[gatein-commits] gatein SVN: r5723 - portal/branches/branch-GTNPORTAL-1745/webui/portal/src/main/java/org/exoplatform/portal/application.
Author: ndkhoiits
Date: 2011-01-11 02:07:59 -0500 (Tue, 11 Jan 2011)
New Revision: 5723
Modified:
portal/branches/branch-GTNPORTAL-1745/webui/portal/src/main/java/org/exoplatform/portal/application/PortalRequestContext.java
Log:
GTNPORTAL-1667 XSS issues passed in URL
Modified:
portal/branches/branch-GTNPORTAL-1745/webui/portal/src/main/java/org/exoplatform/portal/application/PortalRequestContext.java
===================================================================
---
portal/branches/branch-GTNPORTAL-1745/webui/portal/src/main/java/org/exoplatform/portal/application/PortalRequestContext.java 2011-01-11
06:50:46 UTC (rev 5722)
+++
portal/branches/branch-GTNPORTAL-1745/webui/portal/src/main/java/org/exoplatform/portal/application/PortalRequestContext.java 2011-01-11
07:07:59 UTC (rev 5723)
@@ -161,7 +161,8 @@
cacheLevel_ = cache;
}
- requestURI_ = URLDecoder.decode(req.getRequestURI(), "UTF-8");
+ requestURI_ = req.getRequestURI();
+ String decodedURI = URLDecoder.decode(requestURI_, "UTF-8");
// req.getPathInfo will already have the encoding set from the server.
// We need to use the UTF-8 value since this is how we store the portal name.
@@ -170,7 +171,7 @@
String contextPath = URLDecoder.decode(req.getContextPath(), "UTF-8");
String pathInfo = "/";
if (requestURI_.length() > servletPath.length() + contextPath.length())
- pathInfo = requestURI_.substring(servletPath.length() + contextPath.length());
+ pathInfo = decodedURI.substring(servletPath.length() + contextPath.length());
int colonIndex = pathInfo.indexOf("/", 1);
if (colonIndex < 0)
@@ -180,13 +181,13 @@
portalOwner_ = pathInfo.substring(1, colonIndex);
nodePath_ = pathInfo.substring(colonIndex, pathInfo.length());
- portalURI = requestURI_.substring(0, requestURI_.lastIndexOf(nodePath_)) +
"/";
+ portalURI = decodedURI.substring(0, decodedURI.lastIndexOf(nodePath_)) +
"/";
- if (requestURI_.indexOf("/public/") >= 0)
+ if (decodedURI.indexOf("/public/") >= 0)
{
accessPath = PUBLIC_ACCESS;
}
- else if (requestURI_.indexOf("/private/") >= 0)
+ else if (decodedURI.indexOf("/private/") >= 0)
{
accessPath = PRIVATE_ACCESS;
}