This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 42a05c9fa7 Fixed: Do not evaluate a request parameter as an expression
in the return-user-message from-field (OFBIZ-13640)
42a05c9fa7 is described below
commit 42a05c9fa7c8e940613124dad5d858942d70c60a
Author: Mridul Pathak <[email protected]>
AuthorDate: Sat Oct 3 23:15:46 2026 +0530
Fixed: Do not evaluate a request parameter as an expression in the
return-user-message from-field (OFBIZ-13640)
With return-user-message from-field in a controller,
RequestHandler.setUserMessageResponseToRequest looked the field up in the
combined map of the request, where the request parameters are the fallback when
no attribute with that name exists, and evaluated the value as a
FlexibleStringExpander, so a request parameter with the name of the field was
evaluated as an expression, while a message that comes from the request through
_CUSTOM_ERROR_MESSAGE_ or _CUSTOM_EVENT_MESSAGE_ is deliber [...]
The field is now read from the request attributes only, which is where the
results of events and services are, so request parameters are never evaluated,
and the documentation of from-field in site-conf.xsd says so. No controller
delivered with OFBiz uses return-user-message.
---
framework/webapp/dtd/site-conf.xsd | 3 ++-
.../org/apache/ofbiz/webapp/control/RequestHandler.java | 16 +++++++++-------
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/framework/webapp/dtd/site-conf.xsd
b/framework/webapp/dtd/site-conf.xsd
index 79a02b7986..3b36d18267 100644
--- a/framework/webapp/dtd/site-conf.xsd
+++ b/framework/webapp/dtd/site-conf.xsd
@@ -410,7 +410,8 @@ under the License.
<xs:attribute name="from-field" type="xs:string">
<xs:annotation>
<xs:documentation>
- Set from what field in context we can found the
response user message. This field can contain a flexible string
+ Set from what request attribute (for example set by an
event or a service) we can found the response user message.
+ This attribute can contain a flexible string, a
request parameter is never used
</xs:documentation>
</xs:annotation>
</xs:attribute>
diff --git
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
index 4dc7024a25..9ed6e27eb2 100644
---
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
+++
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
@@ -1096,13 +1096,15 @@ public final class RequestHandler {
responseMessage.getRessource(), value,
context, UtilHttp.getLocale(request))
: value;
- } else if (responseMessage.getFromField() != null
- && context.containsKey(responseMessage.getFromField())) {
-
- // now analyze each field to found a flexible string to expand
- userMessage = FlexibleStringExpander.getInstance(
- (String)
context.get(responseMessage.getFromField()))
- .expandString(context);
+ } else if (responseMessage.getFromField() != null) {
+
+ // The message is looked up in the request attributes only,
where events and services put their results, and not in
+ // the request parameters, so that what the client sends is
never evaluated as an expression.
+ Object fieldValue =
request.getAttribute(responseMessage.getFromField());
+ if (fieldValue instanceof String) {
+ // now analyze the field to found a flexible string to
expand
+ userMessage = FlexibleStringExpander.getInstance((String)
fieldValue).expandString(context);
+ }
}
if (UtilValidate.isNotEmpty(userMessage)) {
