Skip to content

Commit ccb41d5

Browse files
SilverYoChammoqui
SilverYoCha
authored and
mmoqui
committed
security #token : - handling the creation menu item area which content is added after the end of the loading of the HTLM page
- adding a rule to prevent from the token validation on some of REST WEB services - removing location.href use on sensible functionalities : . deleting resource from resource manager component . deleting reservation from resource manager component - fixing : . kmax components which didn't work with security tokens (renaming also "nodeName" ids in "nodeNameValue" because of a jQuery bug) . adding to favorite from a publication . thumbnail management on publication header . subscription to forum application . technical navigation error after saving the content of webPages component . navigation problem on process manager application - upgrading subscription UI response on blog component
1 parent 9c05ae0 commit ccb41d5

File tree

21 files changed

+55
-36
lines changed

21 files changed

+55
-36
lines changed

‎blog/blog-war/src/main/java/com/silverpeas/blog/control/BlogSessionController.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@
7878
import org.codehaus.jackson.xc.JaxbAnnotationIntrospector;
7979
import org.silverpeas.node.web.NodeEntity;
8080
import org.silverpeas.search.indexEngine.model.IndexManager;
81+
import org.silverpeas.util.NotifierUtil;
8182

8283
import static com.silverpeas.pdc.model.PdcClassification.aPdcClassificationOfContent;
8384

@@ -344,10 +345,12 @@ public Collection<PostDetail> getResultSearch(String word) {
344345

345346
public synchronized void addUserSubscription() throws RemoteException {
346347
getBlogService().addSubscription(getUserId(), getComponentId());
348+
NotifierUtil.addSuccess(getString("blog.addSubscriptionOk"));
347349
}
348350

349351
public synchronized void removeUserSubscription() throws RemoteException {
350352
getBlogService().removeSubscription(getUserId(), getComponentId());
353+
NotifierUtil.addSuccess(getString("blog.removeSubscriptionOk"));
351354
}
352355

353356
public synchronized boolean isUserSubscribed() throws RemoteException {

‎blog/blog-war/src/main/webapp/blog/jsp/accueil.jsp

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,13 +101,11 @@ function sendData() {
101101
}
102102
103103
function addSubscription() {
104-
window.alert("<%=resource.getString("blog.addSubscriptionOk")%>");
105104
window.document.subscriptionForm.action = "AddSubscription";
106105
window.document.subscriptionForm.submit();
107106
}
108107
109108
function removeSubscription() {
110-
window.alert("<%=resource.getString("blog.removeSubscriptionOk")%>");
111109
window.document.subscriptionForm.action = "RemoveSubscription";
112110
window.document.subscriptionForm.submit();
113111
}

‎forums/forums-war/src/main/java/org/silverpeas/servlets/ForumsRequestRouter.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ public String getDestination(String function, ForumsSessionController forumsSC,
6666
try {
6767
if ((function.startsWith("Main")) || (function.startsWith("main"))) {
6868
String forumId = request.getParameter("forumId");
69-
if (forumId != null && Integer.parseInt(forumId) > 0) {
69+
if (StringUtil.isInteger(forumId) && Integer.parseInt(forumId) > 0) {
7070
return ROOT_DEST + ActionUrl.getUrl("viewForum", "main", Integer.parseInt(forumId));
7171
}
7272
destination = ROOT_DEST + "main.jsp";

‎gallery/gallery-war/src/main/webapp/gallery/jsp/viewAlbum.jsp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@
169169
170170
function addFavorite(m_sAbsolute,m_context,name,description,url)
171171
{
172-
urlWindow = m_sAbsolute + m_context + "/RmyLinksPeas/jsp/CreateLinkFromComponent?Name="+name+"&Description="+description+"&Url="+url+"&Visible=true";
172+
urlWindow = m_sAbsolute + m_context + "/RmyLinksPeas/jsp/AddLinkFromComponent?Name="+name+"&Description="+description+"&Url="+url+"&Visible=true";
173173
windowName = "albumWindow";
174174
larg = "550";
175175
haut = "250";

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/javaScript/navigation.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ var exportComponentWindow = window;
66

