Author: deepak
Date: Sun Feb 3 09:34:47 2019
New Revision: 1852818
URL: http://svn.apache.org/viewvc?rev=1852818&view=rev
Log:
Fixed: Html escaping missing for portalPageId parameter of Help button
(OFBIZ-10828)
Thanks, Niels Heinen of the Google security team for reporting the issue.
Modified:
ofbiz/ofbiz-framework/trunk/themes/bluelight/template/Header.ftl
ofbiz/ofbiz-framework/trunk/themes/flatgrey/template/Header.ftl
ofbiz/ofbiz-framework/trunk/themes/rainbowstone/template/includes/TopAppBar.ftl
ofbiz/ofbiz-framework/trunk/themes/tomahawk/template/AppBarClose.ftl
Modified: ofbiz/ofbiz-framework/trunk/themes/bluelight/template/Header.ftl
URL:
http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/themes/bluelight/template/Header.ftl?rev=1852818&r1=1852817&r2=1852818&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/themes/bluelight/template/Header.ftl (original)
+++ ofbiz/ofbiz-framework/trunk/themes/bluelight/template/Header.ftl Sun Feb 3
09:34:47 2019
@@ -194,7 +194,7 @@ under the License.
<#--if webSiteId?? && requestAttributes._CURRENT_VIEW_?? &&
helpTopic??-->
<#if parameters.componentName?? &&
requestAttributes._CURRENT_VIEW_?? && helpTopic??>
<#include
"component://common-theme/template/includes/HelpLink.ftl" />
- <li><a class="help-link <#if pageAvail?has_content> alert</#if>"
href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${parameters.portalPageId!}','help'
,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
+ <li><a class="help-link <#if pageAvail?has_content> alert</#if>"
href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${(parameters.portalPageId!)?html}','help'
,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
</#if>
<#if userLogin??>
<#if "Y" == (userPreferences.COMPACT_HEADER)?default("N")>
Modified: ofbiz/ofbiz-framework/trunk/themes/flatgrey/template/Header.ftl
URL:
http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/themes/flatgrey/template/Header.ftl?rev=1852818&r1=1852817&r2=1852818&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/themes/flatgrey/template/Header.ftl (original)
+++ ofbiz/ofbiz-framework/trunk/themes/flatgrey/template/Header.ftl Sun Feb 3
09:34:47 2019
@@ -156,7 +156,7 @@ under the License.
<#---if webSiteId?? && requestAttributes._CURRENT_VIEW_?? &&
helpTopic??-->
<#if parameters.componentName?? &&
requestAttributes._CURRENT_VIEW_?? && helpTopic??>
<#include
"component://common-theme/template/includes/HelpLink.ftl" />
- <li><a <#if pageAvail?has_content>class="alert"</#if>
href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${parameters.portalPageId!}','help'
,500,500);">${uiLabelMap.CommonHelp}</a></li>
+ <li><a <#if pageAvail?has_content>class="alert"</#if>
href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${(parameters.portalPageId!)?html}','help'
,500,500);">${uiLabelMap.CommonHelp}</a></li>
</#if>
</ul>
</li>
Modified:
ofbiz/ofbiz-framework/trunk/themes/rainbowstone/template/includes/TopAppBar.ftl
URL:
http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/themes/rainbowstone/template/includes/TopAppBar.ftl?rev=1852818&r1=1852817&r2=1852818&view=diff
==============================================================================
---
ofbiz/ofbiz-framework/trunk/themes/rainbowstone/template/includes/TopAppBar.ftl
(original)
+++
ofbiz/ofbiz-framework/trunk/themes/rainbowstone/template/includes/TopAppBar.ftl
Sun Feb 3 09:34:47 2019
@@ -238,7 +238,7 @@ under the License.
<div id="main-nav-bar-right">
<div id="company-logo"></div>
<#if parameters.componentName?exists &&
requestAttributes._CURRENT_VIEW_?exists && helpTopic?exists>
- <a class="dark-color" title="${uiLabelMap.CommonHelp}"
href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${parameters.portalPageId!}','help'
,500,500);"><img class="appbar-btn-img" id="help-btn"
src="/rainbowstone/images/help.svg" alt="Help"></a>
+ <a class="dark-color" title="${uiLabelMap.CommonHelp}"
href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${(parameters.portalPageId!)?html}','help'
,500,500);"><img class="appbar-btn-img" id="help-btn"
src="/rainbowstone/images/help.svg" alt="Help"></a>
</#if>
<#include "component://rainbowstone/template/includes/Avatar.ftl"/>
Modified: ofbiz/ofbiz-framework/trunk/themes/tomahawk/template/AppBarClose.ftl
URL:
http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/themes/tomahawk/template/AppBarClose.ftl?rev=1852818&r1=1852817&r2=1852818&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/themes/tomahawk/template/AppBarClose.ftl
(original)
+++ ofbiz/ofbiz-framework/trunk/themes/tomahawk/template/AppBarClose.ftl Sun
Feb 3 09:34:47 2019
@@ -75,7 +75,7 @@ under the License.
<#--if webSiteId?? && requestAttributes._CURRENT_VIEW_?? &&
helpTopic??-->
<#if parameters.componentName?? && requestAttributes._CURRENT_VIEW_?? &&
helpTopic??>
<#include "component://common-theme/template/includes/HelpLink.ftl" />
- <li><a class="help-link <#if pageAvail?has_content> alert</#if>"
href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${parameters.portalPageId!}','help'
,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
+ <li><a class="help-link <#if pageAvail?has_content> alert</#if>"
href="javascript:lookup_popup1('showHelp?helpTopic=${helpTopic}&portalPageId=${(parameters.portalPageId!)?html}','help'
,500,500);" title="${uiLabelMap.CommonHelp}"></a></li>
</#if>
<li><a
href="<@ofbizUrl>logout</@ofbizUrl>">${uiLabelMap.CommonLogout}</a></li>
<li><a
href="<@ofbizUrl>ListVisualThemes</@ofbizUrl>">${uiLabelMap.CommonVisualThemes}</a></li>
