svn commit: r1432843 - in /ofbiz/branches/release12.04: ./ framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java

[jacopoc]

Author: jacopoc
Date: Mon Jan 14 09:05:10 2013
New Revision: 1432843

URL: http://svn.apache.org/viewvc?rev=1432843&view=rev
Log:
Applied fix from trunk for revision: 1432833
===

The Image.alt is now escaped to prevent the risk of an XSS attack.


Modified:
    ofbiz/branches/release12.04/   (props changed)
    ofbiz/branches/release12.04/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java

Propchange: ofbiz/branches/release12.04/
------------------------------------------------------------------------------
  Merged /ofbiz/trunk:r1432833

Modified: ofbiz/branches/release12.04/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java
URL: http://svn.apache.org/viewvc/ofbiz/branches/release12.04/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java?rev=1432843&r1=1432842&r2=1432843&view=diff
==============================================================================
--- ofbiz/branches/release12.04/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java (original)
+++ ofbiz/branches/release12.04/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java Mon Jan 14 09:05:10 2013
@@ -1554,7 +1554,12 @@ public abstract class ModelScreenWidget
         }
 
         public String getAlt(Map<String, Object> context) {
-            return this.alt.expandString(context);
+            String alt = this.alt.expandString(context);
+            StringUtil.SimpleEncoder simpleEncoder = (StringUtil.SimpleEncoder) context.get("simpleEncoder");
+            if (simpleEncoder != null) {
+                alt = simpleEncoder.encode(alt);
+            }
+            return alt;
         }
 
         public String getUrlMode() {