[CVE-2010-0432] Merged from trunk r920369:

Menu widget links of type hidden-form were not correctly encoding the value attribute. git-svn-id: https://svn.apache.org/repos/asf/ofbiz/branches/release09.04@920379 13f79535-47bb-0310-9956-ffa450edef68
apache · Mar 8, 2010 · 68de490 · 68de490
1 parent 16e283b
commit 68de490
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/framework/widget/src/org/ofbiz/widget/html/HtmlMenuRenderer.java b/framework/widget/src/org/ofbiz/widget/html/HtmlMenuRenderer.java
@@ -396,11 +396,16 @@ public void renderLink(Appendable writer, Map<String, Object> context, ModelMenu
                 writer.append(uniqueItemName);
                 writer.append("\">");
 
+                StringUtil.SimpleEncoder simpleEncoder = (StringUtil.SimpleEncoder) context.get("simpleEncoder");
                 for (WidgetWorker.Parameter parameter: link.getParameterList()) {
                     writer.append("<input name=\"");
                     writer.append(parameter.getName());
                     writer.append("\" value=\"");
-                    writer.append(parameter.getValue(context));
+                    if (simpleEncoder != null) {
+                        writer.append(simpleEncoder.encode(parameter.getValue(context)));
+                    } else {
+                        writer.append(parameter.getValue(context));
+                    }
                     writer.append("\" type=\"hidden\"/>");
                 }