[gatein-commits] gatein SVN: r7705 - in epp/portal/tags/EPP_5_2_0_ER03: component/common/src/main/java/org/exoplatform/commons/cache/future and 40 other directories.

do-not-reply at jboss.org do-not-reply at jboss.org
Mon Oct 10 13:33:09 EDT 2011


Author: hfnukal
Date: 2011-10-10 13:33:08 -0400 (Mon, 10 Oct 2011)
New Revision: 7705

Added:
   epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/cache/future/Retrieval.java
   epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/serialization/MarshalledObject.java
   epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/utils/HTMLEntityEncoder.java
   epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/utils/TestHTMLEntityEncoder.java
   epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/utils/TestMarshalledObject.java
   epp/portal/tags/EPP_5_2_0_ER03/component/identity/src/main/java/org/exoplatform/services/organization/idm/IDMMembershipListAccess.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/validator/NotHTMLTagValidator.java
Modified:
   epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/cache/future/FutureCache.java
   epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/xml/DOMSerializer.java
   epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/cache/future/GetTestCase.java
   epp/portal/tags/EPP_5_2_0_ER03/component/identity/src/main/java/org/exoplatform/services/organization/idm/MembershipDAOImpl.java
   epp/portal/tags/EPP_5_2_0_ER03/component/web/security/src/main/java/org/exoplatform/web/login/GateinWCIController.java
   epp/portal/tags/EPP_5_2_0_ER03/component/web/server/src/main/java/org/exoplatform/upload/UploadService.java
   epp/portal/tags/EPP_5_2_0_ER03/component/web/server/src/main/java/org/exoplatform/web/handler/UploadHandler.java
   epp/portal/tags/EPP_5_2_0_ER03/distribution/jboss-epp/portletbridge/src/assemble.xml
   epp/portal/tags/EPP_5_2_0_ER03/gadgets/eXoGadgets/src/main/webapp/gadgets/rssAggregator/rssAggregator.xml
   epp/portal/tags/EPP_5_2_0_ER03/gadgets/eXoGadgets/src/main/webapp/gadgets/rssAggregator/script.js
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UIApplicationForm.java
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UICategoryForm.java
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UICategorySelector.java
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UIGadgetEditor.java
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/navigation/webui/TreeNode.java
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/organization/webui/component/FindMembershipByGroupPageList.java
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/organization/webui/component/GroupManagement.java
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/toolbar/webui/component/UIUserToolBarGroupPortlet.java
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/admintoolbar/webui/component/UIUserInfoPortlet.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/admintoolbar/webui/component/UIUserToolBarSitePortlet.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIApplicationInfo.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIApplicationOrganizer.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIGadgetInfo.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIPortletInfo.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UINavigationGrid.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UISiteManagement.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/portlet/web/src/main/webapp/groovy/portal/webui/component/UIBreadcumbsPortlet.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/portlet/web/src/main/webapp/groovy/portal/webui/component/UIPortalNavigation.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/settings-all.xml
   epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/WEB-INF/gatein-resources.xml
   epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/core/DragDrop.js
   epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/core/HTMLUtil.js
   epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/portal/PortalDragDrop.js
   epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/portal/PortalHttpRequest.js
   epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/webui/UIUpload.js
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/classes/locale/portal/webui_en.properties
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/classes/locale/portal/webui_vi.properties
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/conf/portal/portal-configuration.xml
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/application/UIApplicationList.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/application/UIPortlet.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/container/UIColumnContainer.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/container/UIContainer.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/page/UIWizardPageSetInfo.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIBreadcumbs.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIGrid.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIPopupMessages.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/core/UITree.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormDateTimeInput.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormHiddenInput.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormInputBase.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormInputInfo.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormSelectBox.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormStringInput.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormTextAreaInput.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormWYSIWYGInput.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormColorPicker.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormComboBox.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormInputSetWithAction.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/validator/ExpressionValidator.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/dashboard/src/main/resources/groovy/dashboard/webui/component/UIDashboardSelectContainer.gtmpl
   epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroup.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupMembershipSelector.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupSelector.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/account/UIGroupSelector.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/application/UIPortletForm.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/page/UIPageBrowser.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/page/UIPageSearchForm.java
   epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/portal/UIPortalForm.java
   epp/portal/tags/EPP_5_2_0_ER03/wsrp-integration/extension-war/src/main/webapp/WEB-INF/conf/wsrp/wsrp-configuration.xml
Log:
release

Modified: epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/cache/future/FutureCache.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/cache/future/FutureCache.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/cache/future/FutureCache.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -38,10 +38,10 @@
 {
 
    /** . */
-   private final Loader<K, V, C> loader;
+   final Loader<K, V, C> loader;
 
    /** . */
-   private final ConcurrentMap<K, FutureTask<V>> futureEntries;
+   private final ConcurrentMap<K, Retrieval<K, V, C>> futureEntries;
 
    /** . */
    private final Logger log = LoggerFactory.getLogger(FutureCache.class);
@@ -49,7 +49,7 @@
    public FutureCache(Loader<K, V, C> loader)
    {
       this.loader = loader;
-      this.futureEntries = new ConcurrentHashMap<K, FutureTask<V>>();
+      this.futureEntries = new ConcurrentHashMap<K, Retrieval<K, V, C>>();
    }
 
    protected abstract V get(K key);
@@ -75,65 +75,67 @@
       if (value == null)
       {
          // Create our future
-         FutureTask<V> future = new FutureTask<V>(new Callable<V>()
-         {
-            public V call() throws Exception
-            {
-               // Retrieve the value from the loader
-               V value = loader.retrieve(context, key);
+         Retrieval<K, V, C> retrieval = new Retrieval<K, V, C>(context, key, this);
 
-               //
-               if (value != null)
-               {
-                  // Cache it, it is made available to other threads (unless someone removes it)
-                  put(key, value);
-
-                  // Return value
-                  return value;
-               }
-               else
-               {
-                  return null;
-               }
-            }
-         });
-
          // This boolean means we inserted in the local
          boolean inserted = true;
 
          //
          try
          {
-            FutureTask<V> phantom = futureEntries.putIfAbsent(key, future);
+            Retrieval<K, V, C> phantom = futureEntries.putIfAbsent(key, retrieval);
 
             // Use the value that could have been inserted by another thread
             if (phantom != null)
             {
-               future = phantom;
+               retrieval = phantom;
                inserted = false;
             }
             else
             {
-               future.run();
+               try
+               {
+                  retrieval.current = Thread.currentThread();
+                  retrieval.future.run();
+               }
+               catch (Exception e)
+               {
+                  log.error("Retrieval of resource " + key + " threw an exception", e);
+               }
+               finally
+               {
+                  retrieval.current = null;
+               }
             }
 
             // Returns the value
-            value = future.get();
+            if (retrieval.current == Thread.currentThread())
+            {
+               throw new IllegalStateException("Reentrancy detected when obtaining key " + key + " with context " + context + " detected");
+            }
+            else
+            {
+               try
+               {
+                  value = retrieval.future.get();
+               }
+               catch (ExecutionException e)
+               {
+                  log.error("Computing of resource " + key + " threw an exception", e.getCause());
+               }
+               catch (InterruptedException e)
+               {
+                  // We should handle interruped exception in some manner
+                  log.error("Retrieval of resource " + key + " threw an exception", e);
+               }
+            }
          }
-         catch (ExecutionException e)
-         {
-            log.error("Computing of resource " + key + " threw an exception", e.getCause());
-         }
-         catch (Exception e)
-         {
-            log.error("Retrieval of resource " + key + " threw an exception", e);
-         }
          finally
          {
             // Clean up the per key map but only if our insertion succeeded and with our future
             if (inserted)
             {
-               futureEntries.remove(key, future);
+               futureEntries.remove(key, retrieval);
             }
          }
       }

Added: epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/cache/future/Retrieval.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/cache/future/Retrieval.java	                        (rev 0)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/cache/future/Retrieval.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -0,0 +1,53 @@
+package org.exoplatform.commons.cache.future;
+
+import java.util.concurrent.Callable;
+import java.util.concurrent.FutureTask;
+
+/** @author <a href="mailto:julien.viet at exoplatform.com">Julien Viet</a> */
+class Retrieval<K, V, C> implements Callable<V>
+{
+
+   /** . */
+   private final C context;
+
+   /** . */
+   private final K key;
+
+   /** . */
+   private final FutureCache<K, V, C> cache;
+
+   /** . */
+   final FutureTask<V> future;
+
+   /** Avoid reentrancy. */
+   transient Thread current;
+
+   public Retrieval(C context, K key, FutureCache<K, V, C> cache)
+   {
+      this.key = key;
+      this.context = context;
+      this.future = new FutureTask<V>(this);
+      this.cache = cache;
+      this.current = null;
+   }
+
+   public V call() throws Exception
+   {
+      // Retrieve the value from the loader
+      V value = cache.loader.retrieve(context, key);
+
+      //
+      if (value != null)
+      {
+         // Cache it, it is made available to other threads (unless someone removes it)
+         cache.put(key, value);
+
+         // Return value
+         return value;
+      }
+      else
+      {
+         return null;
+      }
+   }
+}

Added: epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/serialization/MarshalledObject.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/serialization/MarshalledObject.java	                        (rev 0)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/serialization/MarshalledObject.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2011 eXo Platform SAS.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.exoplatform.commons.serialization;
+
+import org.gatein.common.io.IOTools;
+import org.gatein.common.io.UndeclaredIOException;
+
+import java.io.IOException;
+import java.io.Serializable;
+import java.lang.reflect.UndeclaredThrowableException;
+import java.util.Arrays;
+
+/**
+ * A simple marshalled object that retain the state of an object as a bytes.
+ *
+ * @author <a href="mailto:julien.viet at exoplatform.com">Julien Viet</a>
+ */
+public class MarshalledObject<S extends Serializable>
+{
+
+   public static <S extends Serializable> MarshalledObject<S> marshall(S serializable) throws NullPointerException
+   {
+      if (serializable == null)
+      {
+         throw new NullPointerException("Cannot marshall null");
+      }
+      try
+      {
+         byte[] bytes = IOTools.serialize(serializable);
+         return new MarshalledObject<S>(serializable.getClass().getClassLoader(), bytes);
+      }
+      catch (IOException e)
+      {
+         throw new UndeclaredIOException(e);
+      }
+   }
+
+   /** . */
+   private final ClassLoader loader;
+
+   /** . */
+   private final byte[] state;
+
+   private MarshalledObject(ClassLoader loader, byte[] state)
+   {
+      this.loader = loader;
+      this.state = state;
+   }
+
+   @Override
+   public boolean equals(Object obj)
+   {
+      if (obj == this)
+      {
+         return true;
+      }
+      if (obj instanceof MarshalledObject)
+      {
+         MarshalledObject<?> that = (MarshalledObject<?>)obj;
+         return Arrays.equals(state, that.state);
+      }
+      return false;
+   }
+
+   @Override
+   public int hashCode()
+   {
+      return Arrays.hashCode(state);
+   }
+
+   public S unmarshall() throws UndeclaredThrowableException
+   {
+      try
+      {
+         return (S)IOTools.unserialize(state, loader);
+      }
+      catch (IOException e)
+      {
+         throw new UndeclaredIOException(e);
+      }
+      catch (ClassNotFoundException e)
+      {
+         throw new UndeclaredThrowableException(e);
+      }
+   }
+}

Added: epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/utils/HTMLEntityEncoder.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/utils/HTMLEntityEncoder.java	                        (rev 0)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/utils/HTMLEntityEncoder.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2011 eXo Platform SAS.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.exoplatform.commons.utils;
+
+import org.gatein.common.io.WriterCharWriter;
+import org.gatein.common.text.CharWriter;
+import org.gatein.common.text.EncodingException;
+import org.gatein.common.text.EntityEncoder;
+import org.gatein.common.util.ParameterValidation;
+
+import java.io.StringWriter;
+import java.io.Writer;
+
+/**
+ * This encoder provides a few methods to encode the String to its HTML entity representation.
+ * 
+ * @author <a href="trongtt at gmail.com">Trong Tran</a>
+ * @version $Revision$
+ */
+public class HTMLEntityEncoder extends EntityEncoder
+{
+   private static volatile HTMLEntityEncoder singletonInstance;
+
+   public static HTMLEntityEncoder getInstance()
+   {
+      if (singletonInstance == null)
+      {
+         synchronized (HTMLEntityEncoder.class)
+         {
+            if (singletonInstance == null)
+            {
+               singletonInstance = new HTMLEntityEncoder();
+            }
+         }
+      }
+      return singletonInstance;
+   }
+   
+   /** . */
+   private final String[] hexToEntity = buildHexEntityNumberArray();
+
+   /**
+    * Character set that are immune from encoding in HTML
+    */
+   private static final char[] IMMUNE_HTML = { ',', '.', '-', '_', ' ' };
+   
+   /**
+    * Character set that are immune from encoding in HTML Attribute
+    */
+   private static final char[] IMMUNE_HTMLATTR = { ',', '.', '-', '_' };
+
+   /**
+    * Encode data for use in HTML
+    * 
+    * @param input the string to encode for HTML
+    * @return input encoded for HTML
+    */
+   public String encodeHTML(String input)
+   {
+      return encode(input, IMMUNE_HTML);
+   }
+
+   /**
+    * Encode data for use in HTML attributes.
+    * 
+    * @param input the string to encode for a HTML attribute
+    * @return input encoded for use as value of a HTML attribute
+    */
+   public String encodeHTMLAttribute(String input)
+   {
+      return encode(input, IMMUNE_HTMLATTR);
+   }
+
+   @Override
+   public void safeEncode(char[] chars, int off, int len, CharWriter writer) throws EncodingException
+   {
+      safeEncode(chars, off, len, writer, IMMUNE_HTML);
+   }
+   
+   /**
+    * @param chars the array to encode
+    * @param off the offset in the chars array
+    * @param len the length of chars to encode
+    * @param writer the writer to use
+    * @param immune the characters array are immune from encoding
+    * @throws EncodingException
+    */
+   private void safeEncode(char[] chars, int off, int len, CharWriter writer, char[] immune) throws EncodingException
+   {
+
+      // The index of the last copied char
+      int previous = off;
+
+      //
+      int to = off + len;
+
+      // Perform lookup char by char
+      for (int current = off; current < to; current++)
+      {
+         char c = chars[current];
+
+         // Lookup
+         if (isImmutable(immune, c))
+         {
+            continue;
+         }
+
+         String replacement;
+
+         String hex;
+
+         // Do we have a replacement
+         if ((replacement = lookupEntityName(c)) != null)
+         {
+            // We lazy create the result
+
+            // Append the previous chars if any
+            writer.append(chars, previous, current - previous);
+
+            // Append the replaced entity
+            writer.append('&').append(replacement).append(';');
+
+            // Update the previous pointer
+            previous = current + 1;
+         }
+         else if ((hex = lookupHexEntityNumber(c)) != null)
+         {
+            // We lazy create the result
+
+            // Append the previous chars if any
+            writer.append(chars, previous, current - previous);
+
+            // Append the replaced entity
+            writer.append("&#x").append(hex).append(';');
+
+            // Update the previous pointer
+            previous = current + 1;
+         }
+      }
+
+      //
+      writer.append(chars, previous, chars.length - previous);
+   }
+
+   public final String lookupEntityName(char c)
+   {
+      return lookup(c);
+   }
+
+   public final String lookupHexEntityNumber(char c)
+   {
+      if (c < 0xFF)
+      {
+         return hexToEntity[c];
+      }
+
+      return Integer.toHexString(c);
+   }
+
+   private boolean isImmutable(char[] array, char c)
+   {
+      for (char ch : array)
+      {
+         if (c == ch)
+         {
+            return true;
+         }
+      }
+      return false;
+   }
+
+   private String encode(String input, char[] immutable)
+   {
+      ParameterValidation.throwIllegalArgExceptionIfNull(input, "String");
+
+      Writer sw = new StringWriter();
+      CharWriter charWriter = new WriterCharWriter(sw);
+      safeEncode(input.toCharArray(), 0, input.length(), charWriter, immutable);
+      return sw.toString();
+   }
+
+   /**
+    * Build an array to store the hex string for characters to be encoded.
+    * If the character shouldn't be encoded, then store null.
+    * 
+    * @return An array containing characters in hex string that are to be encoded.
+    */
+   private String[] buildHexEntityNumberArray()
+   {
+      String[] array = new String[256];
+      
+      for (char c = 0; c < 0xFF; c++)
+      {
+         if (c >= 0x30 && c <= 0x39 || c >= 0x41 && c <= 0x5A || c >= 0x61 && c <= 0x7A)
+         {
+            array[c] = null;
+         }
+         else
+         {
+            array[c] = Integer.toHexString(c);
+         }
+      }
+      
+      return array;
+   }
+}

Modified: epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/xml/DOMSerializer.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/xml/DOMSerializer.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/common/src/main/java/org/exoplatform/commons/xml/DOMSerializer.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,6 +19,7 @@
 
 package org.exoplatform.commons.xml;
 
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 import org.gatein.common.logging.Logger;
 import org.gatein.common.logging.LoggerFactory;
 import org.w3c.dom.Attr;
@@ -28,12 +29,12 @@
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
 