77
function addFavorite(name, description, url)
88
{
9-
urlWindow = getWebContext() + "/RmyLinksPeas/jsp/CreateLinkFromComponent?Name=" + name + "&Description=" + description + "&Url=" + url + "&Visible=true";
9+
urlWindow = getWebContext() + "/RmyLinksPeas/jsp/AddLinkFromComponent?Name=" + name + "&Description=" + description + "&Url=" + url + "&Visible=true";
1010
windowName = "favoriteWindow";
1111
larg = "550";
1212
haut = "250";

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/kmax.jsp

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,12 @@ function search() {
9191
timeCriteria = "X";
9292
timeCriteriaUsed = 0;
9393
<% if (kmeliaScc.isTimeAxisUsed()) { %>
94-
timeCriteria = document.axisForm.elements[document.axisForm.length - 1].value;
95-
timeCriteriaUsed = 1;
94+
// -2 instead of -1 because of security tokens
95+
// before, it was :
96+
// - document.axisForm.elements[document.axisForm.length - 1].value
97+
// - timeCriteriaUsed = 1;
98+
timeCriteria = document.axisForm.elements[document.axisForm.length - 2].value;
99+
timeCriteriaUsed = 2;
96100
<% } %>
97101
for (var i=0; i<document.axisForm.length - timeCriteriaUsed; i++) {
98102
if (document.axisForm.elements[i].value.length != 0) {

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/kmax_addPositionToAxis.jsp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ out.println(board.printBefore());
120120
<%=I18NHelper.getFormLine(resources, null, kmeliaScc.getLanguage())%>
121121
<TR><TD class="txtlibform"><%=kmeliaScc.getString("ComponentTitle")%> :</TD>
122122
<TD><input type="hidden" name="AxisId" value="<%=axisId%>">
123-
<input type="text" id="nodeName" name="Name" value="" size="60" maxlength="60"> <img border="0" src="<%=mandatoryField%>" width="5" height="5"></TD></TR>
123+
<input type="text" id="nodeNameValue" name="Name" value="" size="60" maxlength="60"> <img border="0" src="<%=mandatoryField%>" width="5" height="5"></TD></TR>
124124
<TR><TD class="txtlibform"><%=kmeliaScc.getString("ComponentDescription")%> :</TD>
125125
<TD><input type="text" id="nodeDesc" name="Description" value="" size="60" maxlength="200"></TD></TR>
126126
<TR><TD colspan="2">( <img border="0" src="<%=mandatoryField%>" width="5" height="5"> = <%=kmeliaScc.getString("ChampsObligatoires")%> )</TD></TR>

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/kmax_addPositionToPosition.jsp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ out.println(board.printBefore());
126126
<TABLE cellPadding="5" cellSpacing="0" border="0">
127127
<%=I18NHelper.getFormLine(resources, null, kmeliaScc.getLanguage())%>
128128
<TR><TD class="txtlibform"><%=kmeliaScc.getString("ComponentTitle")%> :</TD>
129-
<TD><input type="hidden" name="AxisId" value="<%=axisId%>"><input type="text" id="nodeName" name="Name" value="" size="60" maxlength="60"> <img border="0" src="<%=mandatoryField%>" width="5" height="5"></TD></TR>
129+
<TD><input type="hidden" name="AxisId" value="<%=axisId%>"><input type="text" id="nodeNameValue" name="Name" value="" size="60" maxlength="60"> <img border="0" src="<%=mandatoryField%>" width="5" height="5"></TD></TR>
130130
<TR><TD class="txtlibform"><%=kmeliaScc.getString("ComponentDescription")%> :</TD>
131131
<TD><input type="text" id="nodeDesc" name="Description" value="" size="60" maxlength="200"></TD></TR>
132132
<TR><TD colspan="2">( <img border="0" src="<%=mandatoryField%>" width="5" height="5"> = <%=kmeliaScc.getString("ChampsObligatoires")%> )</TD></TR>

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/kmax_axisManager.jsp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ function positionDelete() {
264264
265265
function showTranslation(lang)
266266
{
267-
showFieldTranslation('nodeName', 'name_'+lang);
267+
showFieldTranslation('nodeNameValue', 'name_'+lang);
268268
showFieldTranslation('nodeDesc', 'desc_'+lang);
269269
}
270270

