SEBSERV-444 fixed

SafeExamBrowser · May 11, 2023 · af17420 · af17420
1 parent 5612016
commit af17420
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 4 deletions.
diff --git a/src/main/java/ch/ethz/seb/sebserver/gui/content/exam/LmsSetupForm.java b/src/main/java/ch/ethz/seb/sebserver/gui/content/exam/LmsSetupForm.java
@@ -15,6 +15,7 @@
 import java.util.function.Function;
 
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.text.StringEscapeUtils;
 import org.eclipse.swt.SWT;
 import org.eclipse.swt.widgets.Button;
 import org.eclipse.swt.widgets.Composite;
@@ -481,7 +482,7 @@ private static PageAction handleTestResult(
                 case TOKEN_REQUEST: {
                     throw new PageMessageException(new LocTextKey(
                             "sebserver.lmssetup.action.test.tokenRequestError",
-                            Utils.formatHTMLLinesForceEscaped(Utils.escapeHTML_XML_EcmaScript(error.message))));
+                            Utils.formatHTMLLinesForceEscaped(StringEscapeUtils.escapeHtml4(error.message))));
                 }
                 case QUIZ_ACCESS_API_REQUEST: {
                     if (error.message.contains("quizaccess_sebserver_get_exams")) {

diff --git a/src/main/java/ch/ethz/seb/sebserver/gui/service/i18n/impl/PolyglotPageServiceImpl.java b/src/main/java/ch/ethz/seb/sebserver/gui/service/i18n/impl/PolyglotPageServiceImpl.java
@@ -11,7 +11,9 @@
 import java.util.Locale;
 import java.util.function.Consumer;
 
+import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.StringUtils;
+import org.apache.commons.text.StringEscapeUtils;
 import org.eclipse.rap.rwt.RWT;
 import org.eclipse.swt.SWT;
 import org.eclipse.swt.widgets.Button;
@@ -269,8 +271,14 @@ private static Consumer<Label> labelFunction(
             final I18nSupport i18nSupport) {
 
         return label -> {
+
             if (locTextKey != null) {
-                label.setText(i18nSupport.getText(locTextKey));
+                final String text = i18nSupport.getText(locTextKey);
+                if (BooleanUtils.toBoolean((Boolean) label.getData(RWT.MARKUP_ENABLED))) {
+                    label.setText(StringEscapeUtils.escapeHtml4(text));
+                } else {
+                    label.setText(text);
+                }
             }
             if (i18nSupport.hasText(locToolTipKey)) {
                 label.setToolTipText(Utils.formatLineBreaks(i18nSupport.getText(locToolTipKey)));

diff --git a/src/main/java/ch/ethz/seb/sebserver/gui/widget/Message.java b/src/main/java/ch/ethz/seb/sebserver/gui/widget/Message.java
@@ -10,14 +10,14 @@
 
 import java.util.Locale;
 
+import org.apache.commons.text.StringEscapeUtils;
 import org.eclipse.rap.rwt.RWT;
 import org.eclipse.rap.rwt.widgets.DialogCallback;
 import org.eclipse.swt.graphics.Rectangle;
 import org.eclipse.swt.layout.GridLayout;
 import org.eclipse.swt.widgets.MessageBox;
 import org.eclipse.swt.widgets.Shell;
 
-import ch.ethz.seb.sebserver.gbl.util.Utils;
 import ch.ethz.seb.sebserver.gui.service.i18n.I18nSupport;
 import ch.ethz.seb.sebserver.gui.widget.WidgetFactory.CustomVariant;
 
@@ -46,7 +46,7 @@ protected void prepareOpen() {
             super.prepareOpen();
         } catch (final IllegalArgumentException e) {
             // fallback on markup text error
-            super.setMessage(Utils.escapeHTML_XML_EcmaScript(super.getMessage()));
+            super.setMessage(StringEscapeUtils.escapeHtml4(super.getMessage()));
             super.prepareOpen();
         }
         final GridLayout layout = (GridLayout) super.shell.getLayout();