-import javax.xml.stream.FactoryConfigurationError;
+import java.io.IOException;
+import java.io.Writer;
+
 import javax.xml.stream.XMLOutputFactory;
 import javax.xml.stream.XMLStreamException;
 import javax.xml.stream.XMLStreamWriter;
-import java.io.IOException;
-import java.io.Writer;
 
 /**
  * An high performance and custom DOM serializer based on stax {@link XMLStreamWriter}.
@@ -159,4 +160,26 @@
          writer.writeEndElement();
       }
    }
+   
+   private static void writeTextData(XMLStreamWriter writer, String data) throws XMLStreamException
+   {
+      StringBuilder builder = new StringBuilder();
+      
+      for(int i = 0; i < data.length(); i++)
+      {
+         char c = data.charAt(i);
+         String encodedValue = HTMLEntityEncoder.getInstance().lookupEntityName(c);
+         
+         if(encodedValue == null)
+         {
+            builder.append(c);
+         }
+         else
+         {
+            builder.append(encodedValue);
+         }
+      }
+      
+      writer.writeCharacters(builder.toString());
+   }
 }

Modified: epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/cache/future/GetTestCase.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/cache/future/GetTestCase.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/cache/future/GetTestCase.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -23,6 +23,7 @@
 import junit.framework.TestCase;
 
 import java.util.concurrent.Callable;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 /**
  * @author <a href="mailto:julien.viet at exoplatform.com">Julien Viet</a>
@@ -68,4 +69,32 @@
       }, "foo"));
       Assert.assertFalse(futureCache.data.containsKey("foo"));
    }
+
+   public void testReentrancy()
+   {
+      final FutureMap<Callable<String>> futureCache = new FutureMap<Callable<String>>(new StringLoader());
+      String res = futureCache.get(new Callable<String>()
+      {
+         public String call() throws Exception
+         {
+            try
+            {
+               futureCache.get(new Callable<String>()
+               {
+                  public String call() throws Exception
+                  {
+                     // Should not go there
+                     throw new AssertionError();
+                  }
+               }, "foo");
+               return "fail";
+            }
+            catch (IllegalStateException expected)
+            {
+               return "pass";
+            }
+         }
+      }, "foo");
+      assertEquals("pass", res);
+   }
 }

Added: epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/utils/TestHTMLEntityEncoder.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/utils/TestHTMLEntityEncoder.java	                        (rev 0)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/utils/TestHTMLEntityEncoder.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -0,0 +1,57 @@
+/**
+ * Copyright (C) 2011 eXo Platform SAS.
+ * 
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ * 
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.exoplatform.commons.utils;
+
+import junit.framework.TestCase;
+
+/**
+ * @author <a href="trongtt at gmail.com">Trong Tran</a>
+ * @version $Revision$
+ */
+public class TestHTMLEntityEncoder extends TestCase
+{
+   private HTMLEntityEncoder htmlEncoder = HTMLEntityEncoder.getInstance();
+
+   public void testHTMLEncoding()
+   {
+      assertEquals("&lt;h1&gt;HELLO WORLD&lt;&#x2f;h1&gt;", htmlEncoder.encode("<h1>HELLO WORLD</h1>"));
+      assertEquals("&lt;h1&gt;HELLO WORLD&lt;&#x2f;h1&gt;", htmlEncoder.encodeHTML("<h1>HELLO WORLD</h1>"));
+      
+      assertEquals("alert&#x28;&#x27;HELLO WORLD&#x27;&#x29;", htmlEncoder.encode("alert('HELLO WORLD')"));
+      assertEquals("alert&#x28;&#x27;HELLO WORLD&#x27;&#x29;", htmlEncoder.encodeHTML("alert('HELLO WORLD')"));
+
+      assertEquals(
+         "&lt;a href&#x3d;&quot;http&#x3a;&#x2f;&#x2f;example.com&#x2f;&#x3f;name1&#x3d;value1&amp;name2&#x3d;value2&amp;name3&#x3d;a&#x2b;b&quot;&gt;link&lt;&#x2f;a&gt;",
+         htmlEncoder.encode("<a href=\"http://example.com/?name1=value1&name2=value2&name3=a+b\">link</a>"));
+      assertEquals(
+         "&lt;a href&#x3d;&quot;http&#x3a;&#x2f;&#x2f;example.com&#x2f;&#x3f;name1&#x3d;value1&amp;name2&#x3d;value2&amp;name3&#x3d;a&#x2b;b&quot;&gt;link&lt;&#x2f;a&gt;",
+         htmlEncoder.encodeHTML("<a href=\"http://example.com/?name1=value1&name2=value2&name3=a+b\">link</a>"));
+   }
+   
+   public void testHTMLAttributeEncoding()
+   {
+      assertEquals("&lt;h1&gt;HELLO&#x20;WORLD&lt;&#x2f;h1&gt;", htmlEncoder.encodeHTMLAttribute("<h1>HELLO WORLD</h1>"));
+      
+      assertEquals("alert&#x28;&#x27;HELLO&#x20;WORLD&#x27;&#x29;", htmlEncoder.encodeHTMLAttribute("alert('HELLO WORLD')"));
+      
+      assertEquals(
+         "&lt;a&#x20;href&#x3d;&quot;http&#x3a;&#x2f;&#x2f;example.com&#x2f;&#x3f;name1&#x3d;value1&amp;name2&#x3d;value2&amp;name3&#x3d;a&#x2b;b&quot;&gt;link&lt;&#x2f;a&gt;",
+         htmlEncoder.encodeHTMLAttribute("<a href=\"http://example.com/?name1=value1&name2=value2&name3=a+b\">link</a>"));
+   }
+}

Added: epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/utils/TestMarshalledObject.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/utils/TestMarshalledObject.java	                        (rev 0)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/common/src/test/java/org/exoplatform/commons/utils/TestMarshalledObject.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -0,0 +1,72 @@
+/**
+ * Copyright (C) 2009 eXo Platform SAS.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+
+package org.exoplatform.commons.utils;
+
+import org.exoplatform.commons.serialization.MarshalledObject;
+import org.exoplatform.component.test.AbstractGateInTest;
+
+/** @author <a href="mailto:julien.viet at exoplatform.com">Julien Viet</a> */
+public class TestMarshalledObject extends AbstractGateInTest
+{
+
+   public void testSerialization()
+   {
+      String from = "foo";
+      MarshalledObject<String> marshalled = MarshalledObject.marshall(from);
+      String to = marshalled.unmarshall();
+      assertEquals(to, from);
+   }
+
+   public void testNPE()
+   {
+      try
+      {
+         MarshalledObject.marshall(null);
+         fail();
+      }
+      catch (NullPointerException e)
+      {
+      }
+   }
+
+   public void testHashCode()
+   {
+      MarshalledObject<String> marshalled1 = MarshalledObject.marshall("foo");
+      assertEquals(marshalled1.hashCode(), marshalled1.hashCode());
+      MarshalledObject<String> marshalled2 = MarshalledObject.marshall("foo");
+      assertEquals(marshalled1.hashCode(), marshalled2.hashCode());
+      assertEquals(marshalled2.hashCode(), marshalled1.hashCode());
+      MarshalledObject<String> marshalled3 = MarshalledObject.marshall("bar");
+      assertNotSame(marshalled1.hashCode(), marshalled3.hashCode());
+      assertNotSame(marshalled3.hashCode(), marshalled1.hashCode());
+   }
+
+   public void testEquals()
+   {
+      MarshalledObject<String> marshalled1 = MarshalledObject.marshall("foo");
+      assertTrue(marshalled1.equals(marshalled1));
+      MarshalledObject<String> marshalled2 = MarshalledObject.marshall("foo");
+      assertTrue(marshalled1.equals(marshalled2));
+      assertTrue(marshalled2.equals(marshalled1));
+      MarshalledObject<String> marshalled3 = MarshalledObject.marshall("bar");
+      assertFalse(marshalled1.equals(marshalled3));
+      assertFalse(marshalled3.equals(marshalled1));
+   }
+}

Added: epp/portal/tags/EPP_5_2_0_ER03/component/identity/src/main/java/org/exoplatform/services/organization/idm/IDMMembershipListAccess.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/identity/src/main/java/org/exoplatform/services/organization/idm/IDMMembershipListAccess.java	                        (rev 0)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/identity/src/main/java/org/exoplatform/services/organization/idm/IDMMembershipListAccess.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -0,0 +1,186 @@
+/**
+* Copyright (C) 2009 eXo Platform SAS.
+*
+* This is free software; you can redistribute it and/or modify it
+* under the terms of the GNU Lesser General Public License as
+* published by the Free Software Foundation; either version 2.1 of
+* the License, or (at your option) any later version.
+*
+* This software is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+* Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public
+* License along with this software; if not, write to the Free
+* Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+* 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+*/
+
+package org.exoplatform.services.organization.idm;
+
+import org.exoplatform.commons.utils.ListAccess;
+import org.exoplatform.container.PortalContainer;
+import org.exoplatform.services.organization.Membership;
+import org.exoplatform.services.organization.OrganizationService;
+import org.exoplatform.services.organization.User;
+import org.exoplatform.services.organization.impl.GroupImpl;
+import org.exoplatform.services.organization.impl.UserImpl;
+import org.gatein.common.logging.LogLevel;
+import org.gatein.common.logging.Logger;
+import org.gatein.common.logging.LoggerFactory;
+import org.picketlink.idm.api.Group;
+import org.picketlink.idm.api.IdentitySearchCriteria;
+import org.picketlink.idm.api.Role;
+import org.picketlink.idm.api.SortOrder;
+import org.picketlink.idm.api.query.UserQuery;
+import org.picketlink.idm.impl.api.IdentitySearchCriteriaImpl;
+
+import java.io.Serializable;
+import java.util.LinkedList;
+import java.util.List;
+
+/*
+* @author <a href="mailto:boleslaw.dawidowicz at redhat.com">Boleslaw Dawidowicz</a>
+*/
+public class IDMMembershipListAccess implements ListAccess<Membership>, Serializable
+{
+   private static Logger log = LoggerFactory.getLogger(IDMMembershipListAccess.class);
+
+   private final Group group;
+   
+   private final org.picketlink.idm.api.User user;
+
+   private int size = -1;
+
+   public IDMMembershipListAccess(Group group)
+   {
+      this.group = group;
+      this.user = null;
+   }
+
+   public IDMMembershipListAccess(org.picketlink.idm.api.User user)
+   {
+      this.group = null;
+      this.user = user;
+   }
+
+   public Membership[] load(int index, int length) throws Exception, IllegalArgumentException
+   {
+      if (log.isTraceEnabled())
+      {
+         Tools.logMethodIn(
+            log,
+            LogLevel.TRACE,
+            "load",
+            new Object[]{
+               "index", index,
+               "length", length
+            }
+         );
+      }
+
+      IdentitySearchCriteria crit = new IdentitySearchCriteriaImpl().page(index, length);
+      crit.sort(SortOrder.ASCENDING);
+
+
+      List<Role> roles = null;
+
+      if (group != null)
+      {
+         roles = new LinkedList<Role>(getIDMService().getIdentitySession().getRoleManager().findRoles(group, null, crit));
+      }
+      else if (user != null)
+      {
+         roles = new LinkedList<Role>(getIDMService().getIdentitySession().getRoleManager().findRoles(user, null, crit));
+      }
+
+      Membership[] memberships = new Membership[roles.size()];
+
+      for (int i = 0; i < roles.size(); i++)
+      {
+         
+         Role role = roles.get(i);
+         
+         org.exoplatform.services.organization.Group exoGroup = 
+            ((GroupDAOImpl)getOrganizationService().getGroupHandler()).convertGroup(role.getGroup());
+         
+         MembershipImpl memb = new MembershipImpl();
+         memb.setGroupId(exoGroup.getId());
+         memb.setUserName(role.getUser().getId());
+         memb.setMembershipType(role.getRoleType().getName());
+         
+         memberships[i] = memb;
+      }
+
+      if (log.isTraceEnabled())
+      {
+        Tools.logMethodOut(
+            log,
+            LogLevel.TRACE,
+            "load",
+            memberships
+         );
+      }
+
+      return memberships;
+   }
+
+   public int getSize() throws Exception
+   {
+      if (log.isTraceEnabled())
+      {
+         Tools.logMethodIn(
+            log,
+            LogLevel.TRACE,
+            "getSize",
+            null
+         );
+      }
+
+      int result = 0;
+
+      if (size < 0)
+      {
+         if (group != null && user == null)
+         {
+            result = getIDMService().getIdentitySession().getRoleManager().getRolesCount(group, null, null);
+         }
+         else if (group == null && user != null)
+         {
+            result = getIDMService().getIdentitySession().getRoleManager().getRolesCount(user, null, null);
+         }
+
+         size = result;
+      }
+      else
+      {
+         result = size;
+      }
+
+      if (log.isTraceEnabled())
+      {
+         Tools.logMethodOut(
+            log,
+            LogLevel.TRACE,
+            "getSize",
+            result
+         );
+      }
+
+      return result;
+
+   }
+
+   PicketLinkIDMService getIDMService()
+   {
+      return (PicketLinkIDMService)
+         PortalContainer.getInstance().getComponentInstanceOfType(PicketLinkIDMService.class);
+   }
+
+   PicketLinkIDMOrganizationServiceImpl getOrganizationService()
+   {
+      return (PicketLinkIDMOrganizationServiceImpl)
+         PortalContainer.getInstance().getComponentInstanceOfType(OrganizationService.class);
+   }
+}

Modified: epp/portal/tags/EPP_5_2_0_ER03/component/identity/src/main/java/org/exoplatform/services/organization/idm/MembershipDAOImpl.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/identity/src/main/java/org/exoplatform/services/organization/idm/MembershipDAOImpl.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/identity/src/main/java/org/exoplatform/services/organization/idm/MembershipDAOImpl.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -763,8 +763,19 @@
 
       return result;
    }
+   
+   public ListAccess<Membership> findAllMembershipsByUser(User user) throws Exception
+   {
+      org.picketlink.idm.api.User gtnUser = service_.getIdentitySession().getPersistenceManager().findUser(user.getUserName());
+      
+      if (gtnUser == null)
+      {
+         log.log(LogLevel.ERROR, "Internal ERROR. Cannot obtain user: " + user.getUserName());
+         return new ListAccessImpl(Membership.class, Collections.emptyList());
+      }
+      return new IDMMembershipListAccess(gtnUser);
+   }
 
-
    public Collection findMembershipsByGroup(Group group) throws Exception
    {
       return findMembershipsByGroupId(group.getId());
@@ -772,7 +783,20 @@
 
    public ListAccess<Membership> findAllMembershipsByGroup(Group group) throws Exception
    {
-      return new ListAccessImpl(Membership.class, (List)findMembershipsByGroup(group));
+      String plGroupName = getPLIDMGroupName(getGroupNameFromId(group.getId()));
+      
+      String gid =
+         getIdentitySession().getPersistenceManager().
+            createGroupKey(plGroupName, getGroupTypeFromId(group.getId()));
+      
+      org.picketlink.idm.api.Group gtnGroup = service_.getIdentitySession().getPersistenceManager().findGroupByKey(gid);
+
+      if (gtnGroup == null)
+      {
+         log.log(LogLevel.ERROR, "Internal ERROR. Cannot obtain group: " + group.getId());
+         return new ListAccessImpl(Membership.class, Collections.emptyList());
+      }
+      return new IDMMembershipListAccess(gtnGroup);
    }
 
    public Collection findMembershipsByGroupId(String groupId) throws Exception

Modified: epp/portal/tags/EPP_5_2_0_ER03/component/web/security/src/main/java/org/exoplatform/web/login/GateinWCIController.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/web/security/src/main/java/org/exoplatform/web/login/GateinWCIController.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/web/security/src/main/java/org/exoplatform/web/login/GateinWCIController.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -66,11 +66,18 @@
 
    public void showErrorLoginForm(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
    {
-      String initialURI = req.getHeader("referer");
+      //we need to check of the 'initialURI' value is specified or not already for the request. This can occur if an
+      //incorrect login was used on the ErrorLoginForm itself, since we don't want to redirect back to the errorloginform 
+      //when the correct login is entered.
+      String initialURI = req.getParameter("initialURI");
       if (initialURI == null || initialURI.length() == 0)
       {
-         initialURI = req.getContextPath();
-      }      
+         initialURI = req.getHeader("referer");
+         if (initialURI == null || initialURI.length() == 0)
+         {
+            initialURI = req.getContextPath();
+         }
+      }
 
       //
       try

Modified: epp/portal/tags/EPP_5_2_0_ER03/component/web/server/src/main/java/org/exoplatform/upload/UploadService.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/web/server/src/main/java/org/exoplatform/upload/UploadService.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/web/server/src/main/java/org/exoplatform/upload/UploadService.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -42,6 +42,7 @@
 import org.exoplatform.container.xml.PortalContainerInfo;
 import org.gatein.common.logging.Logger;
 import org.gatein.common.logging.LoggerFactory;
+import org.gatein.common.text.EntityEncoder;
 
 public class UploadService
 {
@@ -85,7 +86,6 @@
     *           the webapp's {@link javax.servlet.http.HttpServletRequest}
     * @throws FileUploadException
     */
-   @SuppressWarnings("unchecked")
    public void createUploadResource(HttpServletRequest request) throws FileUploadException
    {
       String uploadId = request.getParameter("uploadId");
@@ -117,8 +117,10 @@
       if (fileName == null)
          fileName = uploadId;
       fileName = fileName.substring(fileName.lastIndexOf('\\') + 1);
+      fileName = EntityEncoder.FULL.encode(fileName);
       String storeLocation = uploadLocation_ + "/" + uploadId + "." + fileName;
 
