diff --git a/src/web/audit-policy.jsp b/src/web/audit-policy.jsp index 2fa8f48cf7..bc8afa3e6a 100644 --- a/src/web/audit-policy.jsp +++ b/src/web/audit-policy.jsp @@ -17,9 +17,10 @@ --%> <%@ page import="org.jivesoftware.util.ParamUtils, - org.jivesoftware.openfire.XMPPServer, - org.jivesoftware.openfire.audit.AuditManager, + org.jivesoftware.openfire.XMPPServer, + org.jivesoftware.openfire.audit.AuditManager, org.jivesoftware.openfire.user.UserNotFoundException, + org.jivesoftware.util.StringUtils, org.xmpp.packet.JID, java.io.File" errorPage="error.jsp" @@ -226,7 +227,7 @@ "> + value="<%= ((logDir != null) ? StringUtils.escapeForXML(logDir) : "") %>"> <% if (errors.get("logDir") != null) { %> @@ -361,7 +362,7 @@ - + <% if (errors.get("ignore") != null) { %> @@ -393,4 +394,4 @@ - \ No newline at end of file + diff --git a/src/web/available-plugins.jsp b/src/web/available-plugins.jsp index 835d6ff517..f530954a29 100644 --- a/src/web/available-plugins.jsp +++ b/src/web/available-plugins.jsp @@ -15,7 +15,8 @@ <%@ page errorPage="error.jsp" import="org.jivesoftware.util.ByteFormat, org.jivesoftware.util.Version, org.jivesoftware.openfire.XMPPServer, - org.jivesoftware.openfire.container.Plugin" + org.jivesoftware.openfire.container.Plugin, + org.jivesoftware.util.StringUtils" %> <%@ page import="org.jivesoftware.openfire.container.PluginManager" %> <%@ page import="org.jivesoftware.openfire.update.AvailablePlugin" %> @@ -284,38 +285,38 @@ <% if (plugin.getIcon() != null) { %> - Plugin + Plugin <% } else { %> Plugin <% } %> - <%= (pluginName != null ? pluginName : "") %>   + <%= (pluginName != null ? StringUtils.escapeHTMLTags(pluginName) : "") %>   <% if (plugin.getReadme() != null) { %> - README <% } else { %>   <% } %> <% if (plugin.getChangelog() != null) { %> - changelog <% } else { %>   <% } %> - <%= pluginDescription != null ? pluginDescription : "" %> + <%= pluginDescription != null ? StringUtils.escapeHTMLTags(pluginDescription) : "" %> - <%= pluginVersion != null ? pluginVersion : "" %> + <%= pluginVersion != null ? StringUtils.escapeHTMLTags(pluginVersion) : "" %> - <%= pluginAuthor != null ? pluginAuthor : "" %>   + <%= pluginAuthor != null ? StringUtils.escapeHTMLTags(pluginAuthor) : "" %>   - <%= fileSize %> + <%= StringUtils.escapeHTMLTags(fileSize) %> <% @@ -328,7 +329,7 @@ <% %> - <fmt:message key="> <% } %> @@ -336,9 +337,9 @@ - + - <%= plugin.getName()%> + <%= StringUtils.escapeHTMLTags(plugin.getName())%> @@ -367,38 +368,38 @@ <% if (plugin.getIcon() != null) { %> - Plugin + Plugin <% } else { %> Plugin <% } %> - <%= (pluginName != null ? pluginName : "") %>   + <%= (pluginName != null ? StringUtils.escapeHTMLTags(pluginName) : "") %>   <% if (plugin.getReadme() != null) { %> - README <% } else { %>   <% } %> <% if (plugin.getChangelog() != null) { %> - changelog <% } else { %>   <% } %> - <%= pluginDescription != null ? pluginDescription : "" %> + <%= pluginDescription != null ? StringUtils.escapeHTMLTags(pluginDescription) : "" %> - <%= pluginVersion != null ? pluginVersion : "" %> + <%= pluginVersion != null ? StringUtils.escapeHTMLTags(pluginVersion) : "" %> - <%= pluginAuthor != null ? pluginAuthor : "" %>   + <%= pluginAuthor != null ? StringUtils.escapeHTMLTags(pluginAuthor) : "" %>   - <%= fileSize %> + <%= StringUtils.escapeHTMLTags(fileSize) %> <% @@ -409,16 +410,16 @@ <% } else { %> - <fmt:message key="> <% } %> - + - <%= plugin.getName()%> + <%= StringUtils.escapeHTMLTags(plugin.getName())%> @@ -493,13 +494,13 @@ else { %>   <% } %>

- <%= pluginDescription %> + <%= StringUtils.escapeHTMLTags(pluginDescription) %> - <%= pluginVersion%> + <%= StringUtils.escapeHTMLTags(pluginVersion) %> - <%= pluginAuthor%> + <%= StringUtils.escapeHTMLTags(pluginAuthor) %> <% }%> @@ -529,4 +530,4 @@ <% } %> - \ No newline at end of file + diff --git a/src/web/clearspace-status.jsp b/src/web/clearspace-status.jsp index 7756633276..d61dde43de 100644 --- a/src/web/clearspace-status.jsp +++ b/src/web/clearspace-status.jsp @@ -20,6 +20,7 @@ <%@ page import="org.jivesoftware.openfire.clearspace.ClearspaceManager" %> <%@ page import="org.jivesoftware.openfire.session.ComponentSession" %> <%@ page import="org.jivesoftware.util.JiveGlobals" %> +<%@ page import="org.jivesoftware.util.StringUtils" %> <%@ page import="java.text.NumberFormat" %> <%@ page import="java.util.Collection" %> <%@ page import="java.util.Date" %> @@ -189,17 +190,17 @@ - <%= cs.getHostAddress() %> + <%= StringUtils.escapeHTMLTags(cs.getHostAddress()) %> / - <%= cs.getHostName() %> + <%= StringUtils.escapeHTMLTags(cs.getHostName()) %> <% } else { %> - <%= cs.getHostAddress() %> + <%= StringUtils.escapeHTMLTags(cs.getHostAddress()) %> / - <%= cs.getHostName() %> + <%= StringUtils.escapeHTMLTags(cs.getHostName()) %> <% } %> @@ -268,4 +269,4 @@ <% } %> - \ No newline at end of file + diff --git a/src/web/component-session-details.jsp b/src/web/component-session-details.jsp index 991899fa41..bedc9723b6 100644 --- a/src/web/component-session-details.jsp +++ b/src/web/component-session-details.jsp @@ -21,6 +21,7 @@ <%@ page import="org.jivesoftware.openfire.SessionManager, org.jivesoftware.openfire.session.ComponentSession, org.jivesoftware.util.JiveGlobals, + org.jivesoftware.util.StringUtils, org.jivesoftware.util.ParamUtils" errorPage="error.jsp" %> @@ -86,7 +87,7 @@ - <%= componentSession.getExternalComponent().getName() %> + <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getName()) %> @@ -94,7 +95,7 @@ : - <%= componentSession.getExternalComponent().getCategory() %> + <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getCategory()) %> @@ -117,7 +118,7 @@ <% } } %> - <%= componentSession.getExternalComponent().getType() %> + <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getType()) %> @@ -150,9 +151,9 @@ - <%= componentSession.getHostAddress() %> + <%= StringUtils.escapeHTMLTags(componentSession.getHostAddress()) %> / - <%= componentSession.getHostName() %> + <%= StringUtils.escapeHTMLTags(componentSession.getHostName()) %> @@ -167,4 +168,4 @@ - \ No newline at end of file + diff --git a/src/web/component-session-summary.jsp b/src/web/component-session-summary.jsp index 465587928f..f3a72f6c8e 100644 --- a/src/web/component-session-summary.jsp +++ b/src/web/component-session-summary.jsp @@ -22,6 +22,7 @@ org.jivesoftware.openfire.session.ComponentSession, org.jivesoftware.openfire.session.Session, org.jivesoftware.util.JiveGlobals, + org.jivesoftware.util.StringUtils, org.jivesoftware.util.ParamUtils, java.net.URLEncoder" errorPage="error.jsp" @@ -187,10 +188,10 @@ " title=""><%= componentSession.getAddress() %> - <%= componentSession.getExternalComponent().getName() %> + <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getName()) %> - <%= componentSession.getExternalComponent().getCategory() %> + <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getCategory()) %> @@ -218,7 +219,7 @@ <% } } %> - +
<%= componentSession.getExternalComponent().getType() %><%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getType()) %>
<% Date creationDate = componentSession.getCreationDate(); @@ -279,4 +280,4 @@

