6:11 p.m.
Author: chris.laprun(a)jboss.com
Date: 2009-05-27 05:11:34 -0400 (Wed, 27 May 2009)
New Revision: 13415
Modified:
branches/JBoss_Portal_Branch_2_7/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminConstants.java
branches/JBoss_Portal_Branch_2_7/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminPortlet.java
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/classes/Resource.properties
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/classes/Resource_fr.properties
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/jsp/cms/admin/edit.jsp
Log:
- JBEPP-86: Fixed problem with disappearing values... We need to TEST this more.
Modified:
branches/JBoss_Portal_Branch_2_7/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminConstants.java
===================================================================
---
branches/JBoss_Portal_Branch_2_7/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminConstants.java 2009-05-26
11:48:45 UTC (rev 13414)
+++
branches/JBoss_Portal_Branch_2_7/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminConstants.java 2009-05-27
09:11:34 UTC (rev 13415)
@@ -121,4 +121,6 @@
public static final String CMS_DATE_PATTERN = "CMS_DATE_PATTERN";
public static final String DATE_FORMAT = "dateFormat";
+
+ public static final String CMS_INVALID_PARAMETER = "CMS_INVALID_PARAMETER";
}
Modified:
branches/JBoss_Portal_Branch_2_7/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminPortlet.java
===================================================================
---
branches/JBoss_Portal_Branch_2_7/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminPortlet.java 2009-05-26
11:48:45 UTC (rev 13414)
+++
branches/JBoss_Portal_Branch_2_7/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminPortlet.java 2009-05-27
09:11:34 UTC (rev 13415)
@@ -48,7 +48,6 @@
import org.jboss.portal.cms.workflow.CMSWorkflowUtil;
import org.jboss.portal.common.util.ParameterValidation;
import org.jboss.portal.core.cms.command.StreamContentCommand;
-import org.jboss.portal.core.cms.ui.Util;
import org.jboss.portal.core.controller.ControllerContext;
import org.jboss.portal.identity.AnonymousRole;
import org.jboss.portal.identity.IdentityException;
@@ -112,6 +111,8 @@
private static final String SLASH = "/";
private static final String INVALID_TITLE = "Invalid title";
private static final String INVALID_DESCRIPTION = "Invalid description";
+ private static final String INVALID_LANG = "INVALID_LANG";
+ private static final String ERROR_MESSAGE = "error:message";
public void init() throws PortletException
@@ -335,10 +336,10 @@
rRes.setContentType("text/html");
rReq.setAttribute("createpath", sPath);
- String parameter = rReq.getParameter("error:message");
+ String parameter = rReq.getParameter(ERROR_MESSAGE);
if (parameter != null)
{
- rReq.setAttribute("error:message", parameter);
+ rReq.setAttribute(ERROR_MESSAGE, parameter);
}
parameter = rReq.getParameter("error:newcollectionname");
if (parameter != null)
@@ -616,10 +617,10 @@
{
rReq.setAttribute("error:filename", parameter);
}
- parameter = rReq.getParameter("error:message");
+ parameter = rReq.getParameter(ERROR_MESSAGE);
if (parameter != null)
{
- rReq.setAttribute("error:message", parameter);
+ rReq.setAttribute(ERROR_MESSAGE, parameter);
}
javax.portlet.PortletRequestDispatcher prd =
getPortletContext().getRequestDispatcher(CMSAdminConstants.CMS_JSP_PATH +
"/create.jsp");
@@ -679,6 +680,7 @@
rReq.setAttribute("language", sLanguage);
rReq.setAttribute("title", file.getContent().getTitle());
