From do-not-reply at jboss.org Thu Apr  1 04:01:05 2010
Content-Type: multipart/mixed; boundary="===============0877856147719333034=="
MIME-Version: 1.0
From: do-not-reply at jboss.org
To: gatein-commits at lists.jboss.org
Subject: [gatein-commits] gatein SVN: r2436 -
 portal/branches/EPP_5_0_Branch/web/portal/src/main/webapp/groovy/portal/webui/workspace.
Date: Thu, 01 Apr 2010 04:01:05 -0400
Message-ID: <201004010801.o31815Tx002791@svn01.web.mwc.hst.phx2.redhat.com>

--===============0877856147719333034==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

Author: thomas.heute(a)jboss.com
Date: 2010-04-01 04:01:03 -0400 (Thu, 01 Apr 2010)
New Revision: 2436

Modified:
   portal/branches/EPP_5_0_Branch/web/portal/src/main/webapp/groovy/portal/=
webui/workspace/UIPortalApplication.gtmpl
Log:
JBEPP-193: Security issue in portal URL handler

Modified: portal/branches/EPP_5_0_Branch/web/portal/src/main/webapp/groovy/=
portal/webui/workspace/UIPortalApplication.gtmpl
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- portal/branches/EPP_5_0_Branch/web/portal/src/main/webapp/groovy/portal=
/webui/workspace/UIPortalApplication.gtmpl	2010-04-01 06:52:16 UTC (rev 243=
5)
+++ portal/branches/EPP_5_0_Branch/web/portal/src/main/webapp/groovy/portal=
/webui/workspace/UIPortalApplication.gtmpl	2010-04-01 08:01:03 UTC (rev 243=
6)
@@ -62,25 +62,21 @@
         <script type=3D"text/javascript" src=3D"<%=3DdocBase%>/javascript/=
merged.js"></script>
     <%}%>
     <script type=3D"text/javascript">
-      eXo.env.portal.context =3D '<%=3DdocBase%>' ;
-      <%if(rcontext.getAccessPath() =3D=3D 0) {%>
-          eXo.env.portal.accessMode =3D 'public' ;
-      <%} else {%>
-          eXo.env.portal.accessMode =3D 'private' ;
-      <%}%>
-      eXo.env.portal.portalName =3D '<%=3Drcontext.getPortalOwner()%>' ;
-      eXo.env.server.context =3D '<%=3DdocBase%>' ;
-      eXo.env.server.portalBaseURL =3D '<%=3Drcontext.getURLBuilder().getB=
aseURL()%>' ;
-      eXo.env.client.skin =3D '$skin' ;
+      eXo.env.portal.context =3D "<%=3DdocBase%>" ;
+      <%if(rcontext.getAccessPath() =3D=3D 0) {%>eXo.env.portal.accessMode=
 =3D "public" ;<%}
+      else
+      {%>eXo.env.portal.accessMode =3D "private" ;<%}%>
+      eXo.env.portal.portalName =3D "<%=3Drcontext.getPortalOwner()%>" ;
+      eXo.env.server.context =3D "<%=3DdocBase%>" ;
+      eXo.env.server.portalBaseURL =3D "<%=3Drcontext.getRequest().getRequ=
estURI()%>" ;
+      eXo.env.client.skin =3D "$skin" ;
       <% =

         UIPortal portal =3D uicomponent.findFirstComponentOfType(UIPortal.=
class);
         String sessionAliveLevel =3D (portal =3D=3D null ? null : portal.s=
essionAlive) ;
         boolean canKeepState =3D sessionAliveLevel =3D=3D null ? false : !=
sessionAliveLevel.equals(PortalProperties.SESSION_NEVER) ;
       %>
-      =

       eXo.portal.portalMode =3D <%=3D uicomponent.getModeState() %>;
-      =

-      eXo.session.level =3D '$sessionAliveLevel';
+      eXo.session.level =3D "$sessionAliveLevel";
       eXo.session.canKeepState =3D $canKeepState;
       eXo.session.isOpen =3D $uicomponent.isSessionOpen ;
       eXo.session.itvTime =3D ${((PortalRequestContext)rcontext).getReques=
t().getSession().getMaxInactiveInterval()} ;


--===============0877856147719333034==--