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/kmax_axisReport.jsp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ String displayAxisManageView(KmeliaSessionController kmeliaScc, GraphicElementFa
264264
result.append("<tr>");
265265
result.append("<td width=\"20%\" class=\"txtlibform\">"+kmeliaScc.getString("AxisTitle")+" : </td>");
266266
result.append("<td>");
267-
result.append("<input type=\"text\" id=\"nodeName\" name=\"Name\" value=\""+Encode.javaStringToHtmlString(axis.getName(translation))+"\" size=\"61\" maxlength=\"50\">&nbsp;<img alt=\"\" src=\""+mandatoryFieldSrc+"\" border=\"0\" width=\"5px\" height=\"5px\" />");
267+
result.append("<input type=\"text\" id=\"nodeNameValue\" name=\"Name\" value=\""+Encode.javaStringToHtmlString(axis.getName(translation))+"\" size=\"61\" maxlength=\"50\">&nbsp;<img alt=\"\" src=\""+mandatoryFieldSrc+"\" border=\"0\" width=\"5px\" height=\"5px\" />");
268268
result.append("</td>");
269269
result.append("<td>&nbsp;</td>");
270270
result.append("<td>&nbsp;</td>");
@@ -338,7 +338,7 @@ String displayComponentManageView(KmeliaSessionController kmelia, GraphicElement
338338
result.append("<tr>");
339339
result.append("<td width=\"20%\" class=\"txtlibform\">"+kmelia.getString("ComponentTitle")+" : </td>");
340340
result.append("<td>");
341-
result.append("<input type=\"text\" id=\"nodeName\" name=\"Name\" value=\""+Encode.javaStringToHtmlString(nodeDetail.getName(translation))+"\" size=\"61\" maxlength=\"50\">&nbsp;<img alt=\" \" src=\""+mandatoryFieldSrc+"\" border=\"0\" width=\"5px\" height=\"5px\" />");
341+
result.append("<input type=\"text\" id=\"nodeNameValue\" name=\"Name\" value=\""+Encode.javaStringToHtmlString(nodeDetail.getName(translation))+"\" size=\"61\" maxlength=\"50\">&nbsp;<img alt=\" \" src=\""+mandatoryFieldSrc+"\" border=\"0\" width=\"5px\" height=\"5px\" />");
342342
result.append("</td>");
343343
result.append("<td>&nbsp;</td>");
344344
result.append("<td>&nbsp;</td>");

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/kmax_portlet.jsp

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,12 @@ function search() {
8787
timeCriteria = "X";
8888
timeCriteriaUsed = 0;
8989
<% if (kmeliaScc.isTimeAxisUsed()) { %>
90-
timeCriteria = document.axisForm.elements[document.axisForm.length - 1].value;
91-
timeCriteriaUsed = 1;
90+
// -2 instead of -1 because of security tokens
91+
// before, it was :
92+
// - document.axisForm.elements[document.axisForm.length - 1].value
93+
// - timeCriteriaUsed = 1;
94+
timeCriteria = document.axisForm.elements[document.axisForm.length - 2].value;
95+
timeCriteriaUsed = 2;
9296
<% } %>
9397
for (var i=0; i<document.axisForm.length - timeCriteriaUsed; i++) {
9498
if (document.axisForm.elements[i].value.length != 0) {

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/kmax_viewCombination.jsp

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,10 @@ out.println(gef.getLookStyleSheet());
8484
function search() {
8585
z = "";
8686
nbSelectedAxis = 0;
87-
for (var i=0; i<document.axisForm.length; i++) {
87+
// -1 because of security tokens
88+
// before, it was :
89+
// - i < document.axisForm.length
90+
for (var i=0; i<(document.axisForm.length-1); i++) {
8891
if (document.axisForm.elements[i].value.length != 0) {
8992
if (nbSelectedAxis != 0)
9093
z += ",";

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/publication.jsp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -414,7 +414,7 @@
414414
var name = encodeURIComponent($("#breadCrumb").text() + " > " + $(".publiName").text());
415415
var description = encodeURIComponent("<%=EncodeHelper.javaStringToJsString(pubDetail.getDescription(language))%>");
416416
var url = "<%=URLManager.getSimpleURL(URLManager.URL_PUBLI, pubDetail.getPK().getId())%>";
417-
urlWindow = "<%=m_context%>/RmyLinksPeas/jsp/CreateLinkFromComponent?Name="+name+"&Description="+description+"&Url="+url+"&Visible=true";
417+
urlWindow = "<%=m_context%>/RmyLinksPeas/jsp/AddLinkFromComponent?Name="+name+"&Description="+description+"&Url="+url+"&Visible=true";
418418
419419
if (!favoriteWindow.closed && favoriteWindow.name== "favoriteWindow") {
420420
favoriteWindow.close();