rReq.setAttribute("description", file.getContent().getDescription());
+ rReq.setAttribute(ERROR_MESSAGE, rReq.getParameter(ERROR_MESSAGE));
javax.portlet.PortletRequestDispatcher prd =
getPortletContext().getRequestDispatcher(CMSAdminConstants.CMS_JSP_PATH +
"/edit.jsp");
prd.include(rReq, rRes);
@@ -942,7 +944,7 @@
aRes.setRenderParameter("path",
aReq.getParameter("destination"));
//used to remember the data already submitted by the user
- aRes.setRenderParameter("error:message",
CMSAdminConstants.CMS_FOLDERNAME_INVALID);
+ aRes.setRenderParameter(ERROR_MESSAGE,
CMSAdminConstants.CMS_FOLDERNAME_INVALID);
aRes.setRenderParameter("error:newcollectionname",
aReq.getParameter("newcollectionname"));
aRes.setRenderParameter("error:newcollectiondescription",
aReq.getParameter("newcollectiondescription"));
@@ -964,7 +966,7 @@
aRes.setRenderParameter("path",
aReq.getParameter("destination"));
//used to remember the data already submitted by the user
- aRes.setRenderParameter("error:message",
CMSAdminConstants.CMS_FOLDERNAME_INVALID);
+ aRes.setRenderParameter(ERROR_MESSAGE,
CMSAdminConstants.CMS_FOLDERNAME_INVALID);
aRes.setRenderParameter("error:newcollectionname",
aReq.getParameter("newcollectionname"));
aRes.setRenderParameter("error:newcollectiondescription",
aReq.getParameter("newcollectiondescription"));
}
@@ -1386,7 +1388,7 @@
String sDescription = aReq.getParameter("description");
String sLanguage = aReq.getParameter("language");
- sFileName = ParameterValidation.sanitizeFromPattern(sFileName,
CHECK_FOR_XSS_PATTERN, "");
+ sFileName = ParameterValidation.sanitizeFromPattern(sFileName,
CHECK_FOR_XSS_PATTERN, "");
sDirectory = ParameterValidation.sanitizeFromPattern(sDirectory,
CHECK_FOR_XSS_PATTERN, SLASH);
sTitle = ParameterValidation.sanitizeFromPattern(sTitle,
CHECK_FOR_XSS_PATTERN, INVALID_TITLE);
sDescription = ParameterValidation.sanitizeFromPattern(sDescription,
CHECK_FOR_XSS_PATTERN, INVALID_DESCRIPTION);
@@ -1464,7 +1466,7 @@
aRes.setRenderParameter("path", sDirectory);
//used to remember the data already submitted by the user
- aRes.setRenderParameter("error:message",
CMSAdminConstants.CMS_FILENAME_INVALID);
+ aRes.setRenderParameter(ERROR_MESSAGE,
CMSAdminConstants.CMS_FILENAME_INVALID);
aRes.setRenderParameter("error:filename",
aReq.getParameter("filename"));
aRes.setRenderParameter("error:content",
aReq.getParameter("elm1"));
aRes.setRenderParameter("error:description",
aReq.getParameter("description"));
@@ -1497,22 +1499,56 @@
else if (CMSAdminConstants.OP_SAVETEXT.equals(op))
{
String sFilePath = aReq.getParameter("savetopath");
- String sTitle = aReq.getParameter("title");
- String sDescription = aReq.getParameter("description");
- String sLanguage = aReq.getParameter("language");
-
- sTitle = ParameterValidation.sanitizeFromPattern(sTitle,
CHECK_FOR_XSS_PATTERN, "");
- sDescription = ParameterValidation.sanitizeFromPattern(sDescription,
CHECK_FOR_XSS_PATTERN, "");
- sLanguage = ParameterValidation.sanitizeFromPattern(sLanguage,
CHECK_FOR_XSS_PATTERN, "en");
-
- String sMakeLive = "off";
- if (aReq.getParameterValues("makelive") != null)
+ if (!"".equals(sFilePath) &&
CHECK_FOR_XSS_PATTERN.matcher(sFilePath).matches())
{
- sMakeLive = "on";
- }
+ String sTitle = aReq.getParameter("title");
+ String sDescription = aReq.getParameter("description");
+ String sLanguage = aReq.getParameter("language");
- if (!"".equals(sFilePath) &&
CHECK_FOR_XSS_PATTERN.matcher(sFilePath).matches())
- {
+ // check title and description for XSS injection... If one found,