- \ No newline at end of file + diff --git a/src/web/error.jsp b/src/web/error.jsp index 7c8f67da66..b4e143a85f 100644 --- a/src/web/error.jsp +++ b/src/web/error.jsp @@ -7,6 +7,7 @@ <%@ page import="java.io.*, org.jivesoftware.util.ParamUtils, org.jivesoftware.util.JiveGlobals, + org.jivesoftware.util.StringUtils, org.jivesoftware.openfire.auth.UnauthorizedException, org.jivesoftware.openfire.user.UserNotFoundException, org.jivesoftware.openfire.group.GroupNotFoundException" @@ -54,7 +55,7 @@ %> 
-<%= sout.toString() %>
+<%= StringUtils.escapeHTMLTags(sout.toString()) %>
-<% } %> \ No newline at end of file +<% } %> diff --git a/src/web/external-components-settings.jsp b/src/web/external-components-settings.jsp index ea46958d77..f6c32196d0 100644 --- a/src/web/external-components-settings.jsp +++ b/src/web/external-components-settings.jsp @@ -25,8 +25,10 @@ org.jivesoftware.openfire.component.ExternalComponentConfiguration, org.jivesoftware.openfire.component.ExternalComponentManager, org.jivesoftware.util.ModificationNotAllowedException, + org.jivesoftware.util.StringUtils, org.jivesoftware.util.ParamUtils, - java.util.Collection" + java.util.Collection, + java.net.URLEncoder" errorPage="error.jsp" %> <%@ page import="java.util.HashMap" %> @@ -243,7 +245,7 @@ - <%= operationFailedDetail != null ? operationFailedDetail : ""%> + <%= operationFailedDetail != null ? StringUtils.escapeHTMLTags(operationFailedDetail) : ""%> @@ -328,7 +330,7 @@ "> + value="<%= ((defaultSecret != null) ? StringUtils.escapeForXML(defaultSecret) : "") %>"> @@ -408,13 +410,13 @@ <%= count %> - <%= configuration.getSubdomain() %> + <%= StringUtils.escapeHTMLTags(configuration.getSubdomain()) %> <%= configuration.getSecret() %> - ')) { location.replace('external-components-settings.jsp?deleteConf=<%= configuration.getSubdomain() %>'); } " + ')) { location.replace('external-components-settings.jsp?deleteConf=<%= URLEncoder.encode(configuration.getSubdomain(),"UTF-8") %>'); } " title="" > diff --git a/src/web/group-create.jsp b/src/web/group-create.jsp index fc6214a789..4cae3c4194 100644 --- a/src/web/group-create.jsp +++ b/src/web/group-create.jsp @@ -20,6 +20,7 @@ <%@ page import="org.jivesoftware.openfire.group.Group, org.jivesoftware.openfire.group.GroupAlreadyExistsException, org.jivesoftware.openfire.security.SecurityAuditManager, + org.jivesoftware.util.StringUtils, org.jivesoftware.util.Log" errorPage="error.jsp" %> @@ -188,7 +189,7 @@
<% if (groupName != null) { %> - + <% } %> @@ -213,7 +214,7 @@ " id="gname"> + value="<%= ((name != null) ? StringUtils.escapeForXML(name) : "") %>" id="gname"> @@ -238,7 +239,7 @@ + ><%= ((description != null) ? StringUtils.escapeHTMLTags(description) : "") %> @@ -298,4 +299,4 @@ for (i=0;i -%> \ No newline at end of file +%> diff --git a/src/web/group-delete.jsp b/src/web/group-delete.jsp index e124db79a8..e60cf553ac 100644 --- a/src/web/group-delete.jsp +++ b/src/web/group-delete.jsp @@ -81,7 +81,7 @@

- + "> "> @@ -101,4 +101,4 @@ <% } %> - \ No newline at end of file + diff --git a/src/web/group-edit.jsp b/src/web/group-edit.jsp index 8ebd076778..0516ceb0af 100644 --- a/src/web/group-edit.jsp +++ b/src/web/group-edit.jsp @@ -314,7 +314,7 @@ <% if(add) { %> - <%= errorBuf %> + <%= StringUtils.escapeHTMLTags(errorBuf.toString()) %> <% } %> @@ -325,7 +325,7 @@
- + @@ -387,7 +387,7 @@
;"> - ">
+ ">
<% if (errors.get("groupDisplayName") != null) { %>
<% } %> @@ -489,7 +489,7 @@

