This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 56eed8aeb2 Fixed: Encode the source URL of menu, tree and form images
56eed8aeb2 is described below
commit 56eed8aeb2942f8c5760e55f492da16a9af65dee
Author: Mridul Pathak <[email protected]>
AuthorDate: Sun Oct 18 19:46:16 2026 +0530
Fixed: Encode the source URL of menu, tree and form images
The image source URL of menu and tree image widgets, and of form hyperlink,
display and submit image locations, was written into the src attribute without
encoding. It is now encoded with the context simple encoder once the final URL
has been built, like screen image widgets already are.
On this branch the tree, submit and sub-hyperlink image values are also
placed inside the macro call strings built by the renderers, so the tree image
values are additionally escaped with MacroCommonRenderer.escapeFtlString, and
the form ones go through the existing encode method of the form renderer.
---
.../ofbiz/widget/renderer/html/HtmlMenuRenderer.java | 15 ++++++++++-----
.../ofbiz/widget/renderer/html/HtmlTreeRenderer.java | 16 +++++++++++-----
.../ofbiz/widget/renderer/macro/MacroFormRenderer.java | 4 ++--
.../ofbiz/widget/renderer/macro/MacroMenuRenderer.java | 4 ++++
.../ofbiz/widget/renderer/macro/MacroTreeRenderer.java | 9 +++++++--
.../renderer/macro/RenderableFtlFormElementsBuilder.java | 4 ++--
6 files changed, 36 insertions(+), 16 deletions(-)
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlMenuRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlMenuRenderer.java
index 9b7046d345..1a05e7e4ee 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlMenuRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlMenuRenderer.java
@@ -566,24 +566,29 @@ public class HtmlMenuRenderer extends HtmlWidgetRenderer
implements MenuStringRe
boolean encode = false;
HttpServletResponse response = (HttpServletResponse)
context.get("response");
HttpServletRequest request = (HttpServletRequest)
context.get("request");
+ String urlString = "";
if (urlMode != null && "ofbiz".equalsIgnoreCase(urlMode)) {
if (request != null && response != null) {
RequestHandler rh = (RequestHandler)
request.getServletContext().getAttribute("_REQUEST_HANDLER_");
- String urlString = rh.makeLink(request, response, src,
fullPath, secure, encode);
- writer.append(urlString);
+ urlString = rh.makeLink(request, response, src, fullPath,
secure, encode);
} else {
- writer.append(src);
+ urlString = src;
}
} else if (urlMode != null && "content".equalsIgnoreCase(urlMode))
{
if (request != null && response != null) {
StringBuilder newURL = new StringBuilder();
ContentUrlTag.appendContentPrefix(request, newURL);
newURL.append(src);
- writer.append(newURL.toString());
+ urlString = newURL.toString();
}
} else {
- writer.append(src);
+ urlString = src;
}
+ UtilCodec.SimpleEncoder simpleEncoder = (UtilCodec.SimpleEncoder)
context.get("simpleEncoder");
+ if (simpleEncoder != null) {
+ urlString = simpleEncoder.encode(urlString);
+ }
+ writer.append(urlString);
writer.append("\"");
}
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlTreeRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlTreeRenderer.java
index 91cf2fb418..236425582f 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlTreeRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/html/HtmlTreeRenderer.java
@@ -28,6 +28,7 @@ import javax.servlet.http.HttpServletResponse;
import org.apache.ofbiz.base.util.Debug;
import org.apache.ofbiz.base.util.StringUtil;
+import org.apache.ofbiz.base.util.UtilCodec;
import org.apache.ofbiz.base.util.UtilGenerics;
import org.apache.ofbiz.base.util.UtilValidate;
import org.apache.ofbiz.webapp.control.ExternalLoginKeysManager;
@@ -323,24 +324,29 @@ public class HtmlTreeRenderer extends HtmlWidgetRenderer
implements TreeStringRe
boolean encode = false;
HttpServletResponse response = (HttpServletResponse)
context.get("response");
HttpServletRequest request = (HttpServletRequest)
context.get("request");
+ String urlString = "";
if (urlMode != null && "intra-app".equalsIgnoreCase(urlMode)) {
if (request != null && response != null) {
RequestHandler rh = RequestHandler.from(request);
- String urlString = rh.makeLink(request, response, src,
fullPath, secure, encode);
- writer.append(urlString);
+ urlString = rh.makeLink(request, response, src, fullPath,
secure, encode);
} else {
- writer.append(src);
+ urlString = src;
}
} else if (urlMode != null && "content".equalsIgnoreCase(urlMode))
{
if (request != null && response != null) {
StringBuilder newURL = new StringBuilder();
ContentUrlTag.appendContentPrefix(request, newURL);
