[ https://issues.apache.org/jira/browse/OFBIZ-4042?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jacques Le Roux closed OFBIZ-4042. ---------------------------------- Resolution: Fixed Fix Version/s: SVN trunk Release Branch 10.04 Release Branch 09.04 Assignee: Jacques Le Roux Thanks Paul, It was only a typo and is fixed in trunk at r1042317, R10.04 at r1042322, R9.04 at r1042323 > ecommerce keyword search - Non-breaking space displayed as literal > ampersand-nbsp-semicolon > ------------------------------------------------------------------------------------------- > > Key: OFBIZ-4042 > URL: https://issues.apache.org/jira/browse/OFBIZ-4042 > Project: OFBiz > Issue Type: Bug > Components: specialpurpose/ecommerce > Affects Versions: SVN trunk > Reporter: Paul Foxworthy > Assignee: Jacques Le Roux > Priority: Minor > Fix For: Release Branch 09.04, Release Branch 10.04, SVN trunk > > > On demo site, navigate to > http://demo-trunk.ofbiz.apache.org/ecommerce/control/main. In Search Catalog > box on the left, enter a keyword that isn't in the product descriptions, such > as "notthere", and click on Find. The results page, > http://demo-trunk.ofbiz.apache.org/ecommerce/control/keywordsearch, displays > a list of "X" buttons, which would exclude some search results if there were > any. Beside each "X" button is a sequence of an ampersand, the letters "nbsp" > and a semi-colon. When I do a View Source in my web browser, the sequence is > the HTML ampersand entity, then nbsp, then a literal semicolon. > Obviously something is HTML encoding what was originally intended to be a > non-breaking space. I can see the non-breaking space entity in > applications/product/webapp/catalog/find/keywordsearch.ftl . > Of course it is necessary to HTML encode any untrusted data coming from the > client side to guard against cross site scripting attacks. I don't see why it > is necessary to HTML encode the contents of a FreeMarker template, and I > don't understand why this non-breaking space is being encoded, and not every > occurrence of a greater-than or a less-than in the template. -- This message is automatically generated by JIRA. - You can reply to this email to add a comment to the issue online.