- + @@ -507,7 +507,7 @@ <% } %> - +
@@ -581,7 +581,7 @@ <% if (user != null) { %> - + <% } else { %> <% } %> @@ -672,4 +672,4 @@ } return false; } -%> \ No newline at end of file +%> diff --git a/src/web/group-summary.jsp b/src/web/group-summary.jsp index 49ddcd3fc9..80c87b7f09 100644 --- a/src/web/group-summary.jsp +++ b/src/web/group-summary.jsp @@ -178,7 +178,7 @@ document.searchForm.search.focus(); <%= i %> @@ -234,4 +234,4 @@ document.searchForm.search.focus(); <% } %> - \ No newline at end of file + diff --git a/src/web/http-bind.jsp b/src/web/http-bind.jsp index 90f0a81bc1..ebc74e50e7 100644 --- a/src/web/http-bind.jsp +++ b/src/web/http-bind.jsp @@ -17,6 +17,7 @@ - limitations under the License. --%> <%@ page import="org.jivesoftware.util.ParamUtils" %> +<%@ page import="org.jivesoftware.util.StringUtils" %> <%@ page import="java.io.File" %> <%@ page import="java.util.Map" %> <%@ page import="java.util.HashMap" %> @@ -261,7 +262,7 @@
 "><%= JID.unescapeNode(user.getUsername()) %><% if (!isLocal) { showRemoteJIDsWarning = true; %> *<%}%>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %><% if (!isLocal) { showRemoteJIDsWarning = true; %> *<%}%><%= jid %><% showRemoteJIDsWarning = true; %> * - <%= StringUtils.escapeHTMLTags(group.getName()) %> + "><%= StringUtils.escapeHTMLTags(group.getName()) %> <% if (group.getDescription() != null) { %>
@@ -195,12 +195,12 @@ document.searchForm.search.focus(); <% // Only show edit and delete options if the groups aren't read-only. if (!webManager.getGroupManager().isReadOnly()) { %> 		- " title= > - " title= >
- +
@@ -303,7 +304,7 @@ - "> + "> @@ -311,7 +312,7 @@ - "> + "> @@ -319,7 +320,7 @@ - "> + "> @@ -327,7 +328,7 @@ - "> + "> @@ -363,4 +364,4 @@ value=""> - \ No newline at end of file + diff --git a/src/web/import-certificate.jsp b/src/web/import-certificate.jsp index 863b732e08..c27b8410c6 100644 --- a/src/web/import-certificate.jsp +++ b/src/web/import-certificate.jsp @@ -1,5 +1,6 @@ <%@ page import="org.jivesoftware.util.CertificateManager, org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils, org.jivesoftware.openfire.XMPPServer, org.jivesoftware.openfire.net.SSLConfig, java.io.ByteArrayInputStream, @@ -114,7 +115,7 @@ <% if (e != null && e.getMessage() != null) { %> - : <%= e.getMessage() %> + : <%= StringUtils.escapeHTMLTags(e.getMessage()) %> <% } %> diff --git a/src/web/log.jsp b/src/web/log.jsp index f99dac87ed..34ed1a59b4 100644 --- a/src/web/log.jsp +++ b/src/web/log.jsp @@ -156,7 +156,7 @@ - <%= log %> + <%= StringUtils.escapeHTMLTags(log) %>
- +
@@ -309,7 +310,7 @@ IFRAME {
- + diff --git a/src/web/media-proxy.jsp b/src/web/media-proxy.jsp index 29fc0234ea..b49f25b371 100644 --- a/src/web/media-proxy.jsp +++ b/src/web/media-proxy.jsp @@ -20,6 +20,7 @@ <%@ page import="org.jivesoftware.util.JiveGlobals" %> <%@ page import="org.jivesoftware.util.ParamUtils" %> +<%@ page import="org.jivesoftware.util.StringUtils" %> <%@ page import="org.jivesoftware.openfire.XMPPServer" %> <%@ page import="org.jivesoftware.openfire.mediaproxy.MediaProxyService" %> <%@ page import="org.jivesoftware.openfire.mediaproxy.MediaProxySession" %> @@ -292,7 +293,7 @@ <%= i %> @@ -136,4 +136,4 @@ - \ No newline at end of file + diff --git a/src/web/muc-room-edit-form.jsp b/src/web/muc-room-edit-form.jsp index 5cf2eb8892..d5f7c90555 100644 --- a/src/web/muc-room-edit-form.jsp +++ b/src/web/muc-room-edit-form.jsp @@ -18,6 +18,7 @@ --%> <%@ page import="org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils, java.text.DateFormat, java.util.*, org.jivesoftware.openfire.muc.MUCRoom, @@ -424,7 +425,7 @@ - + <% if (room.getOccupantsCount() == 0) { %> <% } else { %> @@ -443,7 +444,7 @@ <% } %> <% if (!create) { %> - + <% } %> @@ -456,12 +457,12 @@ <% if (create) { %> - - + <% } %> - - - diff --git a/src/web/muc-room-occupants.jsp b/src/web/muc-room-occupants.jsp index d54ae0b037..db5ef249b7 100644 --- a/src/web/muc-room-occupants.jsp +++ b/src/web/muc-room-occupants.jsp @@ -20,9 +20,9 @@ <%@ page import="org.jivesoftware.openfire.muc.MUCRole, org.jivesoftware.openfire.muc.MUCRoom, org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils, java.net.URLEncoder, - java.text.DateFormat, - java.util.List" + java.text.DateFormat" errorPage="error.jsp" %> <%@ page import="org.jivesoftware.openfire.XMPPServer" %> @@ -50,23 +50,19 @@ // Kick nick specified if (kick != null) { - List roles = room.getOccupantsByNickname(nickName); - if (roles != null && roles.size() > 0) { + MUCRole role = room.getOccupant(nickName); + if (role != null) { try { - for (MUCRole role : roles) { - room.kickOccupant(role.getUserAddress(), XMPPServer.getInstance().createJID(webManager.getUser().getUsername(), null), ""); - } + room.kickOccupant(role.getUserAddress(), XMPPServer.getInstance().createJID(webManager.getUser().getUsername(), null), ""); // Log the event webManager.logEvent("kicked MUC occupant "+nickName+" from "+roomName, null); // Done, so redirect - response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+ - "&nickName="+URLEncoder.encode(nickName, "UTF-8")+"&deletesuccess=true"); + response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+"&nickName="+URLEncoder.encode(role.getNickname(), "UTF-8")+"&deletesuccess=true"); return; } catch (NotAllowedException e) { // Done, so redirect - response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+ - "&nickName="+URLEncoder.encode(nickName, "UTF-8")+"&deletefailed=true"); + response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+"&nickName="+URLEncoder.encode(role.getNickname(), "UTF-8")+"&deletefailed=true"); return; } } @@ -96,7 +92,7 @@ @@ -113,7 +109,7 @@ @@ -134,7 +130,7 @@ - + @@ -162,10 +158,10 @@ <% for (MUCRole role : room.getOccupants()) { %> - - - - + + + + <% } %> diff --git a/src/web/muc-room-summary.jsp b/src/web/muc-room-summary.jsp index 6b31449e6e..cfd14f24d0 100644 --- a/src/web/muc-room-summary.jsp +++ b/src/web/muc-room-summary.jsp @@ -91,7 +91,7 @@

-"><%= mucService.getServiceDomain() %> +"><%= StringUtils.escapeHTMLTags(mucService.getServiceDomain()) %>