+      
       // commons-fileupload will store the temp file with name *.tmp
       // we need to rename it to our desired name
       fileItem.getStoreLocation().renameTo(new File(storeLocation));

Modified: epp/portal/tags/EPP_5_2_0_ER03/component/web/server/src/main/java/org/exoplatform/web/handler/UploadHandler.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/component/web/server/src/main/java/org/exoplatform/web/handler/UploadHandler.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/component/web/server/src/main/java/org/exoplatform/web/handler/UploadHandler.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -27,6 +27,7 @@
 import org.exoplatform.web.ControllerContext;
 import org.exoplatform.web.WebAppController;
 import org.exoplatform.web.WebRequestHandler;
+import org.gatein.common.text.EntityEncoder;
 
 import java.io.Writer;
 import java.net.URLEncoder;
@@ -86,7 +87,6 @@
                continue;
             if (upResource.getStatus() == UploadResource.FAILED_STATUS)
             {
-               
                int limitMB = service.getUploadLimitsMB().get(uploadIds[i]).intValue();
                value.append("\n    \"").append(uploadIds[i]).append("\": {");
                value.append("\n      \"status\":").append('\"').append("failed").append("\",");

Modified: epp/portal/tags/EPP_5_2_0_ER03/distribution/jboss-epp/portletbridge/src/assemble.xml
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/distribution/jboss-epp/portletbridge/src/assemble.xml	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/distribution/jboss-epp/portletbridge/src/assemble.xml	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,11 +19,17 @@
         </dependencySet>
         <dependencySet>
             <includes>
-                <include>*:ear</include>
-                <include>*:war</include>
+                <include>org.jboss.portletbridge.examples.seam.booking:seamBooking-ear:ear</include>
             </includes>
             <outputDirectory>examples</outputDirectory>
+            <outputFileNameMapping>seamEAR.ear</outputFileNameMapping>
+        </dependencySet>
+        <dependencySet>
+            <includes>
+                <include>org.jboss.portal.examples:*:war</include>
+            </includes>
+            <outputDirectory>examples</outputDirectory>
             <outputFileNameMapping>${artifact.artifactId}-${artifact.version}.${artifact.extension}</outputFileNameMapping>
         </dependencySet>
     </dependencySets>
-</assembly>
\ No newline at end of file
+</assembly>

Modified: epp/portal/tags/EPP_5_2_0_ER03/gadgets/eXoGadgets/src/main/webapp/gadgets/rssAggregator/rssAggregator.xml
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/gadgets/eXoGadgets/src/main/webapp/gadgets/rssAggregator/rssAggregator.xml	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/gadgets/eXoGadgets/src/main/webapp/gadgets/rssAggregator/rssAggregator.xml	2011-10-10 17:33:08 UTC (rev 7705)
@@ -23,7 +23,8 @@
 <Module>
 <ModulePrefs title="RSS Reader" title_url="http://www.exoplatform.com" directory_title="RSS Reader" 
 	description="RSS Reader"
-	thumbnail="images/rssAggregator.png">
+	thumbnail="images/rssAggregator.png"
+	height="229">
 <Require feature="dynamic-height" />
 <Require feature="setprefs"/>
 <Require feature="settitle"/>
@@ -35,7 +36,7 @@
 <link rel="stylesheet" type="text/css" href="style.css"></link>
 
 <script type="text/javascript" src="script.js"></script>
-<div id="feedContainer" style="height:229px;overflow:auto;"></div>
+<div id="feedContainer" style="height:auto;overflow:auto;"></div>
 
 <script type="text/javascript">
 // Get userprefs

Modified: epp/portal/tags/EPP_5_2_0_ER03/gadgets/eXoGadgets/src/main/webapp/gadgets/rssAggregator/script.js
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/gadgets/eXoGadgets/src/main/webapp/gadgets/rssAggregator/script.js	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/gadgets/eXoGadgets/src/main/webapp/gadgets/rssAggregator/script.js	2011-10-10 17:33:08 UTC (rev 7705)
@@ -44,48 +44,12 @@
         return "an indeterminate amount of time ago"
     }
     time = (new Date().getTime()*1000 - B) / 1000;
-    if (time < 60) {
-        return "less than a minute ago"
-    } else {
-        if (time < 120) {
-            return "about a minute ago"
-        } else {
-            if (time < 3600) {
-                var A = Math.round(time / 60);
-                return "about " + A + " minutes ago"
-            } else {
-                if (time < 7200) {
-                    return "about an hour ago"
-                } else {
-                    if (time < 86400) {
-                        var A = Math.round(time / 3600);
-                        return "about " + A + " hours ago"
-                    } else {
-                        if (time < 172800) {
-                            return "about a day ago"
-                        } else {
-                            if (time < 2592000) {
-                                var A = Math.round(time / 86400);
-                                return "about " + A + " days ago"
-                            } else {
-                                if (time < 5184000) {
-                                    return "about a month ago"
-                                } else {
-                                    var A = Math.round(time / 2592000);
-                                    return "about " + A + " months ago"
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    }
+    return (new Date(B).toLocaleString());
 }
 
 RssAggregator.prototype.renderFeed = function(feedObj) {
   if(feedObj.rc != 200 && feedObj.data == undefined) {
-    document.write("the url: " + feedurl + " is down or invalid");
+    document.write("the url: " + gadgets.util.escapeString(feedurl) + " is down or invalid");
     return;
   }
     this.feed = feedObj.data;
@@ -140,7 +104,7 @@
             }
 		}
     } else {
-        document.write("No feed found at " + feedurl);
+        document.write("No feed found at " + gadgets.util.escapeString(feedurl));
     }
     gadgets.window.adjustHeight();
 }

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UIApplicationForm.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UIApplicationForm.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UIApplicationForm.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -22,22 +22,20 @@
 import org.exoplatform.application.registry.Application;
 import org.exoplatform.application.registry.ApplicationCategory;
 import org.exoplatform.application.registry.ApplicationRegistryService;
-import org.exoplatform.portal.application.PortalRequestContext;
-import org.exoplatform.portal.webui.portal.UIPortal;
+import org.exoplatform.commons.serialization.api.annotations.Serialized;
 import org.exoplatform.web.application.ApplicationMessage;
 import org.exoplatform.webui.application.WebuiRequestContext;
-import org.exoplatform.commons.serialization.api.annotations.Serialized;
 import org.exoplatform.webui.config.annotation.ComponentConfig;
 import org.exoplatform.webui.config.annotation.EventConfig;
 import org.exoplatform.webui.core.UIApplication;
 import org.exoplatform.webui.core.lifecycle.UIFormLifecycle;
 import org.exoplatform.webui.event.Event;
-import org.exoplatform.webui.event.EventListener;
-import org.exoplatform.webui.event.MonitorEvent;
 import org.exoplatform.webui.event.Event.Phase;
+import org.exoplatform.webui.event.EventListener;
 import org.exoplatform.webui.form.UIForm;
 import org.exoplatform.webui.form.UIFormStringInput;
 import org.exoplatform.webui.form.UIFormTextAreaInput;
+import org.exoplatform.webui.form.validator.NotHTMLTagValidator;
 import org.exoplatform.webui.form.validator.MandatoryValidator;
 import org.exoplatform.webui.form.validator.NameValidator;
 import org.exoplatform.webui.form.validator.StringLengthValidator;
@@ -56,7 +54,7 @@
 @Serialized
 public class UIApplicationForm extends UIForm
 {
-
+   
    private Application application_;
 
    public UIApplicationForm() throws Exception
@@ -64,9 +62,10 @@
       addUIFormInput(new UIFormStringInput("applicationName", "applicationName", null).addValidator(
          MandatoryValidator.class).addValidator(StringLengthValidator.class, 3, 30).addValidator(NameValidator.class));
       addUIFormInput(new UIFormStringInput("displayName", "displayName", null).addValidator(
-         StringLengthValidator.class, 3, 30));
-      addUIFormInput(new UIFormTextAreaInput("description", "description", null).addValidator(
-         StringLengthValidator.class, 0, 255));
+         StringLengthValidator.class, 3, 30).addValidator(NotHTMLTagValidator.class));
+      addUIFormInput(new UIFormTextAreaInput("description", "description", null)
+         .addValidator(StringLengthValidator.class, 0, 255)
+         .addValidator(NotHTMLTagValidator.class));
    }
 
    public void setValues(Application app) throws Exception

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UICategoryForm.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UICategoryForm.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UICategoryForm.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -22,9 +22,9 @@
 import org.exoplatform.application.registry.Application;
 import org.exoplatform.application.registry.ApplicationCategory;
 import org.exoplatform.application.registry.ApplicationRegistryService;
+import org.exoplatform.commons.serialization.api.annotations.Serialized;
 import org.exoplatform.web.application.ApplicationMessage;
 import org.exoplatform.webui.application.WebuiRequestContext;
-import org.exoplatform.commons.serialization.api.annotations.Serialized;
 import org.exoplatform.webui.config.annotation.ComponentConfig;
 import org.exoplatform.webui.config.annotation.EventConfig;
 import org.exoplatform.webui.core.UIApplication;
@@ -36,6 +36,7 @@
 import org.exoplatform.webui.form.UIFormStringInput;
 import org.exoplatform.webui.form.UIFormTabPane;
 import org.exoplatform.webui.form.UIFormTextAreaInput;
+import org.exoplatform.webui.form.validator.NotHTMLTagValidator;
 import org.exoplatform.webui.form.validator.IdentifierValidator;
 import org.exoplatform.webui.form.validator.MandatoryValidator;
 import org.exoplatform.webui.form.validator.StringLengthValidator;
@@ -75,7 +76,7 @@
          MandatoryValidator.class).addValidator(StringLengthValidator.class, 3, 30).addValidator(
          IdentifierValidator.class));
       uiCategorySetting.addUIFormInput(new UIFormStringInput(FIELD_DISPLAY_NAME, FIELD_DISPLAY_NAME, null)
-         .addValidator(StringLengthValidator.class, 3, 30));
+         .addValidator(StringLengthValidator.class, 3, 30).addValidator(NotHTMLTagValidator.class));
       uiCategorySetting.addUIFormInput(new UIFormTextAreaInput(FIELD_DESCRIPTION, FIELD_DESCRIPTION, null)
          .addValidator(StringLengthValidator.class, 0, 255));
       addChild(uiCategorySetting);

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UICategorySelector.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UICategorySelector.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UICategorySelector.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,26 +1,24 @@
 package org.exoplatform.applicationregistry.webui.component;
 
-import org.apache.shindig.gadgets.Gadget;
 import org.exoplatform.application.registry.Application;
 import org.exoplatform.application.registry.ApplicationCategory;
 import org.exoplatform.application.registry.ApplicationRegistryService;
-import org.exoplatform.commons.utils.SerializablePageList;
 import org.exoplatform.commons.serialization.api.annotations.Serialized;
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
+import org.exoplatform.commons.utils.SerializablePageList;
 import org.exoplatform.webui.config.annotation.ComponentConfig;
 import org.exoplatform.webui.config.annotation.EventConfig;
 import org.exoplatform.webui.core.UIContainer;
 import org.exoplatform.webui.core.lifecycle.UIFormLifecycle;
 import org.exoplatform.webui.event.Event;
-import org.exoplatform.webui.event.EventListener;
 import org.exoplatform.webui.event.Event.Phase;
+import org.exoplatform.webui.event.EventListener;
 import org.exoplatform.webui.form.UIForm;
 import org.exoplatform.webui.form.UIFormCheckBoxInput;
 import org.exoplatform.webui.form.UIFormInputInfo;
 import org.exoplatform.webui.form.UIFormInputSet;
 import org.exoplatform.webui.form.UIFormPageIterator;
 
-import org.gatein.common.text.EntityEncoder;
-
 import java.util.ArrayList;
 import java.util.List;
 
@@ -79,7 +77,7 @@
       UIFormCheckBoxInput<Boolean> checkBoxInput;
       UIFormInputInfo uiInfo;
 
-      EntityEncoder encoder = EntityEncoder.FULL;
+      HTMLEntityEncoder encoder = HTMLEntityEncoder.getInstance();
 
       //
       ApplicationRegistryService appRegService = getApplicationComponent(ApplicationRegistryService.class);

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UIGadgetEditor.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UIGadgetEditor.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/applicationregistry/webui/component/UIGadgetEditor.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,15 +19,14 @@
 
 package org.exoplatform.applicationregistry.webui.component;
 
-import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.shindig.common.uri.Uri;
 import org.apache.shindig.gadgets.spec.GadgetSpec;
 import org.exoplatform.application.gadget.Gadget;
 import org.exoplatform.application.gadget.GadgetRegistryService;
 import org.exoplatform.application.gadget.Source;
 import org.exoplatform.application.gadget.SourceStorage;
-import org.exoplatform.portal.webui.application.GadgetUtil;
 import org.exoplatform.commons.serialization.api.annotations.Serialized;
+import org.exoplatform.portal.webui.application.GadgetUtil;
 import org.exoplatform.web.application.ApplicationMessage;
 import org.exoplatform.webui.application.WebuiRequestContext;
 import org.exoplatform.webui.config.InitParams;
@@ -50,6 +49,7 @@
 import org.exoplatform.webui.form.validator.ResourceValidator;
 import org.exoplatform.webui.form.validator.StringLengthValidator;
 import org.exoplatform.webui.form.validator.Validator;
+
 import java.io.Serializable;
 import java.util.Calendar;
 
@@ -120,8 +120,7 @@
    {
       UIFormTextAreaInput uiInputSource = getUIFormTextAreaInput(FIELD_SOURCE);
       UIFormStringInput uiInputName = getUIStringInput(FIELD_NAME);
-      String encoded = StringEscapeUtils.escapeHtml(StringEscapeUtils.unescapeHtml(uiInputSource.getValue()));
-      uiInputSource.setValue(encoded);
+      uiInputSource.setValue(uiInputSource.getValue());
       //uiInputSource.setValue(uiInputSource.getValue());
       
       if(this.isEdit()) {
@@ -137,12 +136,6 @@
       return (idx > 0) ? fullName.substring(0, idx) : fullName;
    }
 
-   private String appendTail(String name)
-   {
-      int idx = name.indexOf('.');
-      return (idx > 0) ? name : name + ".xml";
-   }
-
    public void setDirPath(String dirPath)
    {
       this.dirPath = dirPath;

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/navigation/webui/TreeNode.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/navigation/webui/TreeNode.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/navigation/webui/TreeNode.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,5 +1,6 @@
 package org.exoplatform.navigation.webui;
 
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 import org.exoplatform.portal.mop.Described.State;
 import org.exoplatform.portal.mop.Visibility;
 import org.exoplatform.portal.mop.navigation.NodeChangeListener;
@@ -224,7 +225,7 @@
                      return node.getName();
                   }
 
-                  return label;
+                  return HTMLEntityEncoder.getInstance().encode(label);
                }
             }
          }

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/organization/webui/component/FindMembershipByGroupPageList.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/organization/webui/component/FindMembershipByGroupPageList.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/organization/webui/component/FindMembershipByGroupPageList.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -50,7 +50,6 @@
       OrganizationService service = (OrganizationService)container.getComponentInstance(OrganizationService.class);
       MembershipHandler handler = service.getMembershipHandler();
       Group group = service.getGroupHandler().findGroupById(state);
-      List<Membership> memberships = (List<Membership>)handler.findMembershipsByGroup(group);
-      return new ListAccessImpl<Membership>(Membership.class, memberships);
+      return handler.findAllMembershipsByGroup(group);
    }
 }

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/organization/webui/component/GroupManagement.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/organization/webui/component/GroupManagement.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/organization/webui/component/GroupManagement.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -146,9 +146,20 @@
    {
       if (username == null)
          username = org.exoplatform.portal.webui.util.Util.getPortalRequestContext().getRemoteUser();
-      if (username.equals(getUserACL().getSuperUser())) 
+      
+      //if getRemoteUser() returns null, then there isn't a logged in user, which means they are not an admin
+      if (username == null)
+      {
+         return false;
+      }
+      else if (username.equals(getUserACL().getSuperUser()))
+      {
          return true;
-      return isMemberOfGroup(username, getUserACL().getAdminGroups());
+      }
+      else
+      {
+         return isMemberOfGroup(username, getUserACL().getAdminGroups());
+      }
    }
 
