[gatein-commits] gatein SVN: r5065 - epp/portal/branches/EPP_5_1_Branch/web/portal/src/main/webapp/groovy/portal/webui/application.

[do-not-reply at jboss.org]

Author: thomas.heute at jboss.com
Date: 2010-11-12 06:12:24 -0500 (Fri, 12 Nov 2010)
New Revision: 5065

Modified:
   epp/portal/branches/EPP_5_1_Branch/web/portal/src/main/webapp/groovy/portal/webui/application/UIApplicationList.gtmpl
Log:
JBEPP-595: XSS issue in category name input


Modified: epp/portal/branches/EPP_5_1_Branch/web/portal/src/main/webapp/groovy/portal/webui/application/UIApplicationList.gtmpl
===================================================================
--- epp/portal/branches/EPP_5_1_Branch/web/portal/src/main/webapp/groovy/portal/webui/application/UIApplicationList.gtmpl	2010-11-12 10:59:02 UTC (rev 5064)
+++ epp/portal/branches/EPP_5_1_Branch/web/portal/src/main/webapp/groovy/portal/webui/application/UIApplicationList.gtmpl	2010-11-12 11:12:24 UTC (rev 5065)
@@ -1,4 +1,5 @@
 <%
+import org.gatein.common.text.EntityEncoder;
 def categories = uicomponent.getCategories();
 def selectedCategory = uicomponent.getSelectedCategory();
 %>
@@ -17,6 +18,8 @@
 								cName	= category.getName();
 								displayName =category.getDisplayName();
 								if(displayName == null || displayName.length() < 1 ) displayName = cName;
+								EntityEncoder encoder = EntityEncoder.FULL;
+								displayName = encoder.encode(displayName);								
 								if(selectedCategory != null && cName == selectedCategory.getName()) {
 									isSelected = true;
 									cTab = "SelectedTab";
@@ -67,4 +70,4 @@
 		<div class="ClearLeft"><span></span></div>
 	</div>	
 	
-</div>
\ No newline at end of file
+</div>