@@ -128,7 +128,7 @@ continue; } %> - + <% } %> <% } %> @@ -144,7 +144,7 @@ String sep = ((i+1) - &start=<%= (i*range) %>" + &start=<%= (i*range) %>" class="<%= ((isCurrent) ? "jive-current" : "") %>" ><%= (i+1) %><%= sep %> @@ -248,7 +248,7 @@ String sep = ((i+1) - &start=<%= (i*range) %>" + &start=<%= (i*range) %>" class="<%= ((isCurrent) ? "jive-current" : "") %>" ><%= (i+1) %><%= sep %> @@ -259,4 +259,4 @@ <% } %> - \ No newline at end of file + diff --git a/src/web/muc-service-delete.jsp b/src/web/muc-service-delete.jsp index f1d8416f26..89f0b655a8 100644 --- a/src/web/muc-service-delete.jsp +++ b/src/web/muc-service-delete.jsp @@ -73,12 +73,12 @@

-"><%= mucname %> +"><%= StringUtils.escapeHTMLTags(mucname) %>

- +
@@ -90,7 +90,7 @@
@@ -113,4 +113,4 @@ - \ No newline at end of file + diff --git a/src/web/muc-service-edit-form.jsp b/src/web/muc-service-edit-form.jsp index 3cfbf13270..f3c0608d9a 100644 --- a/src/web/muc-service-edit-form.jsp +++ b/src/web/muc-service-edit-form.jsp @@ -17,7 +17,8 @@ - limitations under the License. --%> -<%@ page import="org.jivesoftware.util.ParamUtils, +<%@ page import="org.jivesoftware.util.StringUtils, + org.jivesoftware.util.ParamUtils, org.jivesoftware.util.AlreadyExistsException, java.util.*" errorPage="error.jsp" @@ -147,7 +148,7 @@ <% if (!create) { %> - + <% } else { %> <% } %> @@ -163,7 +164,7 @@ @@ -182,7 +183,7 @@
<%= logFile.getName() %> (<%= byteFormatter.format(logFile.length()) %>)<%= StringUtils.escapeHTMLTags(logFile.getName()) %> (<%= byteFormatter.format(logFile.length()) %>)   @@ -446,7 +447,7 @@ IFRAME {

- @@ -454,4 +455,4 @@ IFRAME { - \ No newline at end of file + diff --git a/src/web/manage-updates.jsp b/src/web/manage-updates.jsp index cf2acb46cb..20ca2d45a5 100644 --- a/src/web/manage-updates.jsp +++ b/src/web/manage-updates.jsp @@ -23,6 +23,7 @@ <%@ taglib uri="http://java.sun.com/jstl/fmt_rt" prefix="fmt" %> <%@ page import="org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils, org.jivesoftware.openfire.XMPPServer, org.jivesoftware.openfire.update.UpdateManager, java.util.HashMap, @@ -233,7 +234,7 @@ else if (updateSucess) { %> 		"> + value="<%= ((proxyHost != null) ? StringUtils.escapeForXML(proxyHost) : "") %>">
- <%=proxySession.getCreator()%> + <%= StringUtils.escapeHTMLTags(proxySession.getCreator())%> <%=proxySession.getHostA()%>:<%=proxySession.getLocalPortA()%> @@ -328,4 +329,4 @@ <% } // end enabled check %> - \ No newline at end of file + diff --git a/src/web/muc-create-permission.jsp b/src/web/muc-create-permission.jsp index d326c2ac33..6d94bdc2d1 100644 --- a/src/web/muc-create-permission.jsp +++ b/src/web/muc-create-permission.jsp @@ -121,7 +121,7 @@

- "><%= mucname %> + "><%= StringUtils.escapeHTMLTags(mucname) %>

<% if (errors.size() > 0) { %> @@ -166,7 +166,7 @@
- +
@@ -205,7 +205,7 @@ <% if (mucService.isRoomCreationRestricted()) { %> - +
@@ -262,4 +262,4 @@ - \ No newline at end of file + diff --git a/src/web/muc-default-settings.jsp b/src/web/muc-default-settings.jsp index 150061ee40..9dba42c052 100644 --- a/src/web/muc-default-settings.jsp +++ b/src/web/muc-default-settings.jsp @@ -149,7 +149,7 @@

- "><%= mucname %> + "><%= StringUtils.escapeHTMLTags(mucname) %>

<% if (errors.size() > 0) { %> @@ -182,7 +182,7 @@ - +
diff --git a/src/web/muc-history-settings.jsp b/src/web/muc-history-settings.jsp index c03da28628..9b5d4398d1 100644 --- a/src/web/muc-history-settings.jsp +++ b/src/web/muc-history-settings.jsp @@ -115,7 +115,7 @@

- "><%= mucname %> + "><%= StringUtils.escapeHTMLTags(mucname) %>

<% if ("true".equals(request.getParameter("success"))) { %> @@ -135,7 +135,7 @@ - +
@@ -187,4 +187,4 @@ - \ No newline at end of file + diff --git a/src/web/muc-room-affiliations.jsp b/src/web/muc-room-affiliations.jsp index aa6df471b2..dc451de20a 100644 --- a/src/web/muc-room-affiliations.jsp +++ b/src/web/muc-room-affiliations.jsp @@ -23,6 +23,7 @@ org.jivesoftware.openfire.muc.MUCRoom, org.jivesoftware.openfire.muc.NotAllowedException, org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils, org.xmpp.packet.IQ" errorPage="error.jsp" %> @@ -250,10 +251,10 @@
  - <%= userDisplay %> + <%= StringUtils.escapeHTMLTags(userDisplay) %> - &userJID=<%= user %>&delete=true&affiliation=owner" + &userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=owner" title="" onclick="return confirm('');" > @@ -282,10 +283,10 @@
  - <%= userDisplay %> + <%= StringUtils.escapeHTMLTags(userDisplay) %> - &userJID=<%= user %>&delete=true&affiliation=admin" + &userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=admin" title="" onclick="return confirm('');" > @@ -316,10 +317,10 @@
  - <%= userDisplay %><%= nickname %> + <%= StringUtils.escapeHTMLTags(userDisplay) %><%= StringUtils.escapeHTMLTags(nickname) %> - &userJID=<%= user %>&delete=true&affiliation=member" + &userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=member" title="" onclick="return confirm('');" > @@ -348,10 +349,10 @@
  - <%= userDisplay %> + <%= StringUtils.escapeHTMLTags(userDisplay) %> - &userJID=<%= user %>&delete=true&affiliation=outcast" + &userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=outcast" title="" onclick="return confirm('');" > diff --git a/src/web/muc-room-delete.jsp b/src/web/muc-room-delete.jsp index 450717e73c..767f2d0413 100644 --- a/src/web/muc-room-delete.jsp +++ b/src/web/muc-room-delete.jsp @@ -88,12 +88,12 @@

-"><%= room.getJID().toBareJID() %> +"><%= StringUtils.escapeHTMLTags(room.getJID().toBareJID()) %>