    //  public static boolean isSuperUser(String username) throws Exception {

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/toolbar/webui/component/UIUserToolBarGroupPortlet.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/toolbar/webui/component/UIUserToolBarGroupPortlet.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/java/org/exoplatform/toolbar/webui/component/UIUserToolBarGroupPortlet.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -42,8 +42,9 @@
  *          thanhtungty at gmail.com
  * May 26, 2009  
  */
- at ComponentConfig(lifecycle = UIApplicationLifecycle.class, template = "app:/groovy/admintoolbar/webui/component/UIUserToolBarGroupPortlet.gtmpl"
-)
+ at ComponentConfig(lifecycle = UIApplicationLifecycle.class, template = "app:/groovy/admintoolbar/webui/component/UIUserToolBarGroupPortlet.gtmpl",
+   events = {
+      @EventConfig(listeners = UIUserToolBarGroupPortlet.NavigationChangeActionListener.class)})
 public class UIUserToolBarGroupPortlet extends BasePartialUpdateToolbar
 {
 

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/admintoolbar/webui/component/UIUserInfoPortlet.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/admintoolbar/webui/component/UIUserInfoPortlet.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/admintoolbar/webui/component/UIUserInfoPortlet.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,6 +1,7 @@
 <%	
 	import org.exoplatform.services.organization.User;
-	import org.gatein.common.text.EntityEncoder;
+  import org.gatein.common.text.EntityEncoder;
+	import org.exoplatform.commons.utils.HTMLEntityEncoder;
 	
 	def rcontext = _ctx.getRequestContext();
 	
@@ -9,7 +10,7 @@
 <ul class="UIUserInfoPortlet" id="$uicomponent.id">
 	<li class="Name">
 	<% if(rcontext.getRemoteUser() != null) { 
-	   	EntityEncoder encoder = EntityEncoder.FULL;
+	   	EntityEncoder encoder = HTMLEntityEncoder.getInstance();
       	fullName = encoder.encode(uicomponent.getUser().getFullName());
 	%>
 		<a href="$accountSetting"><%=fullName%></a>

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/admintoolbar/webui/component/UIUserToolBarSitePortlet.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/admintoolbar/webui/component/UIUserToolBarSitePortlet.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/admintoolbar/webui/component/UIUserToolBarSitePortlet.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,7 +1,8 @@
 <%	
 	import org.exoplatform.web.application.JavascriptManager;
 	import org.exoplatform.portal.webui.util.Util ;
-	import org.gatein.common.text.EntityEncoder;
+  import org.gatein.common.text.EntityEncoder;
+	import org.exoplatform.commons.utils.HTMLEntityEncoder;
 	import org.exoplatform.portal.mop.user.UserNode;
 	import javax.portlet.MimeResponse;
 	import javax.portlet.ResourceURL;
@@ -41,7 +42,7 @@
 				else clazz = "";
 				
 				href = nodeURL.toString();
-                EntityEncoder entityEncoder = EntityEncoder.FULL;
+                EntityEncoder entityEncoder = HTMLEntityEncoder.getInstance();
                 label = uicomponent.getPortalLabel(portalName);
                 label = entityEncoder.encode(label);
 				print """

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIApplicationInfo.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIApplicationInfo.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIApplicationInfo.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,12 +1,13 @@
 <%
-import org.gatein.common.text.EntityEncoder;	
+import org.gatein.common.text.EntityEncoder;
+import org.exoplatform.commons.utils.HTMLEntityEncoder;	
 def application = uicomponent.getApplication();
 def category = uicomponent.getApplicationCategory();
 String name = application.getApplicationName();
 String srcBG = application.getIconURL();
 String srcBGError = "/eXoResources/skin/sharedImages/Icon80x80/DefaultPortlet.png";
 
-EntityEncoder encoder = EntityEncoder.FULL;
+EntityEncoder encoder = HTMLEntityEncoder.getInstance();
 
 String categoryDisplayName = encoder.encode(category.getDisplayName());
 String applicationDisplayName = encoder.encode(application.getDisplayName());

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIApplicationOrganizer.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIApplicationOrganizer.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIApplicationOrganizer.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,5 +1,6 @@
-<%	
+<%
 import org.gatein.common.text.EntityEncoder;
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 def categories = uicomponent.getCategories();
 def selectedCategory = uicomponent.getSelectedCategory();
 def apps = uicomponent.getApplications();
@@ -29,7 +30,7 @@
 								cName	= category.getName();
 								displayName =category.getDisplayName();
 								if(displayName == null || displayName.length() < 1 ) displayName = cName;
-								EntityEncoder encoder = EntityEncoder.FULL;
+								EntityEncoder encoder = HTMLEntityEncoder.getInstance();
 								displayName = encoder.encode(displayName);
 								if(selectedCategory != null && cName == selectedCategory.getName()) {
 									isSelected = true;

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIGadgetInfo.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIGadgetInfo.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIGadgetInfo.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,8 +1,9 @@
 <%
 	import org.exoplatform.applicationregistry.webui.component.UICategorySelector;
-	import org.gatein.common.text.EntityEncoder;
+  import org.gatein.common.text.EntityEncoder;
+	import org.exoplatform.commons.utils.HTMLEntityEncoder;
 
-        EntityEncoder encoder = EntityEncoder.FULL;
+	EntityEncoder encoder = HTMLEntityEncoder.getInstance();
 	def gadget = uicomponent.getGadget();
 	boolean selectorRender = uicomponent.getChild(UICategorySelector.class).isRendered();
 	String srcBGError = "/eXoResources/skin/sharedImages/Icon80x80/DefaultPortlet.png";

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIPortletInfo.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIPortletInfo.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/applicationregistry/webui/component/UIPortletInfo.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -2,11 +2,12 @@
 	import java.util.Iterator;
 	import java.util.Map.Entry;
 	import org.exoplatform.applicationregistry.webui.component.UICategorySelector;
-        import org.gatein.common.text.EntityEncoder;
+	import org.gatein.common.text.EntityEncoder;
+  import org.exoplatform.commons.utils.HTMLEntityEncoder;
     
 	boolean selectorRender = uicomponent.getChild(UICategorySelector.class).isRendered();
 	String categoryNames = uicomponent.getCategorieNames();
-        EntityEncoder encoder = EntityEncoder.FULL;
+        EntityEncoder encoder = HTMLEntityEncoder.getInstance();
 	def portlet = uicomponent.getPortlet();
 	def portletPreferences = portlet.getPortletPreferences();
 	String srcBG = "/" + portlet.getPortletGroup() + "/skin/DefaultSkin/portletIcons/" + portlet.getName() + ".png";

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UINavigationGrid.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UINavigationGrid.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UINavigationGrid.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,34 +1,52 @@
-<%	
-	import java.util.List;
-	import org.exoplatform.webui.organization.OrganizationUtils;
-	import org.exoplatform.portal.mop.SiteKey;
-	
-	def parent = uicomponent.getParent();
-	def navigations = uicomponent.getBeans();
+<%  
+    import org.exoplatform.portal.mop.SiteKey;
+    import org.exoplatform.webui.organization.OrganizationUtils;
+    import org.gatein.common.text.EntityEncoder;
+    import org.exoplatform.commons.utils.HTMLEntityEncoder;
+    
+    import java.util.List;
+
+    def parent = uicomponent.getParent();
+    def navigations = uicomponent.getBeans();
 %>
 
 <div id="$uicomponent.id" class="FeedBox">
-	<% 
-	boolean isEvenRow = true;
-	SiteKey siteKey;
-	for(navigation in navigations) {
-			siteKey = navigation.getKey();
-			deleteLink = parent.event("DeleteNavigation",String.valueOf(siteKey.getName()));
-			editProperties = parent.event("EditProperties",String.valueOf(siteKey.getName()));
-			editLink = parent.event("EditNavigation",String.valueOf(siteKey.getName()));%>
+    <% 
+    boolean isEvenRow = true;
+    SiteKey siteKey;
+    EntityEncoder encoder = HTMLEntityEncoder.getInstance();
+    String descriptionLabel = _ctx.appRes("UIGroupNavigationManagement.Label.Description");
+    String editNavigationLabel = _ctx.appRes("UIGroupNavigationManagement.Label.EditNavigation");
+    String editPropertiesLabel = _ctx.appRes("UIGroupNavigationManagement.Label.EditProperties");
+    String deleteNavigationLabel = _ctx.appRes("UIGroupNavigationManagement.Label.DeleteNavigation");
+    for(navigation in navigations) {
+       siteKey = navigation.getKey();
+       String groupDescription = OrganizationUtils.getGroupDescription(siteKey.getName());
+       if (groupDescription) {
+          groupDescription = encoder.encode(groupDescription);
+       }
+       
+       String groupLabel = OrganizationUtils.getGroupLabel(siteKey.getName())
+       if (groupLabel) {
+          groupLabel = encoder.encode(groupLabel);
+       }
+       
+       String deleteLink = parent.event("DeleteNavigation",String.valueOf(siteKey.getName()));
+       String editProperties = parent.event("EditProperties",String.valueOf(siteKey.getName()));
+       String editLink = parent.event("EditNavigation",String.valueOf(siteKey.getName()));%>
   <table class="ManagementBlock <%=isEvenRow ? "EvenRow":"OddRow"%>" style="table-layout: fixed">
-	  <tr>
-		  <td class="Image"><img src="/exoadmin/skin/navigation/webui/component/background/GroupImage.png" alt="" /></td>
-   		<td class="Content">
-   			<div class="Label" title="$siteKey.name"><%= OrganizationUtils.getGroupLabel(siteKey.getName()) %></div>
-   			<div><%=_ctx.appRes("UIGroupNavigationManagement.Label.Description")%>: <%= OrganizationUtils.getGroupDescription(siteKey.getName()) %></div>
-   		</td>	
-     	<td class="ActionBlock">
-     		<a href="<%=editLink%>" class="EditNavIcon"><%=_ctx.appRes("UIGroupNavigationManagement.Label.EditNavigation")%></a> 
-     		<a href="<%=editProperties%>" class="EditProIcon"><%=_ctx.appRes("UIGroupNavigationManagement.Label.EditProperties")%></a> 
-     		<a href="<%=deleteLink%>" class="DeleteIcon"><%=_ctx.appRes("UIGroupNavigationManagement.Label.DeleteNavigation")%></a>
-	  	</td>	
-    </tr>								
+      <tr>
+        <td class="Image"><img src="/exoadmin/skin/navigation/webui/component/background/GroupImage.png" alt="" /></td>
+        <td class="Content">
+            <div class="Label" title="$siteKey.name">$groupLabel</div>
+            <div>$descriptionLabel: $groupDescription</div>
+        </td>   
+        <td class="ActionBlock">
+            <a href="<%=editLink%>" class="EditNavIcon">$editNavigationLabel</a> 
+            <a href="<%=editProperties%>" class="EditProIcon">$editPropertiesLabel</a> 
+            <a href="<%=deleteLink%>" class="DeleteIcon">$deleteNavigationLabel</a>
+        </td>   
+    </tr>                               
   </table>  
-	<% isEvenRow = !isEvenRow;} %>    
+    <% isEvenRow = !isEvenRow;} %>    
 </div>

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UISiteManagement.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UISiteManagement.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UISiteManagement.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,62 +1,68 @@
 <%
+  import org.exoplatform.portal.config.UserPortalConfigService;
   import org.exoplatform.webui.core.UIComponent ;
   import org.exoplatform.webui.form.UIForm;
-  import java.text.DateFormat;
-  import java.text.SimpleDateFormat;
-  import org.exoplatform.portal.config.UserPortalConfigService;
-   
+  
+  import org.gatein.common.text.EntityEncoder;
+  import org.exoplatform.commons.utils.HTMLEntityEncoder;
+  
   String[] actions =  uicomponent.getActions();
   uicomponent.loadPortalConfigs();
   def rcontext = _ctx.getRequestContext();
   def userPortalConfigService = uicomponent.getApplicationComponent(UserPortalConfigService.class);
   def defaultPortalName = userPortalConfigService.getDefaultPortal();
+  EntityEncoder encoder = HTMLEntityEncoder.getInstance();
+  
+  String editLayoutLabel = _ctx.appRes("UISiteManagement.label.editLayout");
+  String editNavigationLabel = _ctx.appRes("UISiteManagement.label.editNav");
+  String editPortalPropLabel = _ctx.appRes("UISiteManagement.label.editPortalProp");
+  String deletePortalLabel = _ctx.appRes("UISiteManagement.label.deletePortal");
 %>
 <div class="UISiteManagement UIManagement" id="<%=uicomponent.getId();%>">
-	  <%
-		    for (portalConfig in uicomponent.getPortalConfigs())  {		      
-	  %>
-		      	<table class="ManagementBlock" style="table-layout: fixed">
-		      		<tr>
-				      	<td class="Image"><img src="/exoadmin/skin/navigation/webui/component/background/PlImg.gif" alt=""/></td>
-				      	<td class="Content">
+      <%
+            for (portalConfig in uicomponent.getPortalConfigs())  {           
+      %>
+                <table class="ManagementBlock" style="table-layout: fixed">
+                    <tr>
+                        <td class="Image"><img src="/exoadmin/skin/navigation/webui/component/background/PlImg.gif" alt=""/></td>
+                        <td class="Content">
                            <div class="Label"><%=uicomponent.getFieldValue(portalConfig, 'name') %></div>
                            <%
-                           def siteLabel = uicomponent.getFieldValue(portalConfig, 'label');
-                           def siteDescription = uicomponent.getFieldValue(portalConfig, 'description');
-                           if (siteLabel != null && siteLabel.trim().length() > 0)
-                           {
+                           String siteLabel = uicomponent.getFieldValue(portalConfig, 'label');
+                           if (siteLabel != null && siteLabel.trim().length() > 0) {
+                              siteLabel = encoder.encode(siteLabel);
                               print """<div>$siteLabel</div>""";
                            }
-                           if (siteDescription != null && siteDescription.trim().length() > 0)
-                           {
+                           
+                           String siteDescription = uicomponent.getFieldValue(portalConfig, 'description');
+                           if (siteDescription != null && siteDescription.trim().length() > 0) {
+                              siteDescription = encoder.encode(siteDescription);
                               print """<div>$siteDescription</div>""";
                            }
                            %>
-					    </td>
-				        <td class="ActionBlock">
-					        	<a href="<%=uicomponent.event("EditPortalLayout", portalConfig.getName());%>" class="EditLayoutIcon"><%=_ctx.appRes("UISiteManagement.label.editLayout")%></a>
-					        	<a href="<%=uicomponent.event("EditNavigation", portalConfig.getName());%>" class="EditNavIcon"><%=_ctx.appRes("UISiteManagement.label.editNav")%></a>
-					        	<a href="javascript:ajaxGet(eXo.env.server.createPortalURL('UIPortal', 'EditPortalProperties', true, [{name:'portalName',value:'<%=portalConfig.getName()%>'}]))" class="EditNavIcon"><%=_ctx.appRes("UISiteManagement.label.editPortalProp")%></a>
-					        	
-					        	<% if(defaultPortalName != null && !defaultPortalName.equals(portalConfig.getName())) {%>
-					        		<a href="<%=uicomponent.url("DeletePortal", portalConfig.getName());%>" class="DeleteIcon"><%=_ctx.appRes("UISiteManagement.label.deletePortal")%></a>
-					        	<% } %>
-				        </td>
-				      </tr>
-				    </table>    
-		<%		    
-		  }
-		%> 
-	<%
-		if(uicomponent.getPortalConfigs() != null && uicomponent.getPortalConfigs().size() > 0){
-	%>
-	<div class="UIAction"> 
+                        </td>
+                        <td class="ActionBlock">
+                                <a href="<%=uicomponent.event("EditPortalLayout", portalConfig.getName());%>" class="EditLayoutIcon">$editLayoutLabel</a>
+                                <a href="<%=uicomponent.event("EditNavigation", portalConfig.getName());%>" class="EditNavIcon">$editNavigationLabel</a>
+                                <a href="javascript:ajaxGet(eXo.env.server.createPortalURL('UIPortal', 'EditPortalProperties', true, [{name:'portalName',value:'<%=portalConfig.getName()%>'}]))" class="EditNavIcon">$editPortalPropLabel</a>
+                                
+                                <% if(defaultPortalName != null && !defaultPortalName.equals(portalConfig.getName())) {%>
+                                    <a href="<%=uicomponent.url("DeletePortal", portalConfig.getName());%>" class="DeleteIcon">$deletePortalLabel</a>
+                                <% } %>
+                        </td>
+                      </tr>
+                    </table>    
+        <%          
+          }
+        %> 
+    <%
+        if(uicomponent.getPortalConfigs() != null && uicomponent.getPortalConfigs().size() > 0){
+    %>
+    <div class="UIAction"> 
 		<a href="javascript:void(0);" onclick="ajaxGet(eXo.env.server.createPortalURL('UIWorkingWorkspace', 'CreatePortal', true))" class="ActionButton LightBlueStyle"><%=_ctx.appRes(uicomponent.getId() + ".action.addNewPortal")%></a>
 	</div>
 	<%
 		}
 	%>
 	<%uicomponent.renderChildren();%>
-</div>
-
-
+</div>
\ No newline at end of file

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/web/src/main/webapp/groovy/portal/webui/component/UIBreadcumbsPortlet.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/web/src/main/webapp/groovy/portal/webui/component/UIBreadcumbsPortlet.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/web/src/main/webapp/groovy/portal/webui/component/UIBreadcumbsPortlet.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -2,7 +2,8 @@
 	import java.util.List;
 	import org.exoplatform.portal.webui.util.Util;
 	import org.exoplatform.portal.application.PortalRequestContext;
-	import org.gatein.common.text.EntityEncoder;
+  import org.gatein.common.text.EntityEncoder;
+	import org.exoplatform.commons.utils.HTMLEntityEncoder;
   import org.exoplatform.web.url.PortalURL;
   import org.exoplatform.web.url.navigation.NavigationResource;
  

