svn commit: r1432395 - in /ofbiz/branches/release11.04: ./ framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java

[jacopoc]

Author: jacopoc
Date: Sat Jan 12 08:11:25 2013
New Revision: 1432395

URL: http://svn.apache.org/viewvc?rev=1432395&view=rev
Log:
Applied fix from trunk for revision: 1432392
===

The content of the Screenlet title is now escaped to prevent the risk of an XSS attack.

Modified:
    ofbiz/branches/release11.04/   (props changed)
    ofbiz/branches/release11.04/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java

Propchange: ofbiz/branches/release11.04/
------------------------------------------------------------------------------
  Merged /ofbiz/trunk:r1432392

Modified: ofbiz/branches/release11.04/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java
URL: http://svn.apache.org/viewvc/ofbiz/branches/release11.04/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java?rev=1432395&r1=1432394&r2=1432395&view=diff
==============================================================================
--- ofbiz/branches/release11.04/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java (original)
+++ ofbiz/branches/release11.04/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java Sat Jan 12 08:11:25 2013
@@ -415,7 +415,12 @@ public abstract class ModelScreenWidget
         }
 
         public String getTitle(Map<String, Object> context) {
-            return this.titleExdr.expandString(context);
+            String title = this.titleExdr.expandString(context);
+            StringUtil.SimpleEncoder simpleEncoder = (StringUtil.SimpleEncoder) context.get("simpleEncoder");
+            if (simpleEncoder != null) {
+                title = simpleEncoder.encode(title);
+            }
+            return title;
         }
 
         public Menu getNavigationMenu() {