This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 0003431731 Fixed: Encode the source URL of menu, tree and form images
0003431731 is described below
commit 0003431731cb060d7bbea42cd5e91935ae503507
Author: Mridul Pathak <[email protected]>
AuthorDate: Sun Oct 18 19:07:44 2026 +0530
Fixed: Encode the source URL of menu, tree and form images
The image source URL of menu and tree image widgets, and of form hyperlink,
display and submit image locations, was written into the src attribute without
encoding. It is now encoded with the context simple encoder once the final URL
has been built, like screen image widgets already are.
---
.../ofbiz/widget/renderer/html/HtmlMenuRenderer.java | 15 ++++++++++-----
.../ofbiz/widget/renderer/html/HtmlTreeRenderer.java | 16 +++++++++++-----
.../ofbiz/widget/renderer/macro/MacroMenuRenderer.java | 4 ++++
.../ofbiz/widget/renderer/macro/MacroTreeRenderer.java | 5 +++++
.../renderer/macro/RenderableFtlFormElementsBuilder.java | 6 +++---
5 files changed, 33 insertions(+), 13 deletions(-)
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlMenuRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlMenuRenderer.java
index 5e2ece4684..24afcc9b60 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlMenuRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlMenuRenderer.java
@@ -564,24 +564,29 @@ public class HtmlMenuRenderer extends HtmlWidgetRenderer
implements MenuStringRe
boolean encode = false;
HttpServletResponse response = (HttpServletResponse)
context.get("response");
HttpServletRequest request = (HttpServletRequest)
context.get("request");
+ String urlString = "";
if (urlMode != null && "ofbiz".equalsIgnoreCase(urlMode)) {
if (request != null && response != null) {
RequestHandler rh = (RequestHandler)
request.getServletContext().getAttribute("_REQUEST_HANDLER_");
- String urlString = rh.makeLink(request, response, src,
fullPath, secure, encode);
- writer.append(urlString);
+ urlString = rh.makeLink(request, response, src, fullPath,
secure, encode);
} else {
- writer.append(src);
+ urlString = src;
}
} else if (urlMode != null && "content".equalsIgnoreCase(urlMode))
{
if (request != null && response != null) {
StringBuilder newURL = new StringBuilder();
ContentUrlTag.appendContentPrefix(request, newURL);
newURL.append(src);
- writer.append(newURL.toString());
+ urlString = newURL.toString();
}
} else {
- writer.append(src);
+ urlString = src;
}
+ UtilCodec.SimpleEncoder simpleEncoder = (UtilCodec.SimpleEncoder)
context.get("simpleEncoder");
+ if (simpleEncoder != null) {
+ urlString = simpleEncoder.encode(urlString);
+ }
+ writer.append(urlString);
writer.append("\"");
}
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlTreeRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlTreeRenderer.java
index fe68c63fb2..26b21d6b0e 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlTreeRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlTreeRenderer.java
@@ -28,6 +28,7 @@ import jakarta.servlet.http.HttpServletResponse;
import org.apache.ofbiz.base.util.Debug;
import org.apache.ofbiz.base.util.StringUtil;
+import org.apache.ofbiz.base.util.UtilCodec;
import org.apache.ofbiz.base.util.UtilGenerics;
import org.apache.ofbiz.base.util.UtilValidate;
import org.apache.ofbiz.webapp.control.ExternalLoginKeysManager;
@@ -323,24 +324,29 @@ public class HtmlTreeRenderer extends HtmlWidgetRenderer
implements TreeStringRe
boolean encode = false;
HttpServletResponse response = (HttpServletResponse)
context.get("response");
HttpServletRequest request = (HttpServletRequest)
context.get("request");
+ String urlString = "";
if (urlMode != null && "intra-app".equalsIgnoreCase(urlMode)) {
if (request != null && response != null) {
RequestHandler rh = RequestHandler.from(request);
- String urlString = rh.makeLink(request, response, src,
fullPath, secure, encode);
- writer.append(urlString);
+ urlString = rh.makeLink(request, response, src, fullPath,