Modified: epp/portal/tags/EPP_5_2_0_ER03/portlet/web/src/main/webapp/groovy/portal/webui/component/UIPortalNavigation.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/portlet/web/src/main/webapp/groovy/portal/webui/component/UIPortalNavigation.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/portlet/web/src/main/webapp/groovy/portal/webui/component/UIPortalNavigation.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -2,7 +2,8 @@
 	import org.exoplatform.portal.mop.user.UserNode;
 	import org.exoplatform.web.application.JavascriptManager;
 	import org.exoplatform.portal.webui.util.Util;
-	import org.gatein.common.text.EntityEncoder;
+  import org.gatein.common.text.EntityEncoder;
+	import org.exoplatform.commons.utils.HTMLEntityEncoder;
 	import javax.portlet.MimeResponse;
 	import org.exoplatform.portal.application.PortalRequestContext;
 	import org.exoplatform.web.url.PortalURL;

Modified: epp/portal/tags/EPP_5_2_0_ER03/settings-all.xml
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/settings-all.xml	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/settings-all.xml	2011-10-10 17:33:08 UTC (rev 7705)
@@ -16,9 +16,7 @@
     <!--pluginGroups>
         <pluginGroup>org.codehaus.mojo</pluginGroup>
     </pluginGroups-->
-<!--
 <localRepository>${env.HOME}/.m2_EPP</localRepository>
--->
     <profiles>
         <profile>
             <id>my-jboss-maven2</id>

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/WEB-INF/gatein-resources.xml
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/WEB-INF/gatein-resources.xml	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/WEB-INF/gatein-resources.xml	2011-10-10 17:33:08 UTC (rev 7705)
@@ -132,6 +132,16 @@
 			<js-path>/javascript/eXo/core/DOMUtil.js</js-path>
 			<js-priority>1</js-priority>
 		</param>
+        <param>
+            <js-module>eXo.core.HTMLUtil</js-module>
+            <js-path>/javascript/eXo/core/HTMLUtil.js</js-path>
+            <js-priority>2</js-priority>
+        </param>
+        <param>
+            <js-module>eXo.core.html.HTMLEntities</js-module>
+            <js-path>/javascript/eXo/core/html/HTMLEntities.js</js-path>
+            <js-priority>1</js-priority>
+        </param>
 		<param>
 			<js-module>eXo.core.Browser</js-module>
 			<js-path>/javascript/eXo/core/Browser.js</js-path>

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/core/DragDrop.js
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/core/DragDrop.js	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/core/DragDrop.js	2011-10-10 17:33:08 UTC (rev 7705)
@@ -101,19 +101,20 @@
 } ;
 
 DragDrop.prototype.onDrop = function(evt) {
-  /* should not remove this or move this line to  destroy since the onMouseMove method keep calling */
-  if(eXo.core.DragDrop.dropCallback != null) {
-    var dndEvent = eXo.core.DragDrop.dndEvent ;
-    dndEvent.backupMouseEvent = evt ;
-    var dragObject = dndEvent.dragObject ;
+   if(!evt) evt = window.event ;
+   /* should not remove this or move this line to  destroy since the onMouseMove method keep calling */
+   if(eXo.core.DragDrop.dropCallback != null) {
+      var dndEvent = eXo.core.DragDrop.dndEvent ;
+      dndEvent.backupMouseEvent = evt ;
+      var dragObject = dndEvent.dragObject ;
 
-    var foundTarget = eXo.core.DragDrop.findDropableTarget(dndEvent, eXo.core.DragDrop.dropableTargets, evt) ;
-    var junkMove =  eXo.core.DragDrop.isJunkMove(dragObject, foundTarget) ;
+      var foundTarget = eXo.core.DragDrop.findDropableTarget(dndEvent, eXo.core.DragDrop.dropableTargets, evt) ;
+      var junkMove =  eXo.core.DragDrop.isJunkMove(dragObject, foundTarget) ;
 
-    dndEvent.update(foundTarget, junkMove) ;
-    eXo.core.DragDrop.dropCallback (dndEvent) ;
-  }
-  eXo.core.DragDrop.destroy() ;
+      dndEvent.update(foundTarget, junkMove) ;
+      eXo.core.DragDrop.dropCallback (dndEvent) ;
+   }
+   eXo.core.DragDrop.destroy() ;
 } ;
 
 DragDrop.prototype.onCancel = function(evt) {

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/core/HTMLUtil.js
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/core/HTMLUtil.js	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/core/HTMLUtil.js	2011-10-10 17:33:08 UTC (rev 7705)
@@ -21,7 +21,7 @@
  * @author Nguyen Ba Uoc
  */
 // 4test
-if (eXo.require) eXo.require('eXo.core.html.HTMLEntities');
+//if (eXo.require) eXo.require('eXo.core.html.HTMLEntities');
 
 function HTMLUtil() {
   this.entities = eXo.core.html.HTMLEntities ;

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/portal/PortalDragDrop.js
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/portal/PortalDragDrop.js	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/portal/PortalDragDrop.js	2011-10-10 17:33:08 UTC (rev 7705)
@@ -86,9 +86,12 @@
       dndEvent.dragObject = cloneObject ;
       dndEvent.dragObject.isAddingNewly = isAddingNewly;
     } else {
+       var componentBlockWidth = 300;
+       
     	previewBlock = PortalDragDrop.createPreview();
+    	previewBlock.style.height = dragObject.offsetHeight + "px";
     	dragObject.parentNode.insertBefore(previewBlock, dragObject);
-    	dragObject.style.width = "300px";
+    	dragObject.style.width = componentBlockWidth + "px";
     	var componentBlock = eXo.core.DOMUtil.findFirstDescendantByClass(dragObject, "div", "UIComponentBlock") ;
     	var editBlock = eXo.core.DOMUtil.findFirstChildByClass(componentBlock, "div", "EDITION-BLOCK");
 	    if(editBlock) {
@@ -99,10 +102,20 @@
     dragObject.isAddingNewly = isAddingNewly;
     dragObject = dndEvent.dragObject;
     dragObject.style.position = "absolute" ;
-    if(eXo.core.I18n.isLT()) dragObject.style.left = originalDragObjectLeft + "px" ;
-    else dragObject.style.right = (PortalDragDrop.positionRootObj.offsetWidth - originalDragObjectLeft - dragObject.offsetWidth) + "px" ;
     dragObject.style.top = originalDragObjectTop + "px" ;
+    var dragObjectLeft = originalDragObjectLeft;
     
+    if (PortalDragDrop.deltaXDragObjectAndMouse > componentBlockWidth/2) {
+       if ((PortalDragDrop.backupDragObjectWidth - PortalDragDrop.deltaXDragObjectAndMouse) > componentBlockWidth/2) {
+          dragObjectLeft = originalDragObjectLeft + PortalDragDrop.deltaXDragObjectAndMouse - componentBlockWidth/2;
+       } else {
+          dragObjectLeft = originalDragObjectLeft + PortalDragDrop.backupDragObjectWidth - componentBlockWidth;
+       }
+    }
+    
+    if (eXo.core.I18n.isLT()) dragObject.style.left = dragObjectLeft + "px";
+    else dragObject.style.right = PortalDragDrop.positionRootObj.offsetWidth - dragObject.offsetWidth - dragObjectLeft + "px";
+    
     eXo.portal.isInDragging = true;
   }
   
@@ -110,7 +123,14 @@
     var dragObject = dndEvent.dragObject ;
     /* Control Scroll */
     eXo.portal.PortalDragDrop.scrollOnDrag(dndEvent) ;
-    if(!dndEvent.foundTargetObject) return;
+    if(!dndEvent.foundTargetObject) {
+       if (!dndEvent.lastFoundTargetObject) {
+          return;
+       } else {
+          dndEvent.foundTargetObject = dndEvent.lastFoundTargetObject;
+       }
+    }
+    
     var uiComponentLayout ;
     if(dndEvent.foundTargetObject.className == "UIPage") {
 			uiComponentLayout = DOMUtil.findFirstDescendantByClass(dndEvent.foundTargetObject, "div", "VIEW-PAGE");
@@ -149,7 +169,7 @@
       }
       
       dndEvent.foundTargetObject.listComponentInTarget = listComponent ;
-      var insertPosition = eXo.portal.PortalDragDrop.findInsertPosition(listComponent, dragObject, "row") ;
+      var insertPosition = eXo.portal.PortalDragDrop.findInsertPosition(listComponent, "row", dndEvent.backupMouseEvent) ;
       dndEvent.foundTargetObject.foundIndex = insertPosition ;
       
       /* Insert preview block */
@@ -179,7 +199,7 @@
       }
       
       dndEvent.foundTargetObject.listComponentInTarget = listComponent ;
-      var insertPosition = eXo.portal.PortalDragDrop.findInsertPosition(listComponent, dragObject, "column") ;
+      var insertPosition = eXo.portal.PortalDragDrop.findInsertPosition(listComponent, "column", dndEvent.backupMouseEvent) ;
       dndEvent.foundTargetObject.foundIndex = insertPosition ;
       
       /* Insert preview block */
@@ -203,11 +223,15 @@
   		hasChanged = false;
   	}
   	//When dragObject is outside 
-		var targetElement = dndEvent.foundTargetObject;  
-		if(!targetElement || targetElement.foundIndex == null) {
-			hasChanged = false;
-		}
-		//When dragobject is next to preview object (position is not changed)
+  	if (!dndEvent.foundTargetObject) {
+  	   dndEvent.foundTargetObject = dndEvent.lastFoundTargetObject;
+  	}
+  	
+	var targetElement = dndEvent.foundTargetObject;  
+	if(!targetElement || targetElement.foundIndex == null) {
+	   hasChanged = false;
+	}
+	//When dragobject is next to preview object (position is not changed)
   	if(!dndEvent.dragObject.isAddingNewly) {
 	  	var DOMUtil = eXo.core.DOMUtil;
 	  	var previewClass = "DragAndDropPreview";
@@ -229,7 +253,7 @@
 	    }
   	}
 
-    if(dndEvent.foundTargetObject != null || (dndEvent.backupMouseEvent && dndEvent.backupMouseEvent.keyCode != 27)) {
+    if(dndEvent.backupMouseEvent && dndEvent.backupMouseEvent.keyCode != 27) {
     	eXo.portal.PortalDragDrop.doDropCallback(dndEvent) ;
     } else {
 			if(dndEvent.dragObject.parentNode.nodeName.toLowerCase() == "td") {
@@ -359,13 +383,18 @@
   var mouseY = eXo.core.Browser.findMouseYInClient(dndEvent.backupMouseEvent) ;
   var deltaTop = mouseY - (Math.round(browserHeight * 5/6)) ;
   var deltaBottom = mouseY - (Math.round(browserHeight/6)) ;
+  var currentDragObjPos = parseInt(dndEvent.dragObject.style.top);
   if(deltaTop > 0) {
-    document.documentElement.scrollTop += deltaTop - 5 ;
+    document.documentElement.scrollTop += deltaTop - 5;
+    currentDragObjPos += deltaTop - 5;
   }
   
   if(deltaBottom < 0 && document.documentElement.scrollTop > 0) {
     document.documentElement.scrollTop += deltaBottom ;
+    currentDragObjPos += deltaBottom;
   }
+  
+  dndEvent.dragObject.style.top = currentDragObjPos + "px";
 };
 
 /**
@@ -374,30 +403,32 @@
  * 
  * @param layout {string} the layout type which is "row" or "column"
  */
-PortalDragDrop.prototype.findInsertPosition = function(components, dragObject, layout) {
-  if(layout == "row") {
-    for(var i = 0; i < components.length; i++) {
-      var componentTop = eXo.core.Browser.findPosY(components[i]) ;
-      var dragObjectTop = eXo.core.Browser.findPosY(dragObject) ;
-      var componentMiddle = componentTop + Math.round(components[i].offsetHeight / 2) ;
-            
-      if(dragObjectTop > componentMiddle) continue ;
-      else return i;
-    }
-    return -1 ;
-    
-  } else {
-	  var dragObjectX = eXo.core.Browser.findPosX(dragObject) ;
-    for(var i = 0; i < components.length; i++) {
-      var componentInTD = eXo.core.DOMUtil.getChildrenByTagName(components[i] ,"div")[0] ;    	
-      var componentX = eXo.core.Browser.findPosX(components[i]) ;
-      
-      if(dragObjectX > componentX) continue ;
-      else return i ;
-    }
-    return -1 ;
-  }  
-};
+PortalDragDrop.prototype.findInsertPosition = function(components, layout, mouseEvent) {
+	   var Browser = eXo.core.Browser;
+	   if (layout == "row") {
+	      for (var i = 0; i < components.length; i++) {
+	         var componentTop = Browser.findPosY(components[i]);
+	         var mouseYInPage = Browser.findMouseYInPage(mouseEvent);
+	         var componentMIddle = componentTop + Math.round(components[i].offsetHeight / 2);
+	         if (mouseYInPage > componentMIddle) continue;
+	         else return i;
+	      }
+	      
+	      return -1;
+	   } else {
+	      for (var i = 0; i < components.length; i++) {
+	         var mouseXInPage = Browser.findMouseXInPage(mouseEvent);
+	         var componentX = Browser.findPosX(components[i], eXo.core.I18n.isRT());
+	         if (eXo.core.I18n.isRT()) {
+	        	 if (mouseXInPage < componentX) continue;        	 
+	         } else if (mouseXInPage > componentX ) continue;
+	                  
+	         return i; 
+	      }
+	      
+	      return -1;
+	   }  
+	};
 
 /**
  * Create a div block which show the preview block

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/portal/PortalHttpRequest.js
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/portal/PortalHttpRequest.js	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/portal/PortalHttpRequest.js	2011-10-10 17:33:08 UTC (rev 7705)
@@ -61,6 +61,7 @@
 * which is itself placed inside an array to provide an OO view of the
 * AJAX response
 */
+
 function PortletResponse(responseDiv) {
   var  DOMUtil = eXo.core.DOMUtil ;
   var div = eXo.core.DOMUtil.getChildrenByTagName(responseDiv, "div") ;
@@ -125,7 +126,7 @@
         this.blocksToUpdate[j] = obj ;
         
         /*
-        * handle embeded javascripts to dynamically add them to the page head
+        * handle embedded javascripts to dynamically add them to the page head
         *
         * This is needed when we refresh an entire portal page that contains some 
         * standard JSR 168 / 286 portlets with embeded <script> tag
@@ -394,6 +395,8 @@
 	instance.executeScript = function(script) {
 	  if(script == null || script == "") return ;
 	  try {
+		var HTMLUtil = eXo.core.HTMLUtil;
+		script = HTMLUtil.entitiesDecode(script);
 	    eval(script) ;       
 	    return;
 	  } catch(err) {                  
@@ -409,6 +412,94 @@
 		  }
 	  } 
 	} ;
+
+	instance.updateHtmlHead = function(response) {
+      if (!response) return;      
+		cleanHtmlHead(response);
+		
+		var DOMUtil = eXo.core.DOMUtil;
+		var head = document.getElementsByTagName("head")[0]; 								
+		var markupHeadElements = response.markupHeadElements;
+      if (!markupHeadElements) return;
+		
+		if (markupHeadElements.titles && markupHeadElements.titles.length != 0) {
+			var oldTitle = DOMUtil.getChildrenByTagName(head, "title")[0];
+			var newTitle = markupHeadElements.titles[markupHeadElements.titles.length - 1];
+			if (oldTitle) {
+				head.replaceChild(newTitle, oldTitle);
+			} else {
+				head.appendChild(newTitle);
+			}
+		}			
+		
+		appendElementsToHead(markupHeadElements.metas);
+      appendElementsToHead(markupHeadElements.bases);
+		appendElementsToHead(markupHeadElements.links);				
+		appendElementsToHead(markupHeadElements.styles);
+		appendElementsToHead(markupHeadElements.scripts);
+	};
+	
+	function cleanHtmlHead(response) {
+		var DOMUtil = eXo.core.DOMUtil;
+		var head = document.getElementsByTagName("head")[0];		
+		
+		var portletResponses = response.portletResponses;
+		if (portletResponses) {
+			for (var i = 0; i < portletResponses.length; i++) {
+				removeExtraHead(portletResponses[i].portletId);
+			}
+		}
+
+      if (response.data) {
+         var portletFragments = DOMUtil.findDescendantsByClass(response.data, "div", "PORTLET-FRAGMENT");
+         for (var i = 0; i < portletFragments.length; i++) {
+            removeExtraHead(portletFragments[i].parentNode.id);
+         }
+      }
+		
+		var uiWorkingWorkspace = document.getElementById("UIWorkingWorkspace") ;
+		var portletFragsInWS = DOMUtil.findDescendantsByClass(uiWorkingWorkspace, "div", "PORTLET-FRAGMENT");		
+		var exHeads = DOMUtil.getElementsBy(function(elem) {
+			return elem.tagName != "TITLE" && elem.className.indexOf("ExHead-") == 0;
+		}, "*", head);
+		
+		for (var i = 0; i < exHeads.length; i++) {
+			var portletId = exHeads[i].className.substring(7);
+			var del = true;
+			for (var j = 0; j < portletFragsInWS.length; j++) {
+				if (portletId == portletFragsInWS[j].parentNode.id) {
+					del = false;
+					break;
+				}
+			}
+			if (del) {
+				head.removeChild(exHeads[i]);
+			}
+		}
+	}
+	
+	function removeExtraHead(portletId) {
+		var DOMUtil = eXo.core.DOMUtil;
+		var head = document.getElementsByTagName("head")[0];
+		
+		var elemsToRemove = DOMUtil.getElementsBy(function(elem) {
+			return elem.tagName != "TITLE" && elem.className == "ExHead-" + portletId;
+		}, "*", head);
+		
+		for (var i = 0; i < elemsToRemove.length; i++) {
+			head.removeChild(elemsToRemove[i]);
+		}
+	}
+	
+	function appendElementsToHead(elements) {
+      if (!elements) return;
+		var head = document.getElementsByTagName("head")[0]; 
+		
+		for (var i = 0; i < elements.length; i++) {
+			head.appendChild(elements[i]);
+		}
+	}
+	
 	/*
 	* This methods will replace some block content by new one. 
 	* This is the important concept in any AJAX call where JS is used to dynamically

