalog/store/EditProductStoreRoles.ftl
URL: http://svn.apache.org/viewvc/ofbiz/branches/release09.04/applications/product/webapp/catalog/store/EditProductStoreRoles.ftl?rev=833687&r1=833686&r2=833687&view=diff
==============================================================================
--- ofbiz/branches/release09.04/applications/product/webapp/catalog/store/EditProductStoreRoles.ftl (original)
+++ ofbiz/branches/release09.04/applications/product/webapp/catalog/store/EditProductStoreRoles.ftl Sat Nov  7 14:38:16 2009
@@ -47,7 +47,13 @@
                     <td>&nbsp;</td>
                   <#else>
                     <td align="center">
-                      <a href="<@ofbizUrl>storeRemoveRole?productStoreId=${productStoreId}&partyId=${role.partyId}&roleTypeId=${role.roleTypeId}&fromDate=${role.fromDate}</@ofbizUrl>" class="buttontext">${uiLabelMap.CommonDelete}</a>
+                      <a href="javascript:document.storeRemoveRole_${role_index}.submit();" class="buttontext">${uiLabelMap.CommonDelete}</a>
+                      <form name="storeRemoveRole_${role_index}" method="post" action="<@ofbizUrl>storeRemoveRole</@ofbizUrl>">
+                          <input type="hidden" name="productStoreId" value="${productStoreId}"/>
+                          <input type="hidden" name="partyId" value="${role.partyId}"/>
+                          <input type="hidden" name="roleTypeId" value="${role.roleTypeId}"/>
+                          <input type="hidden" name="fromDate" value="${role.fromDate}"/>
+                      </form>                      
                     </td>
                   </#if>
                 </tr>