secure, encode);
} else {
- writer.append(src);
+ urlString = src;
}
} else if (urlMode != null && "content".equalsIgnoreCase(urlMode))
{
if (request != null && response != null) {
StringBuilder newURL = new StringBuilder();
ContentUrlTag.appendContentPrefix(request, newURL);
newURL.append(src);
- writer.append(newURL.toString());
+ urlString = newURL.toString();
}
} else {
- writer.append(src);
+ urlString = src;
}
+ UtilCodec.SimpleEncoder simpleEncoder = (UtilCodec.SimpleEncoder)
context.get("simpleEncoder");
+ if (simpleEncoder != null) {
+ urlString = simpleEncoder.encode(urlString);
+ }
+ writer.append(urlString);
writer.append("\"");
}
writer.append("/>");
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
index 4a58445355..f5273f591d 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
@@ -87,6 +87,10 @@ public class MacroMenuRenderer implements MenuStringRenderer
{
src = newURL.toString();
}
}
+ UtilCodec.SimpleEncoder simpleEncoder = (UtilCodec.SimpleEncoder)
context.get("simpleEncoder");
+ if (simpleEncoder != null) {
+ src = simpleEncoder.encode(src);
+ }
parameters.put("src", src);
return parameters;
}
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
index 118a21332c..c46a196d0c 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
@@ -29,6 +29,7 @@ import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.apache.ofbiz.base.util.StringUtil;
+import org.apache.ofbiz.base.util.UtilCodec;
import org.apache.ofbiz.base.util.UtilGenerics;
import org.apache.ofbiz.base.util.UtilMisc;
import org.apache.ofbiz.base.util.UtilValidate;
@@ -282,6 +283,10 @@ public class MacroTreeRenderer implements
TreeStringRenderer {
} else {
urlString = src;
}
+ UtilCodec.SimpleEncoder simpleEncoder = (UtilCodec.SimpleEncoder)
context.get("simpleEncoder");
+ if (simpleEncoder != null) {
+ urlString = simpleEncoder.encode(urlString);
+ }
Map<String, Object> parameters = new HashMap<>();
parameters.put("src", src);
parameters.put("id", id);
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/RenderableFtlFormElementsBuilder.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/RenderableFtlFormElementsBuilder.java
index cebabbe491..2299daa476 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/RenderableFtlFormElementsBuilder.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/RenderableFtlFormElementsBuilder.java
@@ -163,7 +163,7 @@ public final class RenderableFtlFormElementsBuilder {
final RenderableFtlMacroCallBuilder builder =
RenderableFtlMacroCall.builder()
.name("renderDisplayField")
.stringParameter("type", type)
- .stringParameter("imageLocation", imageLocation)
+ .stringParameter("imageLocation", encode(imageLocation,
modelFormField, context))
.stringParameter("idName", idName)
.stringParameter("description", description)
.stringParameter("title", title)
@@ -913,7 +913,7 @@ public final class RenderableFtlFormElementsBuilder {
action = modelFormField.getAction(context);
}
if (UtilValidate.isNotEmpty(request.getAttribute("image"))) {
- imgSrc = request.getAttribute("image").toString();
+ imgSrc = encode(request.getAttribute("image").toString(),
modelFormField, context);
}
if (UtilValidate.isNotEmpty(request.getAttribute("imageTitle"))) {
imgTitle = request.getAttribute("imageTitle").toString();
@@ -1459,7 +1459,7 @@ public final class RenderableFtlFormElementsBuilder {
.stringParameter("id",
nonNull(modelFormField.getCurrentContainerId(context)))
.stringParameter("event", nonNull(modelFormField.getEvent()))
.stringParameter("action",
nonNull(modelFormField.getAction(context)))
- .stringParameter("imgSrc",
nonNull(submitField.getImageLocation(context)))
+ .stringParameter("imgSrc",
nonNull(encode(submitField.getImageLocation(context), modelFormField, context)))
.stringParameter("containerId", ajaxEnabled ? nonNull(formId)
: "")
.stringParameter("confirmation",
nonNull(submitField.getConfirmation(context)))
.stringParameter("ajaxUrl", ajaxEnabled ? nonNull(ajaxUrl) :
"")