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/webui/UIUpload.js
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/webui/UIUpload.js	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/eXoResources/src/main/webapp/javascript/eXo/webui/UIUpload.js	2011-10-10 17:33:08 UTC (rev 7705)
@@ -43,7 +43,7 @@
 		//eXo.webui.UIUpload.listLimitMB.push();
 		this.createUploadEntry(uploadId, isAutoUpload);
 	} else if(response.upload[uploadId].percent == 100)  {
-		this.showUploaded(uploadId, decodeURIComponent(response.upload[uploadId].fileName));
+		this.showUploaded(uploadId, (response.upload[uploadId].fileName));
 	} 
 };
 
@@ -97,11 +97,10 @@
   if(list.length < 1) return;
   var url = eXo.env.server.context + "/upload?" ;
 	url += "action=progress" ;
-//  var url =  eXo.env.server.context + "/upload?action=progress";  
+//  var url =  eXo.env.server.context + "/upload?action=progress";
   for(var i = 0; i < list.length; i++){
     url = url + "&uploadId=" + list[i];
   }
-
   var responseText = ajaxAsyncGetRequest(url, false);
   if(list.length > 0) {
     setTimeout("eXo.webui.UIUpload.refeshProgress('" + elementId + "');", 1000); 
@@ -111,16 +110,15 @@
   try {
     eval("response = "+responseText);
   }catch(err) {
-    return;  
+    return;
   }
-  
+
+
   for(id in response.upload) {
     var container = parent.document.getElementById(elementId);
   	if (response.upload[id].status == "failed") {
   		this.abortUpload(id);
   		var message = eXo.core.DOMUtil.findFirstChildByClass(container, "div", "LimitMessage").innerHTML ;
-  		alert(message.replace("{0}", response.upload[id].size)) ;
-//  		alert(response.upload[id].message);
   		continue;
   	}
     var element = document.getElementById(id+"ProgressIframe");
@@ -129,9 +127,11 @@
     var blueProgressBar = eXo.core.DOMUtil.findFirstChildByClass(progressBarMiddle, "div", "BlueProgressBar") ;
     var progressBarLabel = eXo.core.DOMUtil.findFirstChildByClass(blueProgressBar, "div", "ProgressBarLabel") ;
     blueProgressBar.style.width = percent + "%" ;
+
     progressBarLabel.innerHTML = percent + "%" ;
-    
-    if(percent == 100) this.showUploaded(id, "");
+    if(percent == 100) {
+       this.showUploaded(id, response.upload[id].fileName);
+    }
   }
   
   if(eXo.webui.UIUpload.listUpload.length < 1) return;
@@ -160,7 +160,7 @@
   var selectFileFrame = eXo.core.DOMUtil.findFirstDescendantByClass(container, "div", "SelectFileFrame") ;
   selectFileFrame.style.display = "block" ;
   var fileNameLabel = eXo.core.DOMUtil.findFirstDescendantByClass(selectFileFrame, "div", "FileNameLabel") ;
-  if(fileName != null) fileNameLabel.innerHTML += " " + fileName;
+  if(fileName != null) fileNameLabel.innerHTML = decodeURIComponent(fileName);
   var progressBarFrame = eXo.core.DOMUtil.findFirstDescendantByClass(container, "div", "ProgressBarFrame") ;
   progressBarFrame.style.display = "none" ;
   var tmp = element.parentNode;
@@ -246,19 +246,7 @@
 
   var file  = DOMUtil.findDescendantById(form, "file");
   if(file.value == null || file.value == '') return;  
-  var infoUploaded = eXo.core.DOMUtil.findFirstDescendantByClass(container, "div", "FileNameLabel") ;
-  var temp = file.value;
 
-  if (temp.indexOf('/') != -1) {
-    temp = temp.substr((temp.lastIndexOf('/') + 1), temp.length - 1) ;
-  }
-  
-  if (temp.indexOf('\\') != -1) {
-    temp = temp.substr((temp.lastIndexOf('\\') + 1), temp.length - 1) ;
-  }
-  
-  infoUploaded.innerHTML = temp ;
-
   var progressBarFrame = DOMUtil.findFirstDescendantByClass(container, "div", "ProgressBarFrame") ;
   progressBarFrame.style.display = "block" ;  
   var progressBarMiddle = DOMUtil.findFirstDescendantByClass(container, "div", "ProgressBarMiddle") ;

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/classes/locale/portal/webui_en.properties
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/classes/locale/portal/webui_en.properties	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/classes/locale/portal/webui_en.properties	2011-10-10 17:33:08 UTC (rev 7705)
@@ -111,6 +111,12 @@
 URLValidator.msg.invalid-url=The "{0}" field does not contain a valid URL.
 
   #############################################################################
+  #                        Escape HTML character Validator                    #
+  #############################################################################
+  
+NotHTMLTagValidator.msg.value-invalid=The "{0}" field is invalid, it should not contain HTML tag.
+
+  #############################################################################
   #              Label for UIFormMultiValueInputSet                                #
   #############################################################################
   

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/classes/locale/portal/webui_vi.properties
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/classes/locale/portal/webui_vi.properties	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/classes/locale/portal/webui_vi.properties	2011-10-10 17:33:08 UTC (rev 7705)
@@ -85,6 +85,12 @@
 URLValidator.msg.invalid-url=Giá trị trường "{0}" không hợp lệ!
 
   #############################################################################
+  #                        Escape HTML character Validator                    #
+  #############################################################################
+  
+NotHTMLTagValidator.msg.value-invalid=Giá trị trường "{0}" không hợp lệ, không cho phép dấu < hoặc >.
+
+  #############################################################################
   #              Label for UIFormMultiValueInputSet                                #
   #############################################################################
   

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/conf/portal/portal-configuration.xml
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/conf/portal/portal-configuration.xml	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/WEB-INF/conf/portal/portal-configuration.xml	2011-10-10 17:33:08 UTC (rev 7705)
@@ -180,7 +180,6 @@
 	            </field>
 	            <field name="ownerType"><string>portal</string></field>
 	            <field name="templateLocation"><string>war:/conf/portal/</string></field>
-              <field name="importMode"><string>conserve</string></field>
 	          </object>
 	        </object-param> 
 	        <object-param>
@@ -197,7 +196,6 @@
 	            </field>
 	            <field name="ownerType"><string>group</string></field>
 	            <field name="templateLocation"><string>war:/conf/portal</string></field>
-              <field name="importMode"><string>conserve</string></field>
 	          </object>
 	        </object-param>       
 	        <object-param>
@@ -211,7 +209,6 @@
 	            </field>
 	            <field name="ownerType"><string>user</string></field>
 	            <field name="templateLocation"><string>war:/conf/portal</string></field>
-              <field name="importMode"><string>conserve</string></field>
 	          </object>
 	        </object-param>
 	      </init-params>

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/application/UIApplicationList.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/application/UIApplicationList.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/application/UIApplicationList.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,7 +1,10 @@
 <%
 import org.gatein.common.text.EntityEncoder;
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
+
 def categories = uicomponent.getCategories();
 def selectedCategory = uicomponent.getSelectedCategory();
+EntityEncoder encoder = HTMLEntityEncoder.getInstance();
 %>
 <div class="UIOrganizerManagement" id="$uicomponent.id">
 	<div class="AppRegistryContainer">
@@ -14,16 +17,14 @@
 			 			<% 
 			 				String cTab, cName, description, displayName;
 			 				boolean isSelected = false;
-							for(category in categories) { 					 
-								cName	= category.getName();
-								displayName =category.getDisplayName();
-								if(displayName == null || displayName.length() < 1 ) displayName = cName;
-								EntityEncoder encoder = EntityEncoder.FULL;
-								displayName = encoder.encode(displayName);								
-								if(selectedCategory != null && cName == selectedCategory.getName()) {
+							for(category in categories) {
+								cName = category.getName();
+								displayName = encoder.encode(category.getDisplayName());
+								if (displayName == null || displayName.length() < 1 ) displayName = cName;
+								if (selectedCategory != null && cName == selectedCategory.getName()) {
 									isSelected = true;
 									cTab = "SelectedTab";
-								}else {
+								} else {
 									isSelected = false;
 									cTab = "NormalTab";
 								}
@@ -34,30 +35,22 @@
 										<%= displayName %>
 									</a>
 								</div>
-							<% if(isSelected) { %>
+							<% if (isSelected) { %>
 								<div class="UIVTabContent" style="display: block">
 								<%
-								for(application in uicomponent.getApplications()) {
-									String applicationLabel = application.getDisplayName();
-                                    String applicationLabelFull = applicationLabel;
-									if(applicationLabel.length() > 30) applicationLabel = applicationLabel.substring(0, 27) + "...";
-                                    applicationLabel = encoder.encode(applicationLabel==null?"":applicationLabel);
-                                    applicationLabelFull = encoder.encode(applicationLabelFull==null?"":applicationLabelFull);
+								for (application in uicomponent.getApplications()) {
+								    String applicationName = encoder.encode(application.getDisplayName());
+								    String applicationDescription = encoder.encode(application.getDescription());
 									String srcBG = application.getIconURL();
 									String srcBGError = "/eXoResources/skin/sharedImages/Icon80x80/DefaultPortlet.png";
-
-                                    description = application.getDescription();
-                                    if(description == null) displayName = "";
-                                    description = encoder.encode(description);
-
 								%>
 									<div class="UIVTab VTabStyle3" id="<%=application.getId();%>" onmousedown="eXo.portal.PortalDragDrop.init.call(this, event);">
 										<div class="VTabContentBG">
 											<div class="OverflowContainer">
 												<img src="<%=(srcBG!=null && srcBG.length()>0)?srcBG:srcBGError%>" onError="src='$srcBGError'"  alt=""/>
-												<div class="ContentInfo" title="<%= applicationLabelFull %>" style="cursor:move;">
-													<div class="LabelTab">$applicationLabel</div>
-													<div class="LableText"><%= description %></div>
+												<div class="ContentInfo" title="$applicationName" style="cursor:move;">
+													<div class="LabelTab">$applicationName</div>
+													<div class="LableText">$applicationDescription</div>
 												</div>
 												<div class="ClearLeft"><span></span></div>
 											</div>

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/application/UIPortlet.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/application/UIPortlet.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/application/UIPortlet.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,8 +1,10 @@
 <%	
-	import org.exoplatform.portal.webui.page.UIPage;
+	import org.exoplatform.portal.webui.workspace.UIPortalApplication;
+	import org.exoplatform.web.application.JavascriptManager;
+  import org.gatein.common.text.EntityEncoder;
+	import org.exoplatform.commons.utils.HTMLEntityEncoder;
+
 	import javax.portlet.WindowState;
-	import org.exoplatform.web.application.JavascriptManager;
-	import org.exoplatform.portal.webui.workspace.UIPortalApplication;
 	
 	def rcontext = _ctx.getRequestContext();
 	
@@ -20,6 +22,9 @@
 
 	WindowState windowState = uicomponent.getCurrentWindowState();
 	String portletId = uicomponent.getId();
+	EntityEncoder encoder = HTMLEntityEncoder.getInstance();
+	
+	String title = encoder.encode(uicomponent.getDisplayTitle());
 	if(uiPortalApp.isEditing()) {
 %>
 	<div class="UIPortlet <%=hasPermission?"":"ProtectedPortlet"%>" id="UIPortlet-$portletId" onmouseover="eXo.portal.UIPortal.blockOnMouseOver(event, this, true);" onmouseout="eXo.portal.UIPortal.blockOnMouseOver(event, this, false);"
@@ -35,7 +40,7 @@
 							<div class="CPortletLayoutDecorator">
 									<%
 									if(hasPermission) {
-										print uicomponent.getDisplayTitle();
+										print title;
 									} else print "<div class='ProtectedContent'>"+_ctx.appRes("UIPortlet.label.protectedContent")+"</div>";
 									%>
 							</div>
@@ -52,7 +57,6 @@
 		
 	if(portalMode != uiPortalApp.CONTAINER_BLOCK_EDIT_MODE && portalMode != uiPortalApp.APP_BLOCK_EDIT_MODE) {
 		if(uicomponent.getShowInfoBar()) {
-			String title = uicomponent.getDisplayTitle();
 			if(title == null || title.trim().length() < 1)
 				title = portletId;
 			/*Begin Window Portlet Bar*/
@@ -228,7 +232,6 @@
 								String portletIcon = uicomponent.getIcon();
 								if(portletIcon == null) portletIcon = "PortletIcon";
 								
-								String title = uicomponent.getDisplayTitle();
 								if(title.length() > 30) title = title.substring(0,27) + "...";
 							%>
 							<div class="PortletIcon $portletIcon"><%=hasPermission ? title : _ctx.appRes("UIPortlet.label.protectedContent")%></div>

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/container/UIColumnContainer.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/container/UIColumnContainer.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/container/UIColumnContainer.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -40,11 +40,11 @@
 				<div class="VIEW-CONTAINER VIEW-BLOCK">
 			<%} %> 
 					<%if(hasPermission) {%>
+ 						<div>								
 						  <div class="UIRowContainer <%=(portalMode != UIPortalApplication.NORMAL_MODE && uicomponent.getChildren().size() == 0) ? "EmptyContainer" : ""%>">
-							<div>								
 								<%uicomponent.renderChildren();%>
-							</div>
 						  </div>
+						</div>
 						<%} else out.print("<div class='ProtectedContent'>"+_ctx.appRes("UIPortlet.label.protectedContent")+"</div>");%>
 				</div>
 				

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/container/UIContainer.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/container/UIContainer.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/container/UIContainer.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -29,26 +29,25 @@
 				id="${uicomponent.id}" ${cssStyle} 
 				onmouseover="eXo.portal.UIPortal.blockOnMouseOver(event, this, true);" 
 				onmouseout="eXo.portal.UIPortal.blockOnMouseOver(event, this, false);">
-	<div class="NormalContainerBlock UIComponentBlock">
-
-			<%
-				int portalMode = uiPortalApp.getModeState();
-				if(portalMode == uiPortalApp.CONTAINER_BLOCK_EDIT_MODE || portalMode == uiPortalApp.APP_BLOCK_EDIT_MODE){
-			%>
-				<div class="LAYOUT-CONTAINER LAYOUT-BLOCK">
-			<%} else {%>
-				<div class="VIEW-CONTAINER VIEW-BLOCK">
-			<%} %> 
-					<%if(hasPermission) {%>
-						<div class="UIRowContainer <%=(portalMode != UIPortalApplication.NORMAL_MODE && uicomponent.getChildren().size() == 0) ? "EmptyContainer" : ""%>">
-							<div>					    						
-									<%uicomponent.renderChildren();%>							
-							</div>
-						</div>
-						<%} else out.print("<div class='ProtectedContent'>"+_ctx.appRes("UIPortlet.label.protectedContent")+"</div>");%>
-				</div>
-				
-			<%if(portalMode != UIPortalApplication.NORMAL_MODE){%>
+	<div class="NormalContainerBlock UIComponentBlock">
+		<%
+			int portalMode = uiPortalApp.getModeState();
+			if(portalMode == uiPortalApp.CONTAINER_BLOCK_EDIT_MODE || portalMode == uiPortalApp.APP_BLOCK_EDIT_MODE){
+		%>
+			<div class="LAYOUT-CONTAINER LAYOUT-BLOCK">
+		<%} else {%>
+			<div class="VIEW-CONTAINER VIEW-BLOCK">
+		<%} %> 
+				<%if(hasPermission) {%>
+				  <div>
+					<div class="UIRowContainer <%=(portalMode != UIPortalApplication.NORMAL_MODE && uicomponent.getChildren().size() == 0) ? "EmptyContainer" : ""%>">
+							<%uicomponent.renderChildren();%>
+					</div>
+				  </div>
+					<%} else out.print("<div class='ProtectedContent'>"+_ctx.appRes("UIPortlet.label.protectedContent")+"</div>");%>
+			</div>
+			
+		<%if(portalMode != UIPortalApplication.NORMAL_MODE){%>
 			<div class="EDITION-BLOCK EDITION-CONTAINER" style="display: none;position: relative;">
 				<div style="position: absolute; top: -86px;">
 					<div class="NewLayer" style="display: none; visibility: hidden;"><span></span></div>
@@ -74,4 +73,4 @@
 			</div>	
 		<%} %>
 	</div>
-</div>
\ No newline at end of file
+</div>

