Fix "Securing URL's issue in editorderitems.ftl and ordercontactinfo.…

…ftl" (https://issues.apache.org/jira/browse/OFBIZ-2514) - OFBIZ-2514 I did not find any other remaining errors git-svn-id: https://svn.apache.org/repos/asf/ofbiz/trunk@951098 13f79535-47bb-0310-9956-ffa450edef68
apache · Jun 3, 2010 · 0bbb4cf · 0bbb4cf
1 parent 4f6d097
commit 0bbb4cf
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/applications/order/webapp/ordermgr/WEB-INF/actions/order/SendConfirmationEmail.groovy b/applications/order/webapp/ordermgr/WEB-INF/actions/order/SendConfirmationEmail.groovy
@@ -31,7 +31,7 @@ sendTo = request.getParameter("sendTo");
 context.partyId = partyId;
 context.sendTo = sendTo;
 
-donePage = request.getParameter("DONE_PAGE") ?: "orderview?orderId=" + orderId;
+donePage = request.getParameter("DONE_PAGE") ?: "orderview";
 context.donePage = donePage;
 
 // Provide the correct order confirmation ProductStoreEmailSetting, if one exists

diff --git a/applications/order/webapp/ordermgr/order/sendconfirmationemail.ftl b/applications/order/webapp/ordermgr/order/sendconfirmationemail.ftl
@@ -26,10 +26,11 @@ under the License.
       <br class="clear"/>
     </div>
     <div class="screenlet-body">
-      <a href="<@ofbizUrl>authview/${donePage}</@ofbizUrl>" class="buttontext">${uiLabelMap.CommonGoBack}</a>
-      <a href="javascript:document.sendConfirmationForm.submit()" class="buttontext">${uiLabelMap.CommonSend}</a>
+      <a href="<@ofbizUrl>authview/${donePage}?orderId=${orderId}</@ofbizUrl>" class="buttontext">${uiLabelMap.CommonGoBack}</a>
+      <a href="javascript:document.sendConfirmationForm.submit()" class="buttontext">${uiLabelMap.CommonSend}</a>      
       <br />
       <form method="post" action="<@ofbizUrl>sendconfirmationmail/${donePage}</@ofbizUrl>" name="sendConfirmationForm">
+        <input type="hidden" name="orderId" value="${orderId?if_exists}" />
         <#if ! productStoreEmailSetting?exists>
             <#assign productStoreEmailSetting = {} />
         </#if>