re-display page with old values
+ String parameter = null;
+ sTitle = ParameterValidation.sanitizeFromPattern(sTitle,
CHECK_FOR_XSS_PATTERN, INVALID_TITLE);
+ boolean invalidTitle = INVALID_TITLE.equals(sTitle);
+ if(invalidTitle)
+ {
+ parameter = "CMS_TITLE";
+ }
+ sDescription = ParameterValidation.sanitizeFromPattern(sDescription,
CHECK_FOR_XSS_PATTERN, INVALID_DESCRIPTION);
+ boolean invalidDesc = INVALID_DESCRIPTION.equals(sDescription);
+ if(invalidDesc)
+ {
+ parameter = "CMS_DESCRIPTION";
+ }
+
+ sLanguage = ParameterValidation.sanitizeFromPattern(sLanguage,
CHECK_FOR_XSS_PATTERN, INVALID_LANG);
+ boolean invalidLang = INVALID_LANG.equals(sLanguage);
+ if(invalidLang)
+ {
+ parameter = "CMS_LANGUAGE";
+ }
+
+ if (invalidTitle || invalidDesc || invalidLang)
+ {
+ aRes.setRenderParameter("op", CMSAdminConstants.OP_EDIT);
+
+ // output error message
+ aRes.setRenderParameter(ERROR_MESSAGE,
CMSAdminConstants.CMS_INVALID_PARAMETER);
+
+ aRes.setRenderParameter("path",
aReq.getParameter("savetopath"));
+ aRes.setRenderParameter("language",
aReq.getParameter("language"));
+
+ return;
+ }
+
+ Locale locale = new Locale(sLanguage);
+
+ String sMakeLive = "off";
+ if (aReq.getParameterValues("makelive") != null)
+ {
+ sMakeLive = "on";
+ }
+
+
String sContent = aReq.getParameter("elm1");
File file = new FileImpl();
@@ -1533,9 +1569,9 @@
content.setTitle(sTitle);
content.setDescription(sDescription);
- content.setBasePath(sFilePath + SLASH + new
Locale(sLanguage).getLanguage());
+ content.setBasePath(sFilePath + SLASH + locale.getLanguage());
content.setBytes(sContent.getBytes());
- file.setContent(new Locale(sLanguage), content);
+ file.setContent(locale, content);
boolean bMakeLive = false;
if ("on".equalsIgnoreCase(sMakeLive))
Modified:
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/classes/Resource.properties
===================================================================
---
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/classes/Resource.properties 2009-05-26
11:48:45 UTC (rev 13414)
+++
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/classes/Resource.properties 2009-05-27
09:11:34 UTC (rev 13415)
@@ -143,6 +143,7 @@
CMS_FILENAME_INVALID=File Name is invalid. It may not contain illegal characters such as
'.', '/', ':', '[', ']', '*',
''', '"', '|' or any whitespace character.
CMS_FOLDERNAME_INVALID=Folder Name is invalid. It may not contain illegal characters such
as '.', '/', ':', '[', ']', '*',
''', '"', '|' or any whitespace character.
+CMS_INVALID_PARAMETER=A value below is invalid. It may not contain illegal characters
such as '\\', '<', '>', '(', ')',
'=' or '%5c'.
CMS_MSG_DESTINATION_ALREADY_EXISTS=The command was not performed, because the destination
already exists.
CMS_CANT_MOVE_SAME_DESTINATION=You cannot move a folder to the same location
Modified:
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/classes/Resource_fr.properties
===================================================================
---
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/classes/Resource_fr.properties 2009-05-26
11:48:45 UTC (rev 13414)
+++
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/classes/Resource_fr.properties 2009-05-27
09:11:34 UTC (rev 13415)
@@ -32,23 +32,23 @@
CMS_CANCEL = Annuler
-CMS_CONTENT_DIR = R\u00E9pertoire de contenu
+CMS_CONTENT_DIR = R\u00e9pertoire de contenu
-CMS_CONTENT_DIR_USE = Utilisez l'arborescence des dossiers afin de parcourir la
structure du r\u00E9pertoire.