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/page/UIWizardPageSetInfo.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/page/UIWizardPageSetInfo.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/portal/webui/page/UIWizardPageSetInfo.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,6 +1,8 @@
 <%	
 	import org.exoplatform.portal.webui.navigation.UIPageNodeSelector;
 	import org.exoplatform.webui.core.UIComponent;
+  import org.gatein.common.text.EntityEncoder;
+	import org.exoplatform.commons.utils.HTMLEntityEncoder;
 
 	String nodeName = "/"; 	
 	boolean isNoSelecter = !uicomponent.getChild(UIPageNodeSelector.class).isRendered();
@@ -10,7 +12,7 @@
 	<div class="<%=isNoSelecter ? "NoPageSelecter" : ""%>">
   <%if(!isNoSelecter) {
    	def pageNode = uicomponent.getSelectedPageNode();
-   	if( pageNode!=null && pageNode.getResolvedLabel() != null ) nodeName += pageNode.getResolvedLabel();
+   	if( pageNode != null && pageNode.getResolvedLabel() != null ) nodeName += pageNode.getResolvedLabel();
   %>
 		<div class="PageNodeContainer">
 			<% uicomponent.renderChild(UIPageNodeSelector.class); %>
@@ -22,11 +24,12 @@
 					<div class="OverflowContainer">
 						<div class="Icon"><span></span></div>
 						<div class="Label"><%=_ctx.appRes(uicomponent.getId() + ".label.curentSelectedNodeInfo")%>:</div>
-						<% if(nodeName.length() > 40) { %>
-						<div class="Info"><%= nodeName.substring(0,39) %>...</div>
-						<% } else { %>
-						<div class="Info"><%= nodeName%></div>
-						<% } %>
+						<% if(nodeName.length() > 40) {
+						      nodeName = nodeName.substring(0,39) + "...";
+						   }
+						   nodeName = HTMLEntityEncoder.getInstance().encode(nodeName);
+						%>   
+						<div class="Info">$nodeName</div>
 					</div>
 				</div>
 			

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIBreadcumbs.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIBreadcumbs.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIBreadcumbs.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -2,7 +2,8 @@
 	import java.util.List;
 	import org.exoplatform.portal.webui.util.Util;
 	import org.exoplatform.portal.application.PortalRequestContext;
-	import org.gatein.common.text.EntityEncoder;
+  import org.gatein.common.text.EntityEncoder;
+	import org.exoplatform.commons.utils.HTMLEntityEncoder;
  
 	List list = uicomponent.getPath();
 	def styleBread = uicomponent.getBreadcumbsStyle();
@@ -27,7 +28,7 @@
 								actionLink = uicomponent.event("SelectPath", localPath.getId());
 							else
 								actionLink = portalURI + localPath.getId();	
-							EntityEncoder entityEncoder = EntityEncoder.FULL;
+							EntityEncoder entityEncoder = HTMLEntityEncoder.getInstance();
 							String label = entityEncoder.encode(localPath.label) 
 							if(i == list.size()-1) note = "Selected";
 				%>

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIGrid.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIGrid.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIGrid.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -4,6 +4,7 @@
    import java.text.DateFormat;
    import java.text.SimpleDateFormat;
    import org.gatein.common.text.EntityEncoder;
+   import org.exoplatform.commons.utils.HTMLEntityEncoder;
 
    String[] beanFields = uicomponent.getBeanFields();
    String[] beanActions = uicomponent.getBeanActions();
@@ -65,7 +66,7 @@
       %>
       <tr class="$rowClass">
          <%
-               EntityEncoder encoder = EntityEncoder.FULL;
+               EntityEncoder encoder = HTMLEntityEncoder.getInstance();
                for (field in beanFields)
                {
 			      def fieldValue = uicomponent.getFieldValue(bean, field);

Modified: epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIPopupMessages.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIPopupMessages.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/web/portal/src/main/webapp/groovy/webui/core/UIPopupMessages.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -8,7 +8,8 @@
 	 */  
 %>
 <%
-        import org.gatein.common.text.EntityEncoder;	
+  import org.gatein.common.text.EntityEncoder;
+  import org.exoplatform.commons.utils.HTMLEntityEncoder;	
 	String popupId = uicomponent.getId();
 	
 	def rcontext = _ctx.getRequestContext();
@@ -66,7 +67,7 @@
 					}
 			    }
 			}
-                        EntityEncoder encoder = EntityEncoder.FULL;
+                        EntityEncoder encoder = HTMLEntityEncoder.getInstance();
 			msgValue = encoder.encode(msgValue);
 				println msgValue;
 

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/core/UITree.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/core/UITree.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/core/UITree.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -20,6 +20,7 @@
 package org.exoplatform.webui.core;
 
 import org.exoplatform.commons.serialization.api.annotations.Serialized;
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 import org.exoplatform.util.ReflectionUtil;
 import org.exoplatform.webui.application.WebuiRequestContext;
 import org.exoplatform.webui.config.annotation.ComponentConfig;
@@ -117,6 +118,11 @@
     * A right click popup menu
     */
    private UIRightClickPopupMenu uiPopupMenu_;
+   
+   /**
+    * Encode the value before rendering or not
+    */
+   private boolean escapeHTML_ = false;
 
    public Object getFieldValue(Object bean, String field) throws Exception
    {
@@ -260,6 +266,16 @@
          uiPopupMenu_.setParent(this);
    }
 
+   public void setEscapeHTML(boolean escape)
+   {
+      escapeHTML_ = escape;
+   }
+   
+   public boolean getEscapeHTML()
+   {
+      return escapeHTML_;
+   }
+
    public String event(String name, String beanId) throws Exception
    {
       UIForm uiForm = getAncestorOfType(UIForm.class);
@@ -305,6 +321,12 @@
       {
          fieldValue = fieldValue.substring(0, getMaxTitleCharacter() - 3) + "...";
       }
+      
+      if (escapeHTML_)
+      {
+         fieldValue = fieldValue != null ? HTMLEntityEncoder.getInstance().encode(fieldValue) : fieldValue; 
+      }
+      
       if (nodeIcon.equals(expandIcon))
       {
          builder.append(" <div class=\"").append(nodeIcon).append("\" onclick=\"").append(actionLink).append("\">");

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormDateTimeInput.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormDateTimeInput.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormDateTimeInput.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,6 +19,8 @@
 
 package org.exoplatform.webui.form;
 
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
+import org.exoplatform.web.application.JavascriptManager;
 import org.exoplatform.webui.application.WebuiRequestContext;
 
 import java.io.Writer;
@@ -57,11 +59,6 @@
    private String datePattern_;
 
    /**
-    * The date
-    */
-   private Date date;
-
-   /**
     * List of month's name
     */
    private String[] months_;
@@ -69,7 +66,7 @@
    public UIFormDateTimeInput(String name, String bindField, Date date, boolean isDisplayTime)
    {
       super(name, bindField, String.class);
-      this.date = date;
+      setDate(date);
       setDisplayTime(isDisplayTime);
 
       WebuiRequestContext requestContext = WebuiRequestContext.getCurrentInstance();
@@ -92,21 +89,28 @@
       isDisplayTime_ = isDisplayTime;
    }
 
-   public void setCalendar(Calendar date)
+   public void setCalendar(Calendar calendar)
    {
       WebuiRequestContext requestContext = WebuiRequestContext.getCurrentInstance();
       formatPattern(requestContext.getLocale());
+      Date date = null;
+      if (calendar != null)
+      {
+         date = calendar.getTime();
+      }
+      setDate(date);
+   }
+   
+   private void setDate(Date date)
+   {
       if (date != null)
       {
-         this.date = date.getTime();
-         value_ = dateFormat_.format(date.getTime());
+         value_ = dateFormat_.format(date);
       }
       else
       {
-         this.date = null;
          value_ = null;
       }
-
    }
 
    public Calendar getCalendar()
@@ -183,8 +187,9 @@
    @SuppressWarnings("unused")
    public void decode(Object input, WebuiRequestContext context) throws Exception
    {
-      if (input != null)
+      if (input != null) {
          value_ = ((String)input).trim();
+      }
    }
 
    public void processRender(WebuiRequestContext context) throws Exception
@@ -202,25 +207,28 @@
          }
       }
 
-      if (date != null)
+      String value = getValue();
+      
+      if (value != null && value.length() > 0)
       {
-         value_ = dateFormat_.format(date);
+         value = HTMLEntityEncoder.getInstance().encodeHTMLAttribute(value);
       }
-      else if (value_ == null)
+      else
       {
-         value_ = "";
+         value = "";
       }
+      
 
       context.getJavascriptManager().importJavascript("eXo.webui.UICalendar");
       Writer w = context.getWriter();
 
-      w.write("<input type='text' onfocus='eXo.webui.UICalendar.init(this,");
+      w.write("<input type=\"text\" onfocus='eXo.webui.UICalendar.init(this,");
       w.write(String.valueOf(isDisplayTime_));
       w.write(",\"");
       w.write(getDatePattern_());
       w.write("\"");
       w.write(",\"");
-      w.write(value_.toString());
+      w.write(value);
       w.write("\"");
       w.write(",\"");
       w.write(monthNames_);
@@ -228,12 +236,9 @@
       w.write(");' onkeyup='eXo.webui.UICalendar.show();' name='");
       w.write(getName());
       w.write('\'');
-      if (value_ != null && value_.length() > 0)
-      {
-         w.write(" value='");
-         w.write(value_.toString());
-         w.write('\'');
-      }
+      w.write(" value=\"");
+      w.write(value);
+      w.write('\"');
       w.write(" onclick='event.cancelBubble = true'/>");
    }
 }

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormHiddenInput.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormHiddenInput.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormHiddenInput.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,6 +19,7 @@
 
 package org.exoplatform.webui.form;
 
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 import org.exoplatform.webui.application.WebuiRequestContext;
 
 import java.io.Writer;
@@ -62,10 +63,12 @@
       print.write(" id='");
       print.write(getId());
       print.write("'");
-      if (value_ != null && value_.length() > 0)
+      String value = getValue();
+      if (value != null && value.length() > 0)
       {
          print.write(" value='");
-         print.write(value_);
+         value = HTMLEntityEncoder.getInstance().encodeHTMLAttribute(value);
+         print.write(value);
          print.write("'");
       }
       print.write(" />");

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormInputBase.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormInputBase.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormInputBase.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,8 +19,8 @@
 
 package org.exoplatform.webui.form;
 
-import org.exoplatform.webui.application.WebuiRequestContext;
 import org.exoplatform.commons.serialization.api.annotations.Serialized;
+import org.exoplatform.webui.application.WebuiRequestContext;
 import org.exoplatform.webui.core.UIComponent;
 import org.exoplatform.webui.core.UIContainer;
 import org.exoplatform.webui.event.Event;
@@ -90,7 +90,7 @@
     * Whether this field is in read only mode
     */
    protected boolean readonly_ = false;
-
+   
    public UIFormInputBase(String name, String bindingField, Class<T> typeValue)
    {
       this.name = name;
@@ -237,5 +237,4 @@
    {
       this.label = label;
    }
-
 }
\ No newline at end of file

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormInputInfo.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormInputInfo.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormInputInfo.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,8 +19,9 @@
 
 package org.exoplatform.webui.form;
 
+import org.exoplatform.commons.serialization.api.annotations.Serialized;
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 import org.exoplatform.webui.application.WebuiRequestContext;
-import org.exoplatform.commons.serialization.api.annotations.Serialized;
 
 import java.io.Writer;
 
@@ -52,8 +53,12 @@
    {
       Writer w = context.getWriter();
       w.append("<span id=\"").append(getId()).append("\" class=\"").append(getId()).append("\">");
-      if (value_ != null)
-         w.write(value_);
+      String value = getValue();
+      if (value != null)
+      {
+         value = HTMLEntityEncoder.getInstance().encode(value);
+         w.write(value);
+      }
       w.write("</span>");
    }
 

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormSelectBox.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormSelectBox.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormSelectBox.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,8 +19,9 @@
 
 package org.exoplatform.webui.form;
 
+import org.exoplatform.commons.serialization.api.annotations.Serialized;
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 import org.exoplatform.webui.application.WebuiRequestContext;
-import org.exoplatform.commons.serialization.api.annotations.Serialized;
 import org.exoplatform.webui.core.UIComponent;
 import org.exoplatform.webui.core.model.SelectItemOption;
 
@@ -254,10 +255,12 @@
          {
          }
 
+         String value = item.getValue();
+         value = HTMLEntityEncoder.getInstance().encodeHTMLAttribute(value);
          if (item.isSelected())
          {
             w.write("<option selected=\"selected\" value=\"");
-            w.write(item.getValue());
+            w.write(value);
             w.write("\">");
          }
          else

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormStringInput.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormStringInput.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormStringInput.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,8 +19,9 @@
 
 package org.exoplatform.webui.form;
 
-import org.exoplatform.webui.application.WebuiRequestContext;
 import org.exoplatform.commons.serialization.api.annotations.Serialized;
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
+import org.exoplatform.webui.application.WebuiRequestContext;
 
 import java.io.Writer;
 
@@ -88,7 +89,6 @@
       return maxLength;
    }
 
-   @SuppressWarnings("unused")
    public void decode(Object input, WebuiRequestContext context) throws Exception
    {
       String val = (String)input;
@@ -101,6 +101,7 @@
 
    public void processRender(WebuiRequestContext context) throws Exception
    {
+      String value = getValue();
       Writer w = context.getWriter();
       w.write("<input name='");
       w.write(getName());
@@ -112,10 +113,11 @@
       w.write(" id='");
       w.write(getId());
       w.write('\'');
-      if (value_ != null && value_.length() > 0)
+      if (value != null && value.length() > 0)
       {
+         value = HTMLEntityEncoder.getInstance().encodeHTMLAttribute(value);
          w.write(" value='");
-         w.write(encodeValue(value_).toString());
+         w.write(value);
          w.write('\'');
       }
       if (maxLength > 0)
@@ -128,34 +130,4 @@
       if (this.isMandatory())
          w.write(" *");
    }
-
-   private StringBuilder encodeValue(String value)
-   {
-      char[] chars = {'\'', '"'};
-      String[] refs = {"&#39;", "&#34;"};
-      StringBuilder builder = new StringBuilder(value);
-      int idx;
-      for (int i = 0; i < chars.length; i++)
-      {
-         idx = indexOf(builder, chars[i], 0);
-         while (idx > -1)
-         {
-            builder = builder.replace(idx, idx + 1, refs[i]);
-            idx = indexOf(builder, chars[i], idx);
-         }
-      }
-      return builder;
-   }
-
-   private int indexOf(StringBuilder builder, char c, int from)
-   {
-      int i = from;
-      while (i < builder.length())
-      {
-         if (builder.charAt(i) == c)
-            return i;
-         i++;
-      }
-      return -1;
-   }
 }
\ No newline at end of file

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormTextAreaInput.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormTextAreaInput.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormTextAreaInput.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,8 +19,9 @@
 
 package org.exoplatform.webui.form;
 
+import org.exoplatform.commons.serialization.api.annotations.Serialized;
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 import org.exoplatform.webui.application.WebuiRequestContext;
-import org.exoplatform.commons.serialization.api.annotations.Serialized;
 import java.io.Writer;
 
 /**
@@ -49,7 +50,6 @@
       this.value_ = value ; 
    }
    
-   @SuppressWarnings("unused")
    public void decode(Object input, WebuiRequestContext context) throws Exception {
      String val = (String) input ;
      value_ = val ;
@@ -71,9 +71,10 @@
       w.append(" cols=\"").append(String.valueOf(columns)).append("\"");
       w.write(">");
       if (value != null)
-         //TODO: remove from other components and than encode here
-         //w.write(org.gatein.common.text.EntityEncoder.FULL.encode(value));
+      {
+         value = HTMLEntityEncoder.getInstance().encode(value);
          w.write(value);
+      }
       w.write("</textarea>");
       if (this.isMandatory())
          w.write(" *");

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormWYSIWYGInput.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormWYSIWYGInput.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/UIFormWYSIWYGInput.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -28,11 +28,10 @@
  * Author : Tran The Trong
  *          trongtt at gmail.com
  * November 07, 2007
+
+ * @deprecated should use {@link org.exoplatform.webui.form.wysiwyg.UIFormWYSIWYGInput} instead
  */
 @Deprecated
-/**
- * Should use org.exoplatform.webui.form.wysiwyg.UIFormWYSIWYGInput
- * */
 public class UIFormWYSIWYGInput extends UIFormInputBase<String>
 {
 

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormColorPicker.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormColorPicker.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormColorPicker.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,6 +19,7 @@
 
 package org.exoplatform.webui.form.ext;
 