- +
@@ -105,7 +105,7 @@
- <%= room.getJID().toBareJID() %> + <%= StringUtils.escapeHTMLTags(room.getJID().toBareJID()) %>
<%= room.getName() %><%= StringUtils.escapeHTMLTags(room.getName()) %><%= room.getOccupantsCount() %> / <%= room.getMaxUsers() %>
: + <% if (webManager.getMultiUserChatManager().getMultiUserChatServicesCount() > 1) { %> @ <% } else { %> @@ -472,7 +473,7 @@ // Private and hidden, skip it. continue; } - out.print(""+service.getServiceDomain()); + out.print(""+StringUtils.escapeHTMLTags(service.getServiceDomain())); break; } %> @@ -482,22 +483,22 @@ <% } else { %>
:<%= roomJID.getDomain() %><%= StringUtils.escapeHTMLTags(roomJID.getDomain()) %>
:"> + ">
:" type="text" size="40"> + " type="text" size="40">
:" type="text" size="40"> + " type="text" size="40">
- +
- +
<%= room.getName() %><%= StringUtils.escapeHTMLTags(room.getName()) %> <%= room.getOccupantsCount() %> / <%= room.getMaxUsers() %> <%= dateFormatter.format(room.getCreationDate()) %> <%= dateFormatter.format(room.getModificationDate()) %>
<%= role.getUserAddress() %><%= role.getNickname() %><%= role.getRole() %><%= role.getAffiliation() %><%= StringUtils.escapeHTMLTags(role.getUserAddress().toString()) %><%= StringUtils.escapeHTMLTags(role.getNickname().toString()) %><%= StringUtils.escapeHTMLTags(role.getRole().toString()) %><%= StringUtils.escapeHTMLTags(role.getAffiliation().toString()) %> &nickName=<%= URLEncoder.encode(role.getNickname(), "UTF-8") %>&kick=1" title=""><fmt:message key=" border="0" width="16" height="16"/>
- <%= mucname %> + <%= StringUtils.escapeHTMLTags(mucname) %>
<% if (create) { %> - "> + "> <% if (errors.get("mucname") != null) { %> @@ -173,7 +174,7 @@ <% } %> <% } else { %> - <%= mucname %> + <%= StringUtils.escapeHTMLTags(mucname) %> <% } %>
- "> + ">
@@ -193,4 +194,4 @@ - \ No newline at end of file + diff --git a/src/web/muc-service-summary.jsp b/src/web/muc-service-summary.jsp index 2c6ef73c41..0ccd59ddac 100644 --- a/src/web/muc-service-summary.jsp +++ b/src/web/muc-service-summary.jsp @@ -19,7 +19,8 @@ --%> <%@ page import="org.jivesoftware.util.LocaleUtils, - org.jivesoftware.util.ParamUtils" + org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils" %><%@ page import="org.xmpp.packet.JID"%> <%@ page import="java.net.URLEncoder" %> <%@ page import="org.jivesoftware.openfire.muc.MultiUserChatService" %> @@ -196,7 +197,7 @@ <%= i %> - "><%= JID.unescapeNode(service.getServiceName()) %> + "><%= StringUtils.escapeHTMLTags(JID.unescapeNode(service.getServiceName())) %> <%= service.getDescription() %>   diff --git a/src/web/muc-sysadmins.jsp b/src/web/muc-sysadmins.jsp index 9a0cfa1d22..02dc90db4a 100644 --- a/src/web/muc-sysadmins.jsp +++ b/src/web/muc-sysadmins.jsp @@ -88,7 +88,7 @@

- "><%= mucname %> + "><%= StringUtils.escapeHTMLTags(mucname) %>

<% if ("true".equals(request.getParameter("deletesuccess"))) { %> @@ -135,13 +135,13 @@ - +
- " + " id="userJIDtf"> ">

@@ -171,10 +171,10 @@ %> - <%= userDisplay %> + <%= StringUtils.escapeHTMLTags(userDisplay) %> - " + " title="" onclick="return confirm('');" > @@ -191,4 +191,4 @@ - \ No newline at end of file + diff --git a/src/web/muc-tasks.jsp b/src/web/muc-tasks.jsp index d81fcd0f95..fc144eeeea 100644 --- a/src/web/muc-tasks.jsp +++ b/src/web/muc-tasks.jsp @@ -137,7 +137,7 @@

- "><%= mucname %> + "><%= StringUtils.escapeHTMLTags(mucname) %>

<% if (kickSettingSuccess || logSettingSuccess) { %> @@ -187,7 +187,7 @@ - +
@@ -228,7 +228,7 @@ - +
@@ -261,4 +261,4 @@ - \ No newline at end of file + diff --git a/src/web/security-audit-viewer.jsp b/src/web/security-audit-viewer.jsp index c59449734b..634c61efea 100644 --- a/src/web/security-audit-viewer.jsp +++ b/src/web/security-audit-viewer.jsp @@ -116,7 +116,7 @@    : - "/> + "/>
: : @@ -164,7 +164,7 @@ <%= event.getMsgID() %> - "><%= JID.unescapeNode(event.getUsername()) %> + "><%= StringUtils.escapeHTMLTags(JID.unescapeNode(event.getUsername())) %> <%= event.getNode() %> diff --git a/src/web/server-properties.jsp b/src/web/server-properties.jsp index 8323e9887b..d1cfe3bd70 100644 --- a/src/web/server-properties.jsp +++ b/src/web/server-properties.jsp @@ -298,7 +298,7 @@ function dodelete(propName) {
- + <%= StringUtils.escapeHTMLTags(n) %>
@@ -368,12 +368,12 @@ function dodelete(propName) { <% if (edit) { %> - + <%= StringUtils.escapeHTMLTags(propName) %> <% } else { %> - "> + "> <% if (errors.containsKey("propName")) { %> @@ -432,4 +432,4 @@ function dodelete(propName) {





