https://issues.apache.org/jira/browse/AMQ-4397 - xss in cron expressions

git-svn-id: https://svn.apache.org/repos/asf/activemq/trunk@1459265 13f79535-47bb-0310-9956-ffa450edef68
apache · Mar 21, 2013 · 148ca81 · 148ca81
1 parent 0d58477
commit 148ca81
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 8 deletions.
diff --git a/activemq-client/src/main/java/org/apache/activemq/broker/scheduler/CronParser.java b/activemq-client/src/main/java/org/apache/activemq/broker/scheduler/CronParser.java
@@ -42,7 +42,7 @@ public static long getNextScheduledTime(final String cronEntry, long currentTime
 
         // Handle the once per minute case "* * * * *"
         // starting the next event at the top of the minute.
-        if (cronEntry.startsWith("* * * * *")) {
+        if (cronEntry.equals("* * * * *")) {
             result = currentTime + 60 * 1000;
             result = result / 1000 * 1000;
             return result;

diff --git a/activemq-web-console/src/main/webapp/scheduled.jsp b/activemq-web-console/src/main/webapp/scheduled.jsp
@@ -40,13 +40,13 @@
 		<c:forEach items="${requestContext.brokerQuery.scheduledJobs}"
 		var="row">
 		<tr>
-		 <td>${row.jobId}</td>
-		 <td>${row.cronEntry}</td>
-		 <td>${row.nextExecutionTime}</td>
-		 <td>${row.start}</td>
-		 <td>${row.delay}</td>
-	 	 <td>${row.period}</td>
-	     <td>${row.repeat}</td>
+		 <td><c:out value="${row.jobId}"/></td>
+		 <td><c:out value="${row.cronEntry}"/></td>
+		 <td><c:out value="${row.nextExecutionTime}"/></td>
+		 <td><c:out value="${row.start}"/></td>
+		 <td><c:out value="${row.delay}"/></td>
+	 	 <td><c:out value="${row.period}"/></td>
+	     <td><c:out value="${row.repeat}"/></td>
 		<td>
 		    <a href="deleteJob.action?jobId=${row.jobId}&secret=<c:out value='${sessionScope["secret"]}'/>">Delete</a>
 		</td>