+CMS_CONTENT_DIR_USE = Utilisez l'arborescence des dossiers afin de parcourir la
structure du r\u00e9pertoire.
CMS_COPY = Copier
-CMS_CREATE = Cr\u00E9er
+CMS_CREATE = Cr\u00e9er
-CMS_CREATED = Cr\u00E9\u00E9
+CMS_CREATED = Cr\u00e9\u00e9
-CMS_CREATED_BY = Cr\u00E9\u00E9 par
+CMS_CREATED_BY = Cr\u00e9\u00e9 par
-CMS_CREATEFILE = Cr\u00E9er un fichier
+CMS_CREATEFILE = Cr\u00e9er un fichier
-CMS_CREATEFILEINDIR = Cr\u00E9er un fichier dans le dossier
+CMS_CREATEFILEINDIR = Cr\u00e9er un fichier dans le dossier
-CMS_CREATEFOLDER = Cr\u00E9er un dossier
+CMS_CREATEFOLDER = Cr\u00e9er un dossier
CMS_DELETE = Supprimer
@@ -56,7 +56,7 @@
CMS_DELETEWARN1 = ATTENTION ! Vous ne pourrez pas annuler cette action.
-CMS_DELETEWARN2 = \u00CAtes vous certain de vouloir supprimer cette ressource ?
+CMS_DELETEWARN2 = \u00cates vous certain de vouloir supprimer cette ressource ?
CMS_DENY = Refuser
@@ -78,35 +78,35 @@
CMS_LANGUAGE = Langue
-CMS_LIVE = Diffusion imm\u00E9diate
+CMS_LIVE = Diffusion imm\u00e9diate
CMS_LIVEVERSION = Version en ligne
-CMS_MAIN_USE = Utilisez le portlet d'administration du CMS afin de modifier le
contenu de votre r\u00E9pertoire.
+CMS_MAIN_USE = Utilisez le portlet d'administration du CMS afin de modifier le
contenu de votre r\u00e9pertoire.
-CMS_MANAGE = G\u00E9rer le contenu
+CMS_MANAGE = G\u00e9rer le contenu
CMS_MENU = Menu action
-CMS_MODIFIED = Derni\u00E8re modification
+CMS_MODIFIED = Derni\u00e8re modification
CMS_MODIFY = Modifier
-CMS_MOVE = D\u00E9placer
+CMS_MOVE = D\u00e9placer
CMS_NAME = Nom
CMS_PATH = Emplacement
-CMS_PREVIEW = Pr\u00E9visualiser
+CMS_PREVIEW = Pr\u00e9visualiser
-CMS_RESET = R\u00E9initialiser
+CMS_RESET = R\u00e9initialiser
CMS_SEARCH = Rechercher
-CMS_SEARCHNORESULT = Aucun r\u00E9sultat pour cette recherche
+CMS_SEARCHNORESULT = Aucun r\u00e9sultat pour cette recherche
-CMS_SECURE = S\u00E9curiser
+CMS_SECURE = S\u00e9curiser
CMS_SIZE = Taille
@@ -118,23 +118,23 @@
CMS_TYPE = Type
-CMS_UPLOAD = T\u00E9l\u00E9d\u00E9verser
+CMS_UPLOAD = T\u00e9l\u00e9d\u00e9verser
-CMS_UPLOADARCHIVE = T\u00E9l\u00E9d\u00E9verser une archive
+CMS_UPLOADARCHIVE = T\u00e9l\u00e9d\u00e9verser une archive
CMS_VERSION = Version
CMS_VIEW = Visualiser
-CMS_WYSIWYG = \u00C9diteur visuel WYSIWYG
+CMS_WYSIWYG = \u00c9diteur visuel WYSIWYG
TITLE_BROWSE = Navigateur de dossiers
TITLE_COPYCONFIRM = Confirmer la copie
-TITLE_CREATE = Cr\u00E9er un fichier
+TITLE_CREATE = Cr\u00e9er un fichier
-TITLE_CREATECOLLCONFIRM = Confirmer la cr\u00E9ation d'un r\u00E9pertoire