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationManager.jsp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -590,7 +590,7 @@
590590
591591
function addFavorite(name,description,url)
592592
{
593-
urlWindow = "<%=m_context%>/RmyLinksPeas/jsp/CreateLinkFromComponent?Name="+name+"&Description="+description+"&Url="+url+"&Visible=true";
593+
urlWindow = "<%=m_context%>/RmyLinksPeas/jsp/AddLinkFromComponent?Name="+name+"&Description="+description+"&Url="+url+"&Visible=true";
594594
windowName = "favoriteWindow";
595595
larg = "550";
596596
haut = "250";
@@ -636,7 +636,7 @@
636636
}
637637
638638
function deleteThumbnail() {
639-
location.href="<%=httpServerBase + m_context%>/Thumbnail/jsp/thumbnailManager.jsp?Action=Delete<%=standardParamaters%>";
639+
jQuery('#genericForm').attr('action', "<%=httpServerBase + m_context%>/Thumbnail/jsp/thumbnailManager.jsp?Action=Delete<%=standardParamaters%>").submit();
640640
}
641641
642642
function closeThumbnailDialog() {
@@ -1015,5 +1015,6 @@
10151015
document.pubForm.Name.focus();
10161016
});
10171017
</script>
1018+
<form id="genericForm" action="" method="POST"></form>
10181019
</body>
10191020
</html>

‎kmelia/kmelia-war/src/main/webapp/kmelia/jsp/updateTopicNew.jsp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@
142142
143143
function showTranslation(lang)
144144
{
145-
showFieldTranslation('nodeName', 'name_'+lang);
145+
showFieldTranslation('nodeNameValue', 'name_'+lang);
146146
showFieldTranslation('nodeDesc', 'desc_'+lang);
147147
}
148148
@@ -186,7 +186,7 @@
186186
<%=I18NHelper.getFormLine(resources, node, translation)%>
187187
<tr>
188188
<td class="txtlibform"><fmt:message key="TopicTitle"/> :</td>
189-
<td><input type="text" name="Name" id="nodeName" value="<%=EncodeHelper.javaStringToHtmlString(name)%>" size="60" maxlength="50">&nbsp;<img border="0" alt="mandatory" src="<c:out value="${mandatoryFieldUrl}" />" width="5" height="5"/></td>
189+
<td><input type="text" name="Name" id="nodeNameValue" value="<%=EncodeHelper.javaStringToHtmlString(name)%>" size="60" maxlength="50">&nbsp;<img border="0" alt="mandatory" src="<c:out value="${mandatoryFieldUrl}" />" width="5" height="5"/></td>
190190
</tr>
191191
<c:choose>
192192
<c:when test="${true eq requestScope.IsLink}">

‎newsedito/newsedito-war/src/main/webapp/newsEdito/jsp/newsEdito.jsp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,7 @@ function viewFavorits()
159159
160160
function addFavorite(m_sAbsolute,m_context,name,description,url)
161161
{
162-
urlWindow = m_sAbsolute + m_context + "/RmyLinksPeas/jsp/CreateLinkFromComponent?Name="+name+"&Description="+description+"&Url="+url+"&Visible=true";
162+
urlWindow = m_sAbsolute + m_context + "/RmyLinksPeas/jsp/AddLinkFromComponent?Name="+name+"&Description="+description+"&Url="+url+"&Visible=true";
163163
windowName = "favoritWindow";
164164
larg = "550";
165165
haut = "250";

‎process-manager/process-manager-war/src/main/java/com/silverpeas/processManager/servlets/SessionSafeFunctionHandler.java

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,10 @@ final public String getDestination(String function, ProcessManagerSessionControl
4040
if (request.isContentInMultipart()) {
4141
try {
4242
items = new ArrayList<FileItem>();
43-
items.addAll(request.getFileItems());
43+
if (request.getAttribute("ALREADY_PROCESSED") == null) {
44+
items.addAll(request.getFileItems());
45+
request.setAttribute("ALREADY_PROCESSED", true);
46+
}
4447
} catch (UtilException e) {
4548
SilverTrace.error("processManager", "SessionSafeFunctionHandler.getDestination()",
4649
"processManager.TOKENID_CHECK_FAILURE", e);

