(ofbiz-framework) branch release24.09 updated: Fixed: Do not evaluate the Ajax update area string of forms twice as an expression (OFBIZ-13641)

[mridulpathak]

This is an automated email from the ASF dual-hosted git repository.

mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 1f8fa455b0 Fixed: Do not evaluate the Ajax update area string of forms 
twice as an expression (OFBIZ-13641)
1f8fa455b0 is described below

commit 1f8fa455b0d64f6b261a493485983273c826b136
Author: Mridul Pathak <mridul...@gmail.com>
AuthorDate: Sat Oct 3 23:58:21 2026 +0530

    Fixed: Do not evaluate the Ajax update area string of forms twice as an 
expression (OFBIZ-13641)
    
    MacroCommonRenderer.createAjaxParamsFromUpdateAreas built the string of an 
update area from the area id, the target and the parameters, and then evaluated 
the whole string again as a FlexibleStringExpander. The target and the 
parameters were already evaluated, and the parameters URL encoded, so what 
comes from the request, such as the query string of a paginated form, was 
evaluated a second time.
    
    Only the area id is still a raw value of the widget, so it is now evaluated 
on its own, and the evaluation of the whole string is removed.
    
    (cherry picked from commit 97d7a915649bd585a7e9b78a1f236309d56bbadf)
---
 .../ofbiz/widget/renderer/macro/MacroCommonRenderer.java       | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
index d54aea08d7..2ee4622568 100644
--- 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
+++ 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
@@ -57,6 +57,7 @@ public class MacroCommonRenderer {
         Map<String, Object> ctx = UtilGenerics.cast(context);
         RequestHandler rh = RequestHandler.from(request);
 
+        Locale locale = UtilMisc.ensureLocale(context.get("locale"));
         StringBuilder sb = new StringBuilder();
         Iterator<ModelForm.UpdateArea> updateAreaIter = updateAreas.iterator();
         while (updateAreaIter.hasNext()) {
@@ -67,8 +68,10 @@ public class MacroCommonRenderer {
             String targetToCall;
             String parametersToForward;
 
-            // 1. areaId to update, use the screen stack with the potential 
area given by the update area element
-            areaIdToUpdate = 
WidgetWorker.getScreenStack(ctx).resolveScreenAreaId(updateArea.getAreaId());
+            // 1. areaId to update, use the screen stack with the potential 
area given by the update area element.
+            //     It is the only part that is an expression; the target and 
the parameters are expanded below.
+            areaIdToUpdate = 
WidgetWorker.getScreenStack(ctx).resolveScreenAreaId(
+                    
FlexibleStringExpander.expandString(updateArea.getAreaId(), ctx, locale));
 
             // 2. the target, if the updateArea haven't the information and we 
are on event link to the pagination,
             //     will ask to the parent model the pagination target
@@ -104,8 +107,7 @@ public class MacroCommonRenderer {
                 sb.append(",");
             }
         }
-        Locale locale = UtilMisc.ensureLocale(context.get("locale"));
-        return FlexibleStringExpander.expandString(sb.toString(), context, 
locale);
+        return sb.toString();
     }
 
     private static String buildParamStringFromMap(Map<String, Object> 
extraParamsAsMap) {