- \ No newline at end of file + diff --git a/src/web/server-session-row.jspf b/src/web/server-session-row.jspf index f32d6d4c9b..9b30149311 100644 --- a/src/web/server-session-row.jspf +++ b/src/web/server-session-row.jspf @@ -5,6 +5,7 @@ <%@ page import="org.jivesoftware.openfire.session.IncomingServerSession, org.jivesoftware.util.JiveGlobals, + org.jivesoftware.util.StringUtils, java.net.URLEncoder, java.util.Calendar, java.util.Date"%> @@ -38,8 +39,8 @@ - - + +
" title=""><%= host %>" width="16" height="16" alt="">" title=""><%= StringUtils.escapeHTMLTags(host) %>
@@ -124,4 +125,4 @@ onclick="return confirm('');" > - \ No newline at end of file + diff --git a/src/web/session-details.jsp b/src/web/session-details.jsp index 2bb7fb3bf9..185ae9c138 100644 --- a/src/web/session-details.jsp +++ b/src/web/session-details.jsp @@ -25,6 +25,7 @@ org.jivesoftware.openfire.user.UserManager, org.jivesoftware.util.JiveGlobals, org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils, java.text.NumberFormat, java.util.Collection" errorPage="error.jsp" @@ -114,7 +115,7 @@ - <%= StringUtils.escapeForXML(address.toString()) %> + <%= StringUtils.escapeHTMLTags(address.toString()) %> @@ -125,11 +126,11 @@ <% String n = address.getNode(); %> <% if (isAnonymous) { %> - - <%= address.getResource()==null?"":StringUtils.escapeForXML(address.getResource()) %> + - <%= address.getResource()==null?"":StringUtils.escapeHTMLTags(address.getResource()) %> <% } else { %> - "><%= JID.unescapeNode(n) %> + "><%= StringUtils.escapeHTMLTags(JID.unescapeNode(n)) %> - <%= address.getResource()==null?"":StringUtils.escapeForXML(address.getResource()) %> <% } %> @@ -190,7 +191,7 @@ Presence.Show show = currentSess.getPresence().getShow(); String statusTxt = currentSess.getPresence().getStatus(); if (statusTxt != null) { - statusTxt = " -- " + StringUtils.escapeForXML(statusTxt); + statusTxt = " -- " + StringUtils.escapeHTMLTags(statusTxt); } else { statusTxt = ""; @@ -360,4 +361,4 @@ - \ No newline at end of file + diff --git a/src/web/session-row.jspf b/src/web/session-row.jspf index dc895efcb4..bb6cf21eff 100644 --- a/src/web/session-row.jspf +++ b/src/web/session-row.jspf @@ -39,7 +39,7 @@ ><%= ((!sessionManager.isAnonymousRoute(sess.getUsername())) ? JID.unescapeNode(name): ""+LocaleUtils.getLocalizedString("session.details.anonymous")+"") %> - <%= StringUtils.escapeForXML(sess.getAddress().getResource()) %> + <%= StringUtils.escapeHTMLTags(sess.getAddress().getResource()) %> <% if (sess instanceof LocalClientSession) { %> @@ -94,7 +94,7 @@ <% if (_stat != null) { %> - <%= _stat %> + <%= StringUtils.escapeHTMLTags(_stat) %> <% } else { %> @@ -120,7 +120,7 @@ <% if (_stat != null) { %> - <%= sess.getPresence().getStatus() %> + <%= StringUtils.escapeHTMLTags(sess.getPresence().getStatus()) %> <% } else { %> @@ -146,7 +146,7 @@ <% if (_stat != null) { %> - <%= sess.getPresence().getStatus() %> + <%= StringUtils.escapeHTMLTags(sess.getPresence().getStatus()) %> <% } else { %> @@ -177,4 +177,4 @@ onclick="return confirm('');" > - \ No newline at end of file + diff --git a/src/web/session-summary.jsp b/src/web/session-summary.jsp index 2b8694e8df..de90708c89 100644 --- a/src/web/session-summary.jsp +++ b/src/web/session-summary.jsp @@ -290,4 +290,4 @@

- \ No newline at end of file + diff --git a/src/web/ssl-certificates.jsp b/src/web/ssl-certificates.jsp index 05805fe5b1..7e12294ec7 100644 --- a/src/web/ssl-certificates.jsp +++ b/src/web/ssl-certificates.jsp @@ -14,6 +14,7 @@ <%@ page import="java.util.HashMap" %> <%@ page import="java.util.LinkedHashMap" %> <%@ page import="java.util.Map" %> +<%@ page import="java.net.URLEncoder" %> <%@ page import="org.jivesoftware.openfire.container.PluginManager" %> <%@ page import="org.jivesoftware.openfire.container.AdminConsolePlugin" %> <%@ page import="java.io.IOException" %> @@ -356,7 +357,7 @@ <%= (i) %>. - <%= identities.toString() %> (<%= a %>) + <%= StringUtils.escapeHTMLTags(identities.toString()) %> (<%= StringUtils.escapeHTMLTags(a) %>) <% boolean expired = c.getNotAfter().before(new Date()); @@ -388,7 +389,7 @@ <%= c.getPublicKey().getAlgorithm() %> - " onclick="return confirm('');" > @@ -397,7 +398,7 @@ <% if (isSigningPending) { %>
- + diff --git a/src/web/ssl-signing-request.jsp b/src/web/ssl-signing-request.jsp index 71642ef8c4..d3c18af2ce 100644 --- a/src/web/ssl-signing-request.jsp +++ b/src/web/ssl-signing-request.jsp @@ -1,5 +1,6 @@ <%@ page import="org.jivesoftware.util.CertificateManager" %> <%@ page import="org.jivesoftware.util.ParamUtils" %> +<%@ page import="org.jivesoftware.util.StringUtils" %> <%@ page import="org.jivesoftware.openfire.XMPPServer" %> <%@ page import="org.jivesoftware.openfire.net.SSLConfig" %> <%@ page import="java.security.KeyStore" %> @@ -204,42 +205,42 @@ " id="namef"> + value="<%= ((name!=null) ? StringUtils.escapeForXML(name) : "") %>" id="namef"> - " id="ouf"> + " id="ouf"> - " id="of"> + " id="of"> - " id="cityf"> + " id="cityf"> - " id="statef"> + " id="statef"> - " id="countryf"> + " id="countryf"> @@ -254,4 +255,4 @@ - \ No newline at end of file + diff --git a/src/web/system-cache.jsp b/src/web/system-cache.jsp index 50b7c65c2b..8eee0410d3 100644 --- a/src/web/system-cache.jsp +++ b/src/web/system-cache.jsp @@ -1,5 +1,6 @@ <%@ page import="org.jivesoftware.util.cache.Cache"%> <%@ page import="org.jivesoftware.util.ParamUtils"%> +<%@ page import="org.jivesoftware.util.StringUtils"%> <%@ page import="java.text.DecimalFormat"%> <%-- - $RCSfile$ @@ -193,7 +194,7 @@ - +
<%= cache.getName() %><%= StringUtils.escapeHTMLTags(cache.getName()) %>
diff --git a/src/web/system-clustering.jsp b/src/web/system-clustering.jsp index f13aa03570..8a7fa4f244 100644 --- a/src/web/system-clustering.jsp +++ b/src/web/system-clustering.jsp @@ -37,6 +37,7 @@ <%@ page import="java.util.Collection" %> <%@ page import="java.util.Date" %> <%@ page import="java.util.Map" %> +<%@ page import="java.net.URLEncoder" %> <%@ page import="org.jivesoftware.util.Base64" %> @@ -282,12 +283,12 @@ %> " valign="middle"> - - + <% if (isLocalMember) { %> <%= nodeInfo.getHostName() %> <% } else { %> diff --git a/src/web/system-email.jsp b/src/web/system-email.jsp index fe7b124e16..1c92ad4861 100644 --- a/src/web/system-email.jsp +++ b/src/web/system-email.jsp @@ -156,7 +156,7 @@ : - " size="40" maxlength="150"> + " size="40" maxlength="150"> @@ -201,7 +201,7 @@ : - " size="40" maxlength="150"> + " size="40" maxlength="150"> @@ -230,4 +230,4 @@ - \ No newline at end of file + diff --git a/src/web/system-emailtest.jsp b/src/web/system-emailtest.jsp index 0e908e94ce..b5dc51f441 100644 --- a/src/web/system-emailtest.jsp +++ b/src/web/system-emailtest.jsp @@ -17,6 +17,7 @@ <%@ page import="org.jivesoftware.util.*, org.jivesoftware.openfire.user.*, java.util.*, + java.net.URLEncoder, javax.mail.*, javax.mail.internet.*" errorPage="error.jsp" @@ -199,7 +200,7 @@ function checkClick(el) { <% if (mex instanceof AuthenticationFailedException) { %> <% } else { %> - (Message: <%= mex.getMessage() %>) + (Message: <%= StringUtils.escapeHTMLTags(mex.getMessage()) %>) <% } %> <% } %> @@ -229,7 +230,7 @@ function checkClick(el) { <% } else { %> - <%= host %>:<%= JiveGlobals.getIntProperty("mail.smtp.port", 25) %> + <%= StringUtils.escapeHTMLTags(host) %>:<%= JiveGlobals.getIntProperty("mail.smtp.port", 25) %> <% if (JiveGlobals.getBooleanProperty("mail.smtp.ssl", false)) { %> @@ -244,10 +245,10 @@ function checkClick(el) { : - + <%= StringUtils.escapeHTMLTags(from) %> - (Update Address) + (Update Address)
@@ -256,7 +257,7 @@ function checkClick(el) { : - " + " size="40" maxlength="100"> @@ -265,7 +266,7 @@ function checkClick(el) { : - " + " size="40" maxlength="100"> @@ -274,7 +275,7 @@ function checkClick(el) { : - + @@ -290,4 +291,4 @@ function checkClick(el) { - \ No newline at end of file + diff --git a/src/web/user-create.jsp b/src/web/user-create.jsp index 14dfc1271e..08e35f6853 100644 --- a/src/web/user-create.jsp +++ b/src/web/user-create.jsp @@ -213,14 +213,14 @@ * - " + " id="usernametf" autocomplete="off"> <%= UserManager.getUserProvider().isNameRequired() ? "*" : "" %> - " + " id="nametf"> @@ -228,7 +228,7 @@ <%= UserManager.getUserProvider().isEmailRequired() ? "*" : "" %> - " + " id="emailtf"> @@ -299,4 +299,4 @@ if (UserManager.getUserProvider().isReadOnly()) { %> <% } %> - \ No newline at end of file + diff --git a/src/web/user-delete.jsp b/src/web/user-delete.jsp index 31331eb95b..c5b61b90bd 100644 --- a/src/web/user-delete.jsp +++ b/src/web/user-delete.jsp @@ -24,6 +24,7 @@ %> <%@ page import="org.jivesoftware.openfire.user.UserManager" %> <%@ page import="org.jivesoftware.util.ParamUtils" %> +<%@ page import="org.jivesoftware.util.StringUtils" %> <%@ page import="org.xmpp.packet.JID" %> <%@ page import="org.xmpp.packet.StreamError" %> <%@ page import="java.net.URLEncoder" %> @@ -95,7 +96,7 @@