‎resources-manager/resources-manager-war/src/main/webapp/resourcesManager/jsp/resources.jsp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,10 @@
7171
<script type="text/javascript">
7272
function deleteResource(resourceId, name,categoryId) {
7373
if (confirm("<%=resource.getString("resourcesManager.deleteResource")%>" + " " + name + " ?")) {
74-
//location.href="DeleteRessource?resourceId="+resourceId+"&categoryId="+categoryId;
75-
$('#resourceId').val(resourceId);
76-
$('#categoryId').val(categoryId);
77-
$('#resourceForm').submit();
74+
var $form = $('#resourceForm');
75+
$('#resourceId', $form).val(resourceId);
76+
$('#categoryId', $form).val(categoryId);
77+
$form.submit();
7878
}
7979
}
8080
</script>

‎resources-manager/resources-manager-war/src/main/webapp/resourcesManager/jsp/viewReservation.jsp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,9 @@ if (!isOwner) {
7171
<script type="text/javascript">
7272
function deleteReservation(){
7373
if(confirm("<%=resource.getString("resourcesManager.suppressionConfirmation")%>")){
74-
//location.href="DeleteReservation?id="+<%=reservationId%>;
75-
$('#id').val('<%=reservationId%>');
76-
$('#reservationForm').attr('action', 'DeleteReservation').submit();
74+
var $form = $('#reservationForm');
75+
$('#id', $form).val('<%=reservationId%>');
76+
$form.attr('action', 'DeleteReservation').submit();
7777
}
7878
}
7979

‎resources-manager/resources-manager-war/src/main/webapp/resourcesManager/jsp/viewReservations.jsp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,9 @@ ArrayLine arrayLine;
4646
4747
function deleteReservation(reservationId, event) {
4848
if (confirm("Etes vous sûr de vouloir supprimer la réservation liée à l'évènement "+event+"?")) {
49-
//location.href="DeleteReservation?id="+reservationId;
50-
$('input[name="id"]').val(reservationId);
51-
$('#ReservationDeletion').submit();
49+
var $form = $('#ReservationDeletion');
50+
$('#id', $form).val(reservationId);
51+
$form.submit();
5252
}
5353
}
5454

‎webpages/webpages-war/src/main/java/com/silverpeas/webpages/servlets/WebPagesRequestRouter.java

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,16 +25,18 @@
2525
import com.silverpeas.webpages.model.WebPagesException;
2626
import com.stratelia.silverpeas.peasCore.ComponentContext;
2727
import com.stratelia.silverpeas.peasCore.MainSessionController;
28+
import com.stratelia.silverpeas.peasCore.URLManager;
2829
import com.stratelia.silverpeas.peasCore.servlets.ComponentRequestRouter;
2930
import com.stratelia.silverpeas.silvertrace.SilverTrace;
30-
import java.net.URLEncoder;
31-
import java.util.List;
32-
import javax.servlet.http.HttpServletRequest;
3331
import org.apache.commons.fileupload.FileItem;
3432
import org.apache.commons.lang3.CharEncoding;
3533
import org.owasp.encoder.Encode;
3634
import org.silverpeas.servlet.HttpRequest;
3735

36+
import javax.servlet.http.HttpServletRequest;
37+
import java.net.URLEncoder;
38+
import java.util.List;
39+
3840
/**
3941
* @author sdevolder
4042
*/
@@ -108,7 +110,8 @@ public String getDestination(String function, WebPagesSessionController webPages
108110
request.setAttribute("BrowseInfo", Encode.forHtml(webPagesSC.getComponentLabel()));
109111
request.setAttribute("ObjectId", webPagesSC.getComponentId());
110112
request.setAttribute("Language", webPagesSC.getLanguage());
111-
request.setAttribute("ReturnUrl", webPagesSC.getComponentUrl() + "Preview");
113+
request.setAttribute("ReturnUrl",
114+
URLManager.getApplicationURL() + webPagesSC.getComponentUrl() + "Preview");
112115
request.setAttribute("UserId", webPagesSC.getUserId());
113116
request.setAttribute("IndexIt", "false");
114117
destination = "/wysiwyg/jsp/htmlEditor.jsp";

0 commit comments

Comments
 (0)