Author: chris.laprun(a)jboss.com Date: 2009-01-30 18:16:48 -0500 (Fri, 30 Jan 2009) New Revision: 12741 Modified: branches/Enterprise_Portal_Platform_4_3/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminPortlet.java Log: - Added more sanitization of parameter values. However, I am not too familiar with CMS so I am not sure what the proper behavior should be there, or if the default values that I give won't cause side-effects of their own... :( Modified: branches/Enterprise_Portal_Platform_4_3/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminPortlet.java =================================================================== --- branches/Enterprise_Portal_Platform_4_3/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminPortlet.java 2009-01-30 22:45:52 UTC (rev 12740) +++ branches/Enterprise_Portal_Platform_4_3/core-cms/src/main/org/jboss/portal/core/cms/ui/admin/CMSAdminPortlet.java 2009-01-30 23:16:48 UTC (rev 12741) @@ -20,6 +20,7 @@ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA * * 02110-1301 USA, or see the FSF site: http://www.fsf.org. * ******************************************************************************/ + package org.jboss.portal.core.cms.ui.admin; import org.apache.commons.fileupload.FileItem; @@ -985,6 +986,8 @@ if (!item.isFormField()) { String sFilename = item.getName(); + sFilename = ParameterValidation.sanitizeFromPattern(sFilename, CHECK_FOR_XSS_PATTERN, ""); + if (!"".equals(sFilename)) { int backslashIndex = sFilename.lastIndexOf("\\"); @@ -1046,21 +1049,23 @@ else { String fieldName = item.getFieldName(); + String itemValue = item.getString(aReq.getCharacterEncoding()); + itemValue = ParameterValidation.sanitizeFromPattern(itemValue, CHECK_FOR_XSS_PATTERN, ""); if ("destination".equals(fieldName)) { - sPath = item.getString(aReq.getCharacterEncoding()); + sPath = itemValue; } else if ("description".equals(fieldName)) { - sDescription = item.getString(aReq.getCharacterEncoding()); + sDescription = itemValue; } else if ("title".equals(fieldName)) { - sTitle = item.getString(aReq.getCharacterEncoding()); + sTitle = itemValue; } else if ("language".equals(fieldName)) { - sLanguage = item.getString(aReq.getCharacterEncoding()); + sLanguage = itemValue; } } } @@ -1713,7 +1718,7 @@ String language = aReq.getParameter("language"); String version = aReq.getParameter("version"); - //Perform the change in live version here + //Perform the change in live version here Command makeLiveCommand = CMSService.getCommandFactory().createMakeLiveVersionCommand(path, language, version); CMSService.execute(makeLiveCommand); @@ -1783,13 +1788,13 @@ (manageUsers == null || manageUsers.length == 0) ) { - //remove all direct permissions on this node + //remove all direct permissions on this node String uri = this.authorizationManager.getProvider().getCriteriaURI("path", path); this.authorizationManager.getProvider().removeSecurityBindings(uri); return; } - //cleanup the old permissions on this node, before new ones are created + //cleanup the old permissions on this node, before new ones are created String uri = this.authorizationManager.getProvider().getCriteriaURI("path", path); this.authorizationManager.getProvider().removeSecurityBindings(uri);