-"><%= JID.unescapeNode(user.getUsername()) %> +"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %>

@@ -106,7 +107,7 @@
- + "> ">
diff --git a/src/web/user-edit-form.jsp b/src/web/user-edit-form.jsp index 79cbbcd9ab..8fcc32d371 100644 --- a/src/web/user-edit-form.jsp +++ b/src/web/user-edit-form.jsp @@ -18,6 +18,7 @@ --%> <%@ page import="org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils, org.jivesoftware.openfire.user.*, java.net.URLEncoder" errorPage="error.jsp" @@ -141,7 +142,7 @@
- +
@@ -154,7 +155,7 @@ : - <%= JID.unescapeNode(user.getUsername()) %> + <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %> @@ -163,7 +164,7 @@ + value="<%= StringUtils.escapeForXML(user.getName()) %>"> @@ -172,7 +173,7 @@ "> + value="<%= ((user.getEmail()!=null) ? StringUtils.escapeForXML(user.getEmail()) : "") %>"> <% if (!AdminManager.getAdminProvider().isReadOnly()) { %> diff --git a/src/web/user-lockout.jsp b/src/web/user-lockout.jsp index 8b4924d1b5..5d50133ac7 100644 --- a/src/web/user-lockout.jsp +++ b/src/web/user-lockout.jsp @@ -24,6 +24,7 @@ <%@ page import="org.jivesoftware.openfire.security.SecurityAuditManager" %> <%@ page import="org.jivesoftware.openfire.session.ClientSession" %> <%@ page import="org.jivesoftware.util.ParamUtils" %> +<%@ page import="org.jivesoftware.util.StringUtils" %> <%@ page import="org.xmpp.packet.JID" %> <%@ page import="org.xmpp.packet.StreamError" %> <%@ page import="java.net.URLEncoder" %> @@ -133,7 +134,7 @@

- "+JID.unescapeNode(username)+"" %>"/> + "+StringUtils.escapeHTMLTags(JID.unescapeNode(username))+"" %>"/> <% if (flag.getStartTime() != null) { %> <% } %> <% if (flag.getStartTime() != null && flag.getEndTime() != null) { %> <% } %> @@ -141,7 +142,7 @@

- + "> "> @@ -154,7 +155,7 @@

-"><%= JID.unescapeNode(username) %> +"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(username)) %>

@@ -183,7 +184,7 @@

<% } %> - + "> "> diff --git a/src/web/user-message.jsp b/src/web/user-message.jsp index de087fde0e..ee7c71f905 100644 --- a/src/web/user-message.jsp +++ b/src/web/user-message.jsp @@ -19,6 +19,7 @@ --%> <%@ page import="org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils, org.jivesoftware.openfire.SessionManager, org.jivesoftware.openfire.session.ClientSession, org.jivesoftware.openfire.user.User, @@ -169,7 +170,7 @@ function updateSelect(el) {
<% if(username != null){ %> - + <% } %> @@ -276,4 +277,4 @@ document.f.message.focus(); - \ No newline at end of file + diff --git a/src/web/user-password.jsp b/src/web/user-password.jsp index c341c8f687..a5d954ac0e 100644 --- a/src/web/user-password.jsp +++ b/src/web/user-password.jsp @@ -132,7 +132,7 @@