newURL.append(src);
- writer.append(newURL.toString());
+ urlString = newURL.toString();
}
} else {
- writer.append(src);
+ urlString = src;
}
+ UtilCodec.SimpleEncoder simpleEncoder = (UtilCodec.SimpleEncoder)
context.get("simpleEncoder");
+ if (simpleEncoder != null) {
+ urlString = simpleEncoder.encode(urlString);
+ }
+ writer.append(urlString);
writer.append("\"");
}
writer.append("/>");
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
index 457dd7e5c7..bb11430e69 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
@@ -449,7 +449,7 @@ public final class MacroFormRenderer implements
FormStringRenderer {
String name = modelFormField.getParameterName(context);
String buttonType = submitField.getButtonType();
String formName = FormRenderer.getCurrentFormName(modelForm, context);
- String imgSrc = submitField.getImageLocation(context);
+ String imgSrc = encode(submitField.getImageLocation(context),
modelFormField, context);
String confirmation = submitField.getConfirmation(context);
String className = "";
String alert = "false";
@@ -2309,7 +2309,7 @@ public final class MacroFormRenderer implements
FormStringRenderer {
action = modelFormField.getAction(context);
}
if (UtilValidate.isNotEmpty(request.getAttribute("image"))) {
- imgSrc = request.getAttribute("image").toString();
+ imgSrc = encode(request.getAttribute("image").toString(),
modelFormField, context);
}
if (UtilValidate.isNotEmpty(request.getAttribute("imageTitle"))) {
imgTitle = request.getAttribute("imageTitle").toString();
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
index a6b1d2de7b..760b20775e 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
@@ -98,6 +98,10 @@ public class MacroMenuRenderer implements MenuStringRenderer
{
src = newURL.toString();
}
}
+ UtilCodec.SimpleEncoder simpleEncoder = (UtilCodec.SimpleEncoder)
context.get("simpleEncoder");
+ if (simpleEncoder != null) {
+ src = simpleEncoder.encode(src);
+ }
parameters.put("src", src);
return parameters;
}
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
index 3ef9584126..46fd768712 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
@@ -31,6 +31,7 @@ import javax.servlet.http.HttpServletResponse;
import org.apache.ofbiz.base.util.Debug;
import org.apache.ofbiz.base.util.StringUtil;
+import org.apache.ofbiz.base.util.UtilCodec;
import org.apache.ofbiz.base.util.UtilGenerics;
import org.apache.ofbiz.base.util.UtilMisc;
import org.apache.ofbiz.base.util.UtilValidate;
@@ -336,10 +337,14 @@ public class MacroTreeRenderer implements
TreeStringRenderer {
} else {
urlString = src;
}
+ UtilCodec.SimpleEncoder simpleEncoder = (UtilCodec.SimpleEncoder)
context.get("simpleEncoder");
+ if (simpleEncoder != null) {
+ urlString = simpleEncoder.encode(urlString);
+ }
StringWriter sr = new StringWriter();
sr.append("<@renderImage ");
sr.append("src=\"");
- sr.append(src);
+ sr.append(MacroCommonRenderer.escapeFtlString(src));
sr.append("\" id=\"");
sr.append(id);
sr.append("\" style=\"");
@@ -353,7 +358,7 @@ public class MacroTreeRenderer implements
TreeStringRenderer {
sr.append("\" alt=\"");
sr.append(alt);
sr.append("\" urlString=\"");
- sr.append(urlString);
+ sr.append(MacroCommonRenderer.escapeFtlString(urlString));
sr.append("\" />");
executeMacro(sr.toString());
}
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/RenderableFtlFormElementsBuilder.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/RenderableFtlFormElementsBuilder.java
index 0aef73be00..7b2e2d8daf 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/RenderableFtlFormElementsBuilder.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/RenderableFtlFormElementsBuilder.java
@@ -161,7 +161,7 @@ public final class RenderableFtlFormElementsBuilder {
final RenderableFtlMacroCallBuilder builder =
RenderableFtlMacroCall.builder()
.name("renderDisplayField")
.stringParameter("type", type)
- .stringParameter("imageLocation", imageLocation)
+ .stringParameter("imageLocation", encode(imageLocation,
modelFormField, context))
.stringParameter("idName", idName)
.stringParameter("description", description)
.stringParameter("title", title)
@@ -781,7 +781,7 @@ public final class RenderableFtlFormElementsBuilder {
action = modelFormField.getAction(context);
}
if (UtilValidate.isNotEmpty(request.getAttribute("image"))) {
- imgSrc = request.getAttribute("image").toString();
+ imgSrc = encode(request.getAttribute("image").toString(),
modelFormField, context);
}
if (UtilValidate.isNotEmpty(request.getAttribute("imageTitle"))) {
imgTitle = request.getAttribute("imageTitle").toString();
