From cdeea61ccad80d296cab7ea8b9b9287ff3a50b47 Mon Sep 17 00:00:00 2001
From: Alex O'Ree <alexoree@apache.org>
Date: Sat, 8 Aug 2026 08:22:34 -0400
Subject: [PATCH] JSPWIKI-1275

---
 .../src/main/webapp/templates/210/EditGroupContent.jsp      | 4 ++--
 jspwiki-war/src/main/webapp/templates/210/GroupContent.jsp  | 6 +++---
 .../src/main/webapp/templates/210/NewGroupContent.jsp       | 2 +-
 .../src/main/webapp/templates/default/EditGroupContent.jsp  | 3 ++-
 jspwiki-war/src/main/webapp/templates/default/GroupTab.jsp  | 3 ++-
 5 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/jspwiki-war/src/main/webapp/templates/210/EditGroupContent.jsp b/jspwiki-war/src/main/webapp/templates/210/EditGroupContent.jsp
index e0c8f7ba89..5c78d40346 100644
--- a/jspwiki-war/src/main/webapp/templates/210/EditGroupContent.jsp
+++ b/jspwiki-war/src/main/webapp/templates/210/EditGroupContent.jsp
@@ -105,7 +105,7 @@
       <fmt:message key="editgroup.savehelp"><fmt:param><%=name%></fmt:param></fmt:message>
     </div>
       <input type="submit" name="ok" value="<fmt:message key="editgroup.submit.save"/>" />
-      <input type="hidden" name="group" value="<%=name%>" />
+      <input type="hidden" name="group" value="<%= TextUtil.replaceEntities(name) %>" />
       <input type="hidden" name="action" value="save" />
   </form>
 
@@ -118,7 +118,7 @@
         method="POST" accept-charset="UTF-8">
       <wiki:CsrfProtection/>
       <input type="submit" name="ok" value="<fmt:message key="actions.deletegroup"/>" />
-      <input type="hidden" name="group" value="${param.group}" />
+      <input type="hidden" name="group" value="${ TextUtil.replaceEntities (param.group) }" />
   </form>
   </wiki:Permission>
 
diff --git a/jspwiki-war/src/main/webapp/templates/210/GroupContent.jsp b/jspwiki-war/src/main/webapp/templates/210/GroupContent.jsp
index 8561d42a7c..21787ad0a6 100644
--- a/jspwiki-war/src/main/webapp/templates/210/GroupContent.jsp
+++ b/jspwiki-war/src/main/webapp/templates/210/GroupContent.jsp
@@ -82,8 +82,8 @@
     <wiki:Permission permission="createGroups">
       <fmt:message key="group.createsuggestion">
         <fmt:param><wiki:Link jsp="NewGroup.jsp">
-                      <wiki:Param name="group" value="<%=name%>" />
-                      <wiki:Param name="group" value="<%=name%>" />
+                      <wiki:Param name="group" value="<%=TextUtil.replaceEntities(name)%>" />
+                      <wiki:Param name="group" value="<%=TextUtil.replaceEntities(name)%>" />
                       <fmt:message key="group.createit"/>
                    </wiki:Link>
         </fmt:param>
@@ -156,7 +156,7 @@
         method="POST" accept-charset="UTF-8">
       <wiki:CsrfProtection/>
       <input type="submit" name="ok" value="<fmt:message key="actions.deletegroup"/>" />
-      <input type="hidden" name="group" value="${param.group}" />
+      <input type="hidden" name="group" value="${TextUtil.replaceEntities(param.group)}" />
   </form>
   </wiki:Permission>
 
diff --git a/jspwiki-war/src/main/webapp/templates/210/NewGroupContent.jsp b/jspwiki-war/src/main/webapp/templates/210/NewGroupContent.jsp
index 618bc8c21d..79c0f59f24 100644
--- a/jspwiki-war/src/main/webapp/templates/210/NewGroupContent.jsp
+++ b/jspwiki-war/src/main/webapp/templates/210/NewGroupContent.jsp
@@ -72,7 +72,7 @@
     <!-- Name -->
     <tr>
       <th scope="row"><label><fmt:message key="newgroup.name"/></label></th>
-      <td><input type="text" name="group" size="30" value="<%=name%>" />
+      <td><input type="text" name="group" size="30" value="<%=TextUtil.replaceEntities(name)%>" />
       <div class="formhelp">
         <fmt:message key="newgroup.name.description"/>
       </div>
diff --git a/jspwiki-war/src/main/webapp/templates/default/EditGroupContent.jsp b/jspwiki-war/src/main/webapp/templates/default/EditGroupContent.jsp
index efccd99b3f..b05342fa8e 100644
--- a/jspwiki-war/src/main/webapp/templates/default/EditGroupContent.jsp
+++ b/jspwiki-war/src/main/webapp/templates/default/EditGroupContent.jsp
@@ -23,6 +23,7 @@
 <%@ page import="org.apache.logging.log4j.LogManager" %>
 <%@ page import="org.apache.wiki.api.core.*" %>
 <%@ page import="org.apache.wiki.auth.authorize.Group" %>
+<%@ page import="org.apache.wiki.util.TextUtil" %>
 <%@ page import="org.apache.wiki.util.comparators.PrincipalComparator" %>
 <%@ page errorPage="/Error.jsp" %>
 <%@ taglib uri="http://jspwiki.apache.org/tags" prefix="wiki" %>
@@ -63,7 +64,7 @@
             id="editGroup"
         method="POST" accept-charset="UTF-8">
 
-    <input type="hidden" name="group" value="${name}" />
+    <input type="hidden" name="group" value="${ TextUtil.replaceEntities(name) }" />
     <wiki:CsrfProtection/>
 
     <div class="form-group">
diff --git a/jspwiki-war/src/main/webapp/templates/default/GroupTab.jsp b/jspwiki-war/src/main/webapp/templates/default/GroupTab.jsp
index d7de1135f2..7a7b9fb306 100644
--- a/jspwiki-war/src/main/webapp/templates/default/GroupTab.jsp
+++ b/jspwiki-war/src/main/webapp/templates/default/GroupTab.jsp
@@ -30,6 +30,7 @@
 <%@ page import="org.apache.wiki.auth.authorize.GroupManager" %>
 <%@ page import="org.apache.wiki.preferences.Preferences" %>
 <%@ page import="org.apache.wiki.util.comparators.PrincipalComparator" %>
+<%@ page import="org.apache.wiki.util.TextUtil" %>
 <%@ page errorPage="/Error.jsp" %>
 <%@ taglib uri="http://jspwiki.apache.org/tags" prefix="wiki" %>
 <%@ taglib prefix="c" uri="jakarta.tags.core" %>
@@ -102,7 +103,7 @@
       class="hidden"
         name="deleteGroupForm" id="deleteGroupForm"
       method="POST" accept-charset="UTF-8">
-  <input type="hidden" name="group" value="${group.name}" />
+  <input type="hidden" name="group" value="${ TextUtil.replaceEntities(group.name)}" />
   <wiki:CsrfProtection/>
   <input type="submit" name="ok"
    data-modal="+ .modal"