Author: ndkhoiits Date: 2011-09-12 06:38:27 -0400 (Mon, 12 Sep 2011) New Revision: 7351 Modified: portal/branches/xss-issues/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UISiteManagement.gtmpl portal/branches/xss-issues/webui/portal/src/main/java/org/exoplatform/portal/webui/portal/UIPortalForm.java Log: GTNPORTAL-2062 XSS issue when entering site description Modified: portal/branches/xss-issues/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UISiteManagement.gtmpl =================================================================== --- portal/branches/xss-issues/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UISiteManagement.gtmpl 2011-09-12 10:26:25 UTC (rev 7350) +++ portal/branches/xss-issues/portlet/exoadmin/src/main/webapp/groovy/navigation/webui/component/UISiteManagement.gtmpl 2011-09-12 10:38:27 UTC (rev 7351) @@ -1,76 +1,81 @@ <% + import org.exoplatform.portal.config.UserPortalConfigService; import org.exoplatform.webui.core.UIComponent ; import org.exoplatform.webui.form.UIForm; - import java.text.DateFormat; - import java.text.SimpleDateFormat; - import org.exoplatform.portal.config.UserPortalConfigService; - + + import org.gatein.common.text.EntityEncoder; + String[] actions = uicomponent.getActions(); uicomponent.loadPortalConfigs(); def rcontext = _ctx.getRequestContext(); def userPortalConfigService = uicomponent.getApplicationComponent(UserPortalConfigService.class); def defaultPortalName = userPortalConfigService.getDefaultPortal(); + EntityEncoder encoder = EntityEncoder.FULL; + + String editLayoutLabel = _ctx.appRes("UISiteManagement.label.editLayout"); + String editNavigationLabel = _ctx.appRes("UISiteManagement.label.editNav"); + String editPortalPropLabel = _ctx.appRes("UISiteManagement.label.editPortalProp"); + String deletePortalLabel = _ctx.appRes("UISiteManagement.label.deletePortal"); %> <div class="UISiteManagement UIManagement" id="<%=uicomponent.getId();%>"> - <% - for (portalConfig in uicomponent.getPortalConfigs()) { - %> - <table class="ManagementBlock" style="table-layout: fixed"> - <tr> - <td class="Image"><img src="/exoadmin/skin/navigation/webui/component/background/PlImg.gif" alt=""/></td> - <td class="Content"> + <% + for (portalConfig in uicomponent.getPortalConfigs()) { + %> + <table class="ManagementBlock" style="table-layout: fixed"> + <tr> + <td class="Image"><img src="/exoadmin/skin/navigation/webui/component/background/PlImg.gif" alt=""/></td> + <td class="Content"> <div class="Label"><%=uicomponent.getFieldValue(portalConfig, 'name') %></div> <% - def siteLabel = uicomponent.getFieldValue(portalConfig, 'label'); - def siteDescription = uicomponent.getFieldValue(portalConfig, 'description'); - if (siteLabel != null && siteLabel.trim().length() > 0) - { + String siteLabel = uicomponent.getFieldValue(portalConfig, 'label'); + if (siteLabel != null && siteLabel.trim().length() > 0) { + siteLabel = encoder.encode(siteLabel); print """<div>$siteLabel</div>"""; } - if (siteDescription != null && siteDescription.trim().length() > 0) - { + + String siteDescription = uicomponent.getFieldValue(portalConfig, 'description'); + if (siteDescription != null && siteDescription.trim().length() > 0) { + siteDescription = encoder.encode(siteDescription); print """<div>$siteDescription</div>"""; } %> - </td> - <td class="ActionBlock"> - <a href="<%=uicomponent.event("EditPortalLayout", portalConfig.getName());%>" class="EditLayoutIcon"><%=_ctx.appRes("UISiteManagement.label.editLayout")%></a> - <a href="<%=uicomponent.event("EditNavigation", portalConfig.getName());%>" class="EditNavIcon"><%=_ctx.appRes("UISiteManagement.label.editNav")%></a> - <a href="javascript:ajaxGet(eXo.env.server.createPortalURL('UIPortal', 'EditPortalProperties', true, [{name:'portalName',value:'<%=portalConfig.getName()%>'}]))" class="EditNavIcon"><%=_ctx.appRes("UISiteManagement.label.editPortalProp")%></a> - - <% if(defaultPortalName != null && !defaultPortalName.equals(portalConfig.getName())) {%> - <a href="<%=uicomponent.url("DeletePortal", portalConfig.getName());%>" class="DeleteIcon"><%=_ctx.appRes("UISiteManagement.label.deletePortal")%></a> - <% } %> - </td> - </tr> - </table> - <% - } - %> - <% - if(uicomponent.getPortalConfigs() != null && uicomponent.getPortalConfigs().size() > 0){ - %> - <div class="UIAction"> + </td> + <td class="ActionBlock"> + <a href="<%=uicomponent.event("EditPortalLayout", portalConfig.getName());%>" class="EditLayoutIcon">$editLayoutLabel</a> + <a href="<%=uicomponent.event("EditNavigation", portalConfig.getName());%>" class="EditNavIcon">$editNavigationLabel</a> + <a href="javascript:ajaxGet(eXo.env.server.createPortalURL('UIPortal', 'EditPortalProperties', true, [{name:'portalName',value:'<%=portalConfig.getName()%>'}]))" class="EditNavIcon">$editPortalPropLabel</a> + + <% if(defaultPortalName != null && !defaultPortalName.equals(portalConfig.getName())) {%> + <a href="<%=uicomponent.url("DeletePortal", portalConfig.getName());%>" class="DeleteIcon">$deletePortalLabel</a> + <% } %> + </td> + </tr> + </table> + <% + } + %> + <% + if(uicomponent.getPortalConfigs() != null && uicomponent.getPortalConfigs().size() > 0){ + %> + <div class="UIAction"> <table class="ActionContainer"> - <tr> - <td> - <div onclick="ajaxGet(eXo.env.server.createPortalURL('UIWorkingWorkspace', 'CreatePortal', true))" class="ActionButton BlueButton"> - <div class="ButtonLeft"> - <div class="ButtonRight"> - <div class="ButtonMiddle"> - <a href="javascript:void(0);"><%=_ctx.appRes(uicomponent.getId() + ".action.addNewPortal")%></a> - </div> - </div> - </div> - </div> - </td> + <tr> + <td> + <div onclick="ajaxGet(eXo.env.server.createPortalURL('UIWorkingWorkspace', 'CreatePortal', true))" class="ActionButton BlueButton"> + <div class="ButtonLeft"> + <div class="ButtonRight"> + <div class="ButtonMiddle"> + <a href="javascript:void(0);"><%=_ctx.appRes(uicomponent.getId() + ".action.addNewPortal")%></a> + </div> + </div> + </div> + </div> + </td> </tr> - </table> - </div> - <% - } - %> - <%uicomponent.renderChildren();%> -</div> - - + </table> + </div> + <% + } + %> + <%uicomponent.renderChildren();%> +</div> \ No newline at end of file Modified: portal/branches/xss-issues/webui/portal/src/main/java/org/exoplatform/portal/webui/portal/UIPortalForm.java =================================================================== --- portal/branches/xss-issues/webui/portal/src/main/java/org/exoplatform/portal/webui/portal/UIPortalForm.java 2011-09-12 10:26:25 UTC (rev 7350) +++ portal/branches/xss-issues/webui/portal/src/main/java/org/exoplatform/portal/webui/portal/UIPortalForm.java 2011-09-12 10:38:27 UTC (rev 7351) @@ -63,6 +63,7 @@ import org.exoplatform.webui.form.UIFormTabPane; import org.exoplatform.webui.form.validator.IdentifierValidator; import org.exoplatform.webui.form.validator.MandatoryValidator; +import org.exoplatform.webui.form.validator.SpecialCharacterValidator; import org.exoplatform.webui.form.validator.StringLengthValidator; import org.exoplatform.webui.organization.UIListPermissionSelector; import org.exoplatform.webui.organization.UIListPermissionSelector.EmptyIteratorValidator; @@ -242,7 +243,7 @@ new UIFormStringInput(FIELD_NAME, FIELD_NAME, null).addValidator(MandatoryValidator.class).addValidator( StringLengthValidator.class, 3, 30).addValidator(IdentifierValidator.class).setEditable(false)); - uiSettingSet.addUIFormInput(new UIFormStringInput(FIELD_LABEL, FIELD_LABEL, null)); + uiSettingSet.addUIFormInput(new UIFormStringInput(FIELD_LABEL, FIELD_LABEL, null).addValidator(SpecialCharacterValidator.class)); uiSettingSet.addUIFormInput(new UIFormStringInput(FIELD_DESCRIPTION, FIELD_DESCRIPTION, null)); uiSettingSet.addUIFormInput(new UIFormSelectBox(FIELD_LOCALE, FIELD_LOCALE, languages).addValidator(MandatoryValidator.class));