[gatein-commits] gatein SVN: r2394 - in portal/trunk: examples/portal/war/src/main/webapp/login/jsp and 1 other directories.

[do-not-reply at jboss.org]

Author: thomas.heute at jboss.com
Date: 2010-03-30 05:58:37 -0400 (Tue, 30 Mar 2010)
New Revision: 2394

Modified:
   portal/trunk/examples/extension/war/src/main/webapp/login/jsp/login.jsp
   portal/trunk/examples/portal/war/src/main/webapp/login/jsp/login.jsp
   portal/trunk/web/portal/src/main/webapp/login/jsp/login.jsp
Log:
GTNPORTAL-725: JAAS Servlet, XSS issue
Encoding the username before displaying it back to the user


Modified: portal/trunk/examples/extension/war/src/main/webapp/login/jsp/login.jsp
===================================================================
--- portal/trunk/examples/extension/war/src/main/webapp/login/jsp/login.jsp	2010-03-30 09:18:21 UTC (rev 2393)
+++ portal/trunk/examples/extension/war/src/main/webapp/login/jsp/login.jsp	2010-03-30 09:58:37 UTC (rev 2394)
@@ -25,6 +25,7 @@
 <%@ page import="org.exoplatform.services.resources.ResourceBundleService"%>
 <%@ page import="java.util.ResourceBundle"%>
 <%@ page import="org.exoplatform.web.login.InitiateLoginServlet"%>
+<%@ page import="org.gatein.common.text.EntityEncoder"%>
 <%@ page language="java" %>
 <%@ page contentType="text/html; charset=utf-8" %>
 <%
@@ -67,6 +68,8 @@
           <%/*Begin form*/%>
           <%
             if(username.length() > 0 || password.length() > 0) {
+               EntityEncoder encoder = EntityEncoder.FULL;
+               username = encoder.encode(username);
           %>
             <font color="red">Sign in failed. Wrong username or password.</font><%}%>
           <form name="loginForm" action="<%= contextPath + "/login"%>" method="post" style="margin: 0px;">    

Modified: portal/trunk/examples/portal/war/src/main/webapp/login/jsp/login.jsp
===================================================================
--- portal/trunk/examples/portal/war/src/main/webapp/login/jsp/login.jsp	2010-03-30 09:18:21 UTC (rev 2393)
+++ portal/trunk/examples/portal/war/src/main/webapp/login/jsp/login.jsp	2010-03-30 09:58:37 UTC (rev 2394)
@@ -25,6 +25,7 @@
 <%@ page import="org.exoplatform.services.resources.ResourceBundleService"%>
 <%@ page import="java.util.ResourceBundle"%>
 <%@ page import="org.exoplatform.web.login.InitiateLoginServlet"%>
+<%@ page import="org.gatein.common.text.EntityEncoder"%>
 <%@ page language="java" %>
 <%@ page contentType="text/html; charset=utf-8" %>
 <%
@@ -67,6 +68,8 @@
           <%/*Begin form*/%>
           <%
             if(username.length() > 0 || password.length() > 0) {
+               EntityEncoder encoder = EntityEncoder.FULL;
+               username = encoder.encode(username);
           %>
             <font color="red">Sign in failed. Wrong username or password.</font><%}%>
           <form name="loginForm" action="<%= contextPath + "/login"%>" method="post" style="margin: 0px;">    

Modified: portal/trunk/web/portal/src/main/webapp/login/jsp/login.jsp
===================================================================
--- portal/trunk/web/portal/src/main/webapp/login/jsp/login.jsp	2010-03-30 09:18:21 UTC (rev 2393)
+++ portal/trunk/web/portal/src/main/webapp/login/jsp/login.jsp	2010-03-30 09:58:37 UTC (rev 2394)
@@ -25,6 +25,7 @@
 <%@ page import="org.exoplatform.services.resources.ResourceBundleService"%>
 <%@ page import="java.util.ResourceBundle"%>
 <%@ page import="org.exoplatform.web.login.InitiateLoginServlet"%>
+<%@ page import="org.gatein.common.text.EntityEncoder"%>
 <%@ page language="java" %>
 <%
   String contextPath = request.getContextPath() ;
@@ -69,6 +70,9 @@
           <%/*Begin form*/%>
           <%
             if(username.length() > 0 || password.length() > 0) {
+               EntityEncoder encoder = EntityEncoder.FULL;
+               username = encoder.encode(username);
+
           %>
           <font color="red"><%=res.getString("UILoginForm.label.SigninFail")%></font><%}%>
           <form name="loginForm" action="<%= contextPath + "/login"%>" method="post" style="margin: 0px;">
@@ -117,4 +121,4 @@
     </div>
     <span style="font-size: 11px; color: #3f3f3f; text-align: center"><%=res.getString("UILoginForm.label.Copyright")%></span>
   </body>
-</html>
\ No newline at end of file
+</html>