- +
@@ -144,7 +144,7 @@ : - <%= JID.unescapeNode(user.getUsername()) %> + <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %> diff --git a/src/web/user-properties.jsp b/src/web/user-properties.jsp index 8b2ab9f7d6..dcc56e8641 100644 --- a/src/web/user-properties.jsp +++ b/src/web/user-properties.jsp @@ -28,6 +28,7 @@ <%@ page import="org.jivesoftware.util.JiveGlobals"%> <%@ page import="org.jivesoftware.util.LocaleUtils"%> <%@ page import="org.jivesoftware.util.ParamUtils"%> +<%@ page import="org.jivesoftware.util.StringUtils"%> <%@ page import="org.xmpp.packet.JID"%><%@ page import="org.xmpp.packet.Presence"%> <%@ page import="java.net.URLEncoder" %> <%@ page import="java.util.Collection" %> @@ -185,7 +186,7 @@ : - <%= JID.unescapeNode(user.getUsername()) %> + <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %> <% if (lockedOut) { %><fmt:message key='user.properties.locked'/><% } %> <% if (pendingLockOut) { %><fmt:message key='user.properties.locked_set'/><% } %> @@ -241,7 +242,7 @@ <% } else { %> - <%= user.getName() %> + <%= StringUtils.escapeHTMLTags(user.getName()) %> <% } %> @@ -257,7 +258,7 @@ <% } else { %> - <%= user.getEmail() %> + <%= StringUtils.escapeHTMLTags(user.getEmail()) %> <% } %>   @@ -306,11 +307,11 @@ <% if (user != null && !UserManager.getUserProvider().isReadOnly()) { %> - + "> <% } %> - \ No newline at end of file + diff --git a/src/web/user-roster-add.jsp b/src/web/user-roster-add.jsp index 3ed322b893..4b5f778959 100644 --- a/src/web/user-roster-add.jsp +++ b/src/web/user-roster-add.jsp @@ -107,7 +107,7 @@

- +

@@ -156,7 +156,7 @@
- +
@@ -167,7 +167,7 @@ * - " + " id="jidtf"> @@ -176,7 +176,7 @@ - " + " id="nicknametf"> @@ -184,7 +184,7 @@ - " + " id="groupstf"> @@ -211,4 +211,4 @@ - \ No newline at end of file + diff --git a/src/web/user-roster-delete.jsp b/src/web/user-roster-delete.jsp index 0155719972..adec36e8a7 100644 --- a/src/web/user-roster-delete.jsp +++ b/src/web/user-roster-delete.jsp @@ -67,14 +67,14 @@

- "+jid+"" %>" /> - "+username+"" %>" /> + "+StringUtils.escapeForXML(jid)+"" %>" /> + "+StringUtils.escapeForXML(username)+"" %>" />

- - + + "> "> diff --git a/src/web/user-roster-edit.jsp b/src/web/user-roster-edit.jsp index 81fd2f8501..3ed274bfc2 100644 --- a/src/web/user-roster-edit.jsp +++ b/src/web/user-roster-edit.jsp @@ -18,6 +18,7 @@ --%> <%@ page import="org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils, java.net.URLEncoder" errorPage="error.jsp" %><%@ page import="org.xmpp.packet.JID"%> @@ -85,14 +86,14 @@

- +

- - + +
@@ -105,7 +106,7 @@ : - <%= jid %> + <%= StringUtils.escapeHTMLTags(jid) %> @@ -114,7 +115,7 @@ + value="<%= StringUtils.escapeForXML(item.getNickname()) %>"> @@ -131,7 +132,7 @@ if (count != 0) { out.print(","); } - out.print(group); + out.print(StringUtils.escapeForXML(group)); count++; } } @@ -152,7 +153,7 @@ out.print(","); } out.print(""); - out.print(group.getName()); + out.print(StringUtils.escapeForXML(group.getName())); out.print(""); count++; } @@ -190,4 +191,4 @@ - \ No newline at end of file + diff --git a/src/web/user-roster-view.jsp b/src/web/user-roster-view.jsp index 5155623c5c..cb0254a192 100644 --- a/src/web/user-roster-view.jsp +++ b/src/web/user-roster-view.jsp @@ -18,6 +18,7 @@ --%> <%@ page import="org.jivesoftware.util.ParamUtils, + org.jivesoftware.util.StringUtils, java.net.URLEncoder" errorPage="error.jsp" %><%@ page import="org.xmpp.packet.JID"%> @@ -84,7 +85,7 @@

- +

@@ -98,7 +99,7 @@ : - <%= jid %> + <%= StringUtils.escapeHTMLTags(jid) %> @@ -106,7 +107,7 @@ : - <%= item.getNickname() %> + <%= StringUtils.escapeHTMLTags(item.getNickname()) %> @@ -122,7 +123,7 @@ if (count != 0) { out.print(","); } - out.print(group); + out.print(StringUtils.escapeForXML(group)); count++; } } @@ -146,7 +147,7 @@ out.print(","); } out.print(""); - out.print(group.getName()); + out.print(StringUtils.escapeForXML(group.getName())); out.print(""); count++; } @@ -162,7 +163,7 @@ : - <%= item.getSubStatus().getName() %> + <%= StringUtils.escapeHTMLTags(item.getSubStatus().getName()) %> @@ -173,18 +174,18 @@

- - + + ">
<% if (sharedGroups.isEmpty()) { %>
- - + + ">
<% } %> - \ No newline at end of file + diff --git a/src/web/user-roster.jsp b/src/web/user-roster.jsp index 3fc4608d94..7ce3596707 100644 --- a/src/web/user-roster.jsp +++ b/src/web/user-roster.jsp @@ -149,7 +149,7 @@

- "+JID.unescapeNode(username)+"" %>" /> + "+StringUtils.escapeForXML(JID.unescapeNode(username))+"" %>" />

@@ -298,7 +298,7 @@ ><%= rosterItem.getJid() %> - <%= (rosterItem.getNickname() != null ? rosterItem.getNickname() : "None") %> + <%= (rosterItem.getNickname() != null ? StringUtils.escapeHTMLTags(rosterItem.getNickname()) : "None") %> <% @@ -363,4 +363,4 @@

- \ No newline at end of file + diff --git a/src/web/user-search.jsp b/src/web/user-search.jsp index 252f5f1a5f..093b27ee36 100644 --- a/src/web/user-search.jsp +++ b/src/web/user-search.jsp @@ -65,7 +65,7 @@ : - " size="30" maxlength="75"/> + " size="30" maxlength="75"/> "/>"/> diff --git a/src/web/user-summary.jsp b/src/web/user-summary.jsp index b39019112f..b241f29784 100644 --- a/src/web/user-summary.jsp +++ b/src/web/user-summary.jsp @@ -230,13 +230,13 @@ <% } %> - "<%= lockedOut ? " style='text-decoration: line-through underline;'" : "" %>><%= JID.unescapeNode(user.getUsername()) %> + "<%= lockedOut ? " style='text-decoration: line-through underline;'" : "" %>><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %> <% if (isAdmin) { %><fmt:message key='user.properties.isadmin'/><% } %> <% if (lockedOut) { %><fmt:message key='user.properties.locked'/><% } %> <% if (pendingLockOut) { %><fmt:message key='user.properties.locked_set'/><% } %> - <%= user.getName() %>   + <%= StringUtils.escapeHTMLTags(user.getName()) %>   <%= JiveGlobals.formatDate(user.getCreationDate()) %>