svn commit: r920381 - /ofbiz/branches/release09.04/framework/webapp/src/org/ofbiz/webapp/control/ControlServlet.java

[lektran]

Author: lektran
Date: Mon Mar  8 16:11:04 2010
New Revision: 920381

URL: http://svn.apache.org/viewvc?rev=920381&view=rev
Log:
Merged from trunk r920371
Properly encode any error messages before attempting to write them to the response.  I'm doing it here to avoid having to do the encoding within each app's error.jsp file, I think this should be fine though.

Modified:
    ofbiz/branches/release09.04/framework/webapp/src/org/ofbiz/webapp/control/ControlServlet.java

Modified: ofbiz/branches/release09.04/framework/webapp/src/org/ofbiz/webapp/control/ControlServlet.java
URL: http://svn.apache.org/viewvc/ofbiz/branches/release09.04/framework/webapp/src/org/ofbiz/webapp/control/ControlServlet.java?rev=920381&r1=920380&r2=920381&view=diff
==============================================================================
--- ofbiz/branches/release09.04/framework/webapp/src/org/ofbiz/webapp/control/ControlServlet.java (original)
+++ ofbiz/branches/release09.04/framework/webapp/src/org/ofbiz/webapp/control/ControlServlet.java Mon Mar  8 16:11:04 2010
@@ -32,6 +32,7 @@
 import org.apache.bsf.BSFManager;
 
 import org.ofbiz.base.util.Debug;
+import org.ofbiz.base.util.StringUtil;
 import org.ofbiz.base.util.UtilHttp;
 import org.ofbiz.base.util.UtilJ2eeCompat;
 import org.ofbiz.base.util.UtilTimer;
@@ -202,11 +203,13 @@
         } catch (RequestHandlerException e) {
             Throwable throwable = e.getNested() != null ? e.getNested() : e;
             Debug.logError(throwable, "Error in request handler: ", module);
-            request.setAttribute("_ERROR_MESSAGE_", throwable.toString());
+            StringUtil.HtmlEncoder encoder = new StringUtil.HtmlEncoder();
+            request.setAttribute("_ERROR_MESSAGE_", encoder.encode(throwable.toString()));
             errorPage = requestHandler.getDefaultErrorPage(request);
         } catch (Exception e) {
             Debug.logError(e, "Error in request handler: ", module);
-            request.setAttribute("_ERROR_MESSAGE_", e.toString());
+            StringUtil.HtmlEncoder encoder = new StringUtil.HtmlEncoder();
+            request.setAttribute("_ERROR_MESSAGE_", encoder.encode(e.toString()));
             errorPage = requestHandler.getDefaultErrorPage(request);
         }