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 import org.exoplatform.webui.application.WebuiRequestContext;
 import org.exoplatform.webui.form.UIForm;
 import org.exoplatform.webui.form.UIFormInput;
@@ -196,12 +197,17 @@
 
    public void processRender(WebuiRequestContext context) throws Exception
    {
+      String value = getValue();
+      if (value != null)
+      {
+         value = HTMLEntityEncoder.getInstance().encode(value);
+      }
       Writer w = context.getWriter();
       w.write("<div class='UIFormColorPicker'>");
       w.write("<div class=\"UIColorPickerInput\" onclick=\"eXo.webui.UIColorPicker.show(this)\">");
-      w.write("<span class=\" DisplayValue " + encodeValue(value_).toString() + "\"></span>");
+      w.write("<span class=\" DisplayValue " + value + "\"></span>");
       w.write("</div>");
-      w.write("<div class=\"CalendarTableColor\" selectedColor=\"" + encodeValue(value_).toString() + " \">");
+      w.write("<div class=\"CalendarTableColor\" selectedColor=\"" + value + " \">");
       int i = 0;
       int count = 0;
       while (i <= size() / items())
@@ -227,9 +233,9 @@
       w.write("</div>");
       w.write("<input class='UIColorPickerValue' name='" + getId() + "' type='hidden'" + " id='" + getId() + "' "
          + renderJsActions());
-      if (value_ != null && value_.trim().length() > 0)
+      if (value != null && value.trim().length() > 0)
       {
-         w.write(" value='" + value_ + "'");
+         w.write(" value='" + value + "'");
       }
       w.write(" />");
       w.write("</div>");
@@ -243,36 +249,6 @@
       return super.setValue(arg0);
    }
 
-   private StringBuilder encodeValue(String value)
-   {
-      char[] chars = {'\'', '"'};
-      String[] refs = {"&#39;", "&#34;"};
-      StringBuilder builder = new StringBuilder(value);
-      int idx;
-      for (int i = 0; i < chars.length; i++)
-      {
-         idx = indexOf(builder, chars[i], 0);
-         while (idx > -1)
-         {
-            builder = builder.replace(idx, idx + 1, refs[i]);
-            idx = indexOf(builder, chars[i], idx);
-         }
-      }
-      return builder;
-   }
-
-   private int indexOf(StringBuilder builder, char c, int from)
-   {
-      int i = from;
-      while (i < builder.length())
-      {
-         if (builder.charAt(i) == c)
-            return i;
-         i++;
-      }
-      return -1;
-   }
-
    static public class Colors
    {
 

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormComboBox.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormComboBox.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormComboBox.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,6 +19,7 @@
 
 package org.exoplatform.webui.form.ext;
 
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 import org.exoplatform.webui.application.WebuiRequestContext;
 import org.exoplatform.webui.core.model.SelectItemOption;
 import org.exoplatform.webui.form.UIForm;
@@ -193,6 +194,12 @@
       }
       text += "</div></div></div>";
       options = options.substring(0, options.length() - 1) + "]";
+
+      String value = getValue();
+      if (value != null)
+      {
+         value = HTMLEntityEncoder.getInstance().encode(value);
+      }
       text += "<input type='hidden'  name='" + getName() + "' id='" + getId() + "'";
       if (value_ != null && value_.trim().length() > 0)
       {

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormInputSetWithAction.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormInputSetWithAction.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/ext/UIFormInputSetWithAction.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -19,7 +19,6 @@
 
 package org.exoplatform.webui.form.ext;
 
-import org.exoplatform.webui.application.WebuiRequestContext;
 import org.exoplatform.webui.config.annotation.ComponentConfig;
 import org.exoplatform.webui.form.UIForm;
 import org.exoplatform.webui.form.UIFormInput;
@@ -89,14 +88,6 @@
       isShowActionInfo = isShow;
    }
 
-   /* (non-Javadoc)
-    * @see org.exoplatform.webui.form.UIFormInputSet#processRender(org.exoplatform.webui.application.WebuiRequestContext)
-    */
-   public void processRender(WebuiRequestContext context) throws Exception
-   {
-      super.processRender(context);
-   }
-
    /**
     * Sets the actions.
     * 

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/validator/ExpressionValidator.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/validator/ExpressionValidator.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/validator/ExpressionValidator.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -64,13 +64,11 @@
       {
          return;
       }
-      if (uiInput.getValue() != null)
+      
+      String value = ((String)uiInput.getValue()).trim();
+      if (value.matches(expression_))
       {
-         String value = ((String)uiInput.getValue()).trim();
-         if (value.matches(expression_))
-         {
-            return;
-         }
+         return;
       }
 
       //  modified by Pham Dinh Tan

Added: epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/validator/NotHTMLTagValidator.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/validator/NotHTMLTagValidator.java	                        (rev 0)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/core/src/main/java/org/exoplatform/webui/form/validator/NotHTMLTagValidator.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -0,0 +1,38 @@
+/**
+ * Copyright (C) 2011 eXo Platform SAS.
+ * 
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ * 
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ * 
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.exoplatform.webui.form.validator;
+
+/**
+ * @author <a href="trongtt at gmail.com">Trong Tran</a>
+ * @version $Revision$
+ */
+public class NotHTMLTagValidator extends ExpressionValidator
+{
+   private static final String REGEX = "[^\\<\\>]*";
+   
+   public NotHTMLTagValidator()
+   {
+      super(REGEX, "NotHTMLTagValidator.msg.value-invalid");
+   }
+
+   public NotHTMLTagValidator(final String key)
+   {
+      super(REGEX, key);
+   } 
+}

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/dashboard/src/main/resources/groovy/dashboard/webui/component/UIDashboardSelectContainer.gtmpl
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/dashboard/src/main/resources/groovy/dashboard/webui/component/UIDashboardSelectContainer.gtmpl	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/dashboard/src/main/resources/groovy/dashboard/webui/component/UIDashboardSelectContainer.gtmpl	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,11 +1,15 @@
 <% 
+  import org.gatein.common.text.EntityEncoder;
+  import org.exoplatform.commons.utils.HTMLEntityEncoder;
+
 	def uiDashboard = uicomponent.getAncestorOfType(org.exoplatform.dashboard.webui.component.UIDashboard.class);
 	if(!uiDashboard.canEdit()) return;
 		
 	def uiPopup = uicomponent.getAncestorOfType(org.exoplatform.webui.core.UIPopupWindow.class);
 	def rcontext = _ctx.getRequestContext();
 	rcontext.getJavascriptManager().addJavascript("eXo.webui.UIDashboard.initPopup('"+uiPopup.getId()+"');");
-	
+
+	EntityEncoder encoder = HTMLEntityEncoder.getInstance();
  %>
 <div class="$uicomponent.id" id="UIDashboardSelectContainer" style="display: <%= uiDashboard.isShowSelectPopup()? "block" : "none"; %>;">
 	<div class="DashboardItemContainer ItemContainer">
@@ -21,13 +25,15 @@
 			<% List categories = uicomponent.getCategories();
 				 if(categories != null && categories.size() > 0){
 					for(category in categories){
+					   String categoryName = category.getDisplayName();
+					   categoryName = categoryName == null ? "" : encoder.encode(categoryName);
 			%>
 							<div class="GadgetCategory" id="${category.getName()}">
 								<div class="GadgetTab SelectedTab" onclick="eXo.webui.UIDashboard.onTabClick(this, 'NormalTab', 'SelectedTab')">
 									<div class="LeftCategoryTitleBar">
 										<div class="RightCategoryTitleBar">
 											<div class="MiddleCategoryTitleBar">
-												<div class="ArrowIcon" title="${category.getDisplayName()}">${category.getDisplayName()}</div>
+												<div class="ArrowIcon" title="$categoryName">$categoryName</div>
 											</div>								
 										</div>
 									</div>
@@ -40,12 +46,13 @@
 //                                              uiPopup.setWindowSize(-1, 600);
                                         
 											for(gadget in lstGadgets){
+											   String gadgetName = gadget.getDisplayName();
+											   gadgetName = gadgetName == null ? "" : encoder.encode(gadgetName);
 									%>
 													 	<div class="UIGadget SelectItem Item" id="${gadget.getId()}" style="top:0px; left:0px;">
 													 		<div class="GadgetControl">
-											 					<% def label = gadget.getDisplayName() %> 
-												 				<div class="GadgetTitle" style="cursor:move;" title="$label">
-												 					<%= (label.length() <= 23) ? label : label.substring(0, 20)+"..." %>
+												 				<div class="GadgetTitle" style="cursor:move;" title="$gadgetName">
+												 					<%= (gadgetName.length() <= 23) ? gadgetName : gadgetName.substring(0, 20)+"..." %>
 												 				</div>
 												 			</div>
 														</div>

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroup.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroup.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroup.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -1,10 +1,10 @@
 package org.exoplatform.webui.organization;
 
-import java.io.Serializable;
-
+import org.exoplatform.commons.utils.HTMLEntityEncoder;
 import org.exoplatform.services.organization.Group;
-import org.gatein.common.text.EntityEncoder;
 
+import java.io.Serializable;
+
 public class UIGroup implements Serializable {
 
 	private Group group;
@@ -16,8 +16,7 @@
 	
 	public String getEncodedLabel()
 	{
-		EntityEncoder encoder = EntityEncoder.FULL;
-		return encoder.encode(getLabel());
+		return HTMLEntityEncoder.getInstance().encode(getLabel());
 	}
 	
 	public String getLabel()

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupMembershipSelector.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupMembershipSelector.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupMembershipSelector.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -68,6 +68,7 @@
       tree.setSelectedIcon("PortalIcon");
       tree.setBeanIdField("id");
       tree.setBeanLabelField("label");
+      tree.setEscapeHTML(true);
       uiBreadcumbs.setBreadcumbsStyle("UIExplorerHistoryPath");
    }
 

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupSelector.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupSelector.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupSelector.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -71,6 +71,7 @@
       tree.setBeanIdField("id");
       //tree.setBeanLabelField("groupName");
       tree.setBeanLabelField("label");
+      tree.setEscapeHTML(true);
       uiBreadcumbs.setBreadcumbsStyle("UIExplorerHistoryPath");
    }
 

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/account/UIGroupSelector.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/account/UIGroupSelector.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/eXo/src/main/java/org/exoplatform/webui/organization/account/UIGroupSelector.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -75,6 +75,7 @@
       tree.setBeanIdField("id");
       //tree.setBeanLabelField("groupName");
       tree.setBeanLabelField("label");
+      tree.setEscapeHTML(true);
       uiBreadcumbs.setBreadcumbsStyle("UIExplorerHistoryPath");
    }
 

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/application/UIPortletForm.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/application/UIPortletForm.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/application/UIPortletForm.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -46,6 +46,7 @@
 import org.exoplatform.webui.event.Event.Phase;
 import org.exoplatform.webui.event.EventListener;
 import org.exoplatform.webui.form.*;
+import org.exoplatform.webui.form.validator.NotHTMLTagValidator;
 import org.exoplatform.webui.form.validator.ExpressionValidator;
 import org.exoplatform.webui.form.validator.MandatoryValidator;
 import org.exoplatform.webui.form.validator.StringLengthValidator;
@@ -97,7 +98,7 @@
                      addValidator(MandatoryValidator.class).setEditable(false)).
       addUIFormInput(new UIFormStringInput("windowId", "windowId", null).setEditable(false)).*/
             addUIFormInput(new UIFormInputInfo("displayName", "displayName", null)).addUIFormInput(
-         new UIFormStringInput("title", "title", null).addValidator(StringLengthValidator.class, 3, 60).addValidator(ExpressionValidator.class, "[^\\<\\>]*",
+         new UIFormStringInput("title", "title", null).addValidator(StringLengthValidator.class, 3, 60).addValidator(NotHTMLTagValidator.class,
                "UIPortletForm.msg.InvalidPortletTitle"))
          .addUIFormInput(
             new UIFormStringInput("width", "width", null).addValidator(ExpressionValidator.class, "(^([1-9]\\d*)px$)?",
@@ -107,8 +108,8 @@
          new UIFormCheckBoxInput("showInfoBar", "showInfoBar", false)).addUIFormInput(
          new UIFormCheckBoxInput("showPortletMode", "showPortletMode", false)).addUIFormInput(
          new UIFormCheckBoxInput("showWindowState", "showWindowState", false)).addUIFormInput(
-         new UIFormTextAreaInput("description", "description", null).addValidator(StringLengthValidator.class, 0,
-            255).addValidator(ExpressionValidator.class, "[^\\<\\>]*", "UIPortletForm.msg.InvalidPortletDescription"));
+                  new UIFormTextAreaInput("description", "description", null).addValidator(StringLengthValidator.class,
+                        0, 255).addValidator(NotHTMLTagValidator.class, "UIPortletForm.msg.InvalidPortletDescription"));
       addUIFormInput(uiSettingSet);
       UIFormInputIconSelector uiIconSelector = new UIFormInputIconSelector("Icon", "icon");
       addUIFormInput(uiIconSelector);

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/page/UIPageBrowser.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/page/UIPageBrowser.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/page/UIPageBrowser.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -152,9 +152,13 @@
       String title = titleInput.getValue();
       String ownerType = select.getValue();      
       if (title != null && title != "")
-         query.setTitle(title);
+      {
+         query.setTitle(title.trim());
+      }
       if (siteName != null && siteName != "")
-         query.setOwnerId(siteName);
+      {
+         query.setOwnerId(siteName.trim());
+      }
 
       query.setOwnerType(ownerType);
       query.setName(null);

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/page/UIPageSearchForm.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/page/UIPageSearchForm.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/page/UIPageSearchForm.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -29,6 +29,7 @@
 import org.exoplatform.webui.form.UIFormInputSet;
 import org.exoplatform.webui.form.UIFormSelectBox;
 import org.exoplatform.webui.form.UIFormStringInput;
+import org.exoplatform.webui.form.validator.ExpressionValidator;
 
 import java.util.List;
 
@@ -50,7 +51,7 @@
    {
       UIFormInputSet uiQuickSearchSet = new UIFormInputSet(QUICK_SEARCH_SET);
       uiQuickSearchSet.addUIFormInput(new UIFormStringInput("pageTitle", "pageTitle", null));
-      uiQuickSearchSet.addUIFormInput(new UIFormStringInput("siteName", "siteName", null));
+      uiQuickSearchSet.addUIFormInput(new UIFormStringInput("siteName", "siteName", null).addValidator(ExpressionValidator.class, "[^\\'\"]*", "UISearchForm.msg.empty"));
       uiQuickSearchSet.addUIFormInput(new UIFormSelectBox("searchOption", null, null));
       addChild(uiQuickSearchSet);
    }

Modified: epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/portal/UIPortalForm.java
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/portal/UIPortalForm.java	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/webui/portal/src/main/java/org/exoplatform/portal/webui/portal/UIPortalForm.java	2011-10-10 17:33:08 UTC (rev 7705)
@@ -63,6 +63,7 @@
 import org.exoplatform.webui.form.UIFormTabPane;
 import org.exoplatform.webui.form.validator.IdentifierValidator;
 import org.exoplatform.webui.form.validator.MandatoryValidator;
+import org.exoplatform.webui.form.validator.SpecialCharacterValidator;
 import org.exoplatform.webui.form.validator.StringLengthValidator;
 import org.exoplatform.webui.organization.UIListPermissionSelector;
 import org.exoplatform.webui.organization.UIListPermissionSelector.EmptyIteratorValidator;
@@ -244,7 +245,7 @@
          .addUIFormInput(
             new UIFormSelectBox(FIELD_LOCALE, FIELD_LOCALE, languages).addValidator(MandatoryValidator.class));
       
-      uiSettingSet.addUIFormInput(new UIFormStringInput(FIELD_LABEL, FIELD_LABEL, null));
+      uiSettingSet.addUIFormInput(new UIFormStringInput(FIELD_LABEL, FIELD_LABEL, null).addValidator(SpecialCharacterValidator.class));
       uiSettingSet.addUIFormInput(new UIFormStringInput(FIELD_DESCRIPTION, FIELD_DESCRIPTION, null));
       
       List<SelectItemOption<String>> listSkin = new ArrayList<SelectItemOption<String>>();

Modified: epp/portal/tags/EPP_5_2_0_ER03/wsrp-integration/extension-war/src/main/webapp/WEB-INF/conf/wsrp/wsrp-configuration.xml
===================================================================
--- epp/portal/tags/EPP_5_2_0_ER03/wsrp-integration/extension-war/src/main/webapp/WEB-INF/conf/wsrp/wsrp-configuration.xml	2011-10-10 16:50:55 UTC (rev 7704)
+++ epp/portal/tags/EPP_5_2_0_ER03/wsrp-integration/extension-war/src/main/webapp/WEB-INF/conf/wsrp/wsrp-configuration.xml	2011-10-10 17:33:08 UTC (rev 7705)
@@ -164,9 +164,6 @@
                <name>group.configuration</name>
                <description>description</description>
                <object type="org.exoplatform.portal.config.NewPortalConfig">
-                  <field name="importMode">
-                     <string>merge</string>
-                  </field>
                   <field name="predefinedOwner">
                      <collection type="java.util.HashSet">
                         <value>



More information about the gatein-commits mailing list