[gatein-commits] gatein SVN: r7399 - in portal/branches/xss/webui: eXo/src/main/java/org/exoplatform/webui/organization and 1 other directories.

Author: ndkhoiits Date: 2011-09-14 02:10:00 -0400 (Wed, 14 Sep 2011) New Revision: 7399 Modified: portal/branches/xss/webui/core/src/main/java/org/exoplatform/webui/core/UITree.java portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupMembershipSelector.java portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupSelector.java portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/account/UIGroupSelector.java Log: GTNPORTAL-2090 XSS issue in application select permission editor Modified: portal/branches/xss/webui/core/src/main/java/org/exoplatform/webui/core/UITree.java =================================================================== --- portal/branches/xss/webui/core/src/main/java/org/exoplatform/webui/core/UITree.java 2011-09-14 04:48:39 UTC (rev 7398) +++ portal/branches/xss/webui/core/src/main/java/org/exoplatform/webui/core/UITree.java 2011-09-14 06:10:00 UTC (rev 7399) @@ -27,6 +27,7 @@ import org.exoplatform.webui.event.Event; import org.exoplatform.webui.event.EventListener; import org.exoplatform.webui.form.UIForm; +import org.gatein.common.text.EntityEncoder; import java.lang.reflect.Method; import java.util.Collection; @@ -117,6 +118,11 @@ * A right click popup menu */ private UIRightClickPopupMenu uiPopupMenu_; + + /** + * Encode the value before rendering or not + */ + private boolean escapeHTML_ = false; public Object getFieldValue(Object bean, String field) throws Exception { @@ -260,6 +266,16 @@ uiPopupMenu_.setParent(this); } + public void setEscapeHTML(boolean escape) + { + escapeHTML_ = escape; + } + + public boolean getEscapeHTML() + { + return escapeHTML_; + } + public String event(String name, String beanId) throws Exception { UIForm uiForm = getAncestorOfType(UIForm.class); @@ -305,6 +321,12 @@ { fieldValue = fieldValue.substring(0, getMaxTitleCharacter() - 3) + "..."; } + + if (escapeHTML_) + { + fieldValue = fieldValue != null ? EntityEncoder.FULL.encode(fieldValue) : fieldValue; + } + if (nodeIcon.equals(expandIcon)) { builder.append(" <div class=\"").append(nodeIcon).append("\" onclick=\"").append(actionLink).append("\">"); Modified: portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupMembershipSelector.java =================================================================== --- portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupMembershipSelector.java 2011-09-14 04:48:39 UTC (rev 7398) +++ portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupMembershipSelector.java 2011-09-14 06:10:00 UTC (rev 7399) @@ -68,6 +68,7 @@ tree.setSelectedIcon("PortalIcon"); tree.setBeanIdField("id"); tree.setBeanLabelField("label"); + tree.setEscapeHTML(true); uiBreadcumbs.setBreadcumbsStyle("UIExplorerHistoryPath"); } Modified: portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupSelector.java =================================================================== --- portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupSelector.java 2011-09-14 04:48:39 UTC (rev 7398) +++ portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/UIGroupSelector.java 2011-09-14 06:10:00 UTC (rev 7399) @@ -71,6 +71,7 @@ tree.setBeanIdField("id"); //tree.setBeanLabelField("groupName"); tree.setBeanLabelField("label"); + tree.setEscapeHTML(true); uiBreadcumbs.setBreadcumbsStyle("UIExplorerHistoryPath"); } Modified: portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/account/UIGroupSelector.java =================================================================== --- portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/account/UIGroupSelector.java 2011-09-14 04:48:39 UTC (rev 7398) +++ portal/branches/xss/webui/eXo/src/main/java/org/exoplatform/webui/organization/account/UIGroupSelector.java 2011-09-14 06:10:00 UTC (rev 7399) @@ -75,6 +75,7 @@ tree.setBeanIdField("id"); //tree.setBeanLabelField("groupName"); tree.setBeanLabelField("label"); + tree.setEscapeHTML(true); uiBreadcumbs.setBreadcumbsStyle("UIExplorerHistoryPath"); }