File tree Expand file tree Collapse file tree 3 files changed +12
-4
lines changed
java/org/silverpeas/web/notificationuser Expand file tree Collapse file tree 3 files changed +12
-4
lines changed Original file line number Diff line number Diff line change 1
1
package org .silverpeas .web .notificationuser .control ;
2
2
3
- import org .owasp .encoder .Encode ;
4
3
import org .silverpeas .core .admin .user .model .User ;
5
4
import org .silverpeas .core .notification .user .UserNotification ;
6
5
import org .silverpeas .core .notification .user .client .GroupRecipient ;
@@ -58,7 +57,7 @@ public UserNotificationWrapper setTitle(final String title) {
58
57
final boolean isSimpleContents = metaData .getTemplateContents ().isEmpty ();
59
58
final Map <String , String > simpleContents = metaData .getSimpleContents ();
60
59
for (String lang : DisplayI18NHelper .getLanguages ()) {
61
- metaData .setTitle (Encode . forHtml ( title ) , lang );
60
+ metaData .setTitle (title , lang );
62
61
if (isSimpleContents && isNotDefined (simpleContents .get (lang ))) {
63
62
final LocalizationBundle bundle = getLocalizationBundle (
64
63
"org.silverpeas.alertUserPeas.multilang.alertUserPeasBundle" , lang );
Original file line number Diff line number Diff line change @@ -129,7 +129,14 @@ private NotificationContext getNotificationContext(final HttpRequest request) {
129
129
final HtmlSanitizer htmlSanitizer = HtmlSanitizer .get ();
130
130
while (parameters .hasMoreElements ()) {
131
131
final String name = parameters .nextElement ();
132
- context .put (name , htmlSanitizer .sanitize (request .getParameter (name )));
132
+ final String value = request .getParameter (name );
133
+ boolean isBase64 = false ;
134
+ try {
135
+ isBase64 = value != null && StringUtil .fromBase64 (value ).length > 0 ;
136
+ } catch (Exception ignore ) {
137
+ // if not base64 encoded, value can be sanitized
138
+ }
139
+ context .put (name , isBase64 ? value : htmlSanitizer .sanitize (value ));
133
140
}
134
141
return context ;
135
142
}
Original file line number Diff line number Diff line change 27
27
Silverpeas plugin which handles the behaviour about the user notification.
28
28
*/
29
29
30
+ //# sourceURL=/util/javaScript/silverpeas-user-notification.js
31
+
30
32
( function ( ) {
31
33
32
34
var $window = top . spLayout ? top . window : window ;
@@ -232,7 +234,7 @@ Silverpeas plugin which handles the behaviour about the user notification.
232
234
__notificationMonitor . newOne ( userNotification ) ;
233
235
try {
234
236
this . notifyOnDesktop ( userNotification . sender , {
235
- body : userNotification . subject ,
237
+ body : userNotification . subject . unescapeHTML ( ) ,
236
238
tag : userNotification . id ,
237
239
icon : DESKTOP_USER_NOTIFICATION_ICON_URL
238
240
} , function ( desktopNotification ) {
You can’t perform that action at this time.
0 commit comments