+TITLE_CREATECOLLCONFIRM = Confirmer la cr\u00e9ation d'un r\u00e9pertoire
TITLE_DELETECONFIRM = Confirmer la suppression
@@ -145,17 +145,19 @@
## CMS ADMIN PORTLET
TITLE_HEAD = Administration du CMS
-TITLE_MOVECONFIRM = Confirmer le d\u00E9placement
+TITLE_MOVECONFIRM = Confirmer le d\u00e9placement
-TITLE_SECURECONFIRM = S\u00E9curiser le noeud
+TITLE_SECURECONFIRM = S\u00e9curiser le noeud
-TITLE_UPLOAD = T\u00E9l\u00E9d\u00E9verser un fichier
+TITLE_UPLOAD = T\u00e9l\u00e9d\u00e9verser un fichier
-TITLE_VIEWFILE = Propri\u00E9t\u00E9s du fichier
+TITLE_VIEWFILE = Propri\u00e9t\u00e9s du fichier
-CMS_ACCESS_DENIED=Acc\u00E9s interdit
-CMS_ACCESS_DENIED_DESCRIPTION=Vous n'\u00eates pas autoris\u00E9 \u00e0 acc\u00e9der
a ce document
-CMS_ACCESS_DENIED_DESCRIPTION_PATH=Vous n'\u00eates pas autoris\u00E9 \u00e0
acc\u00e9der au document
+CMS_ACCESS_DENIED=Acc\u00e9s interdit
+CMS_ACCESS_DENIED_DESCRIPTION=Vous n'\u00eates pas autoris\u00e9 \u00e0 acc\u00e9der
a ce document
+CMS_ACCESS_DENIED_DESCRIPTION_PATH=Vous n'\u00eates pas autoris\u00e9 \u00e0
acc\u00e9der au document
-CMS_MISSING_DOCUMENT=404 - Page non trouv\u00E9e
-CMS_MISSING_DOCUMENT_DESCRIPTION=Le document auquel vous avez tent\u00E9
d'acc\u00E9der est introuvable
+CMS_MISSING_DOCUMENT=404 - Page non trouv\u00e9e
+CMS_MISSING_DOCUMENT_DESCRIPTION=Le document auquel vous avez tent\u00e9
d'acc\u00e9der est introuvable
+
+CMS_INVALID_PARAMETER=Une valeur ci-dessous est invalide car elle contient des
caract\u00e8rs invalides '\\', '<', '>', '(',
')', '=' ou '%5c'.
\ No newline at end of file
Modified:
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/jsp/cms/admin/edit.jsp
===================================================================
---
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/jsp/cms/admin/edit.jsp 2009-05-26
11:48:45 UTC (rev 13414)
+++
branches/JBoss_Portal_Branch_2_7/core-cms/src/resources/portal-cms-war/WEB-INF/jsp/cms/admin/edit.jsp 2009-05-27
09:11:34 UTC (rev 13415)
@@ -21,6 +21,9 @@
String sVersion = (String)request.getAttribute("version");
String sTitle = (String)request.getAttribute("title");
String sDescription = (String)request.getAttribute("description");
+
+ // for error handling
+ String errorMessage = (String)request.getAttribute("error:message");
%>
<!-- tinyMCE -->
@@ -74,8 +77,20 @@
<tr>
<td height="10"></td>
</tr>
+
+ <%
+ if(errorMessage != null)
+ {
+ %>
+ <tr>
+ <td><span style="color:
red">${n:i18n("CMS_INVALID_PARAMETER")}></span></td>
+ </tr>
+ <%
+ }
+ %>
<tr>
- <td>
+ <td></td>
+</tr>
<tr>
<td>
<table>