Applied fix from trunk for revision: 1432392

=== The content of the Screenlet title is now escaped to prevent the risk of an XSS attack. git-svn-id: https://svn.apache.org/repos/asf/ofbiz/branches/release10.04@1432397 13f79535-47bb-0310-9956-ffa450edef68
apache · Jan 12, 2013 · bac5490 · bac5490
1 parent 51457b0
commit bac5490
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java b/framework/widget/src/org/ofbiz/widget/screen/ModelScreenWidget.java
@@ -449,7 +449,12 @@ public String getId(Map<String, Object> context) {
         }
 
         public String getTitle(Map<String, Object> context) {
-            return this.titleExdr.expandString(context);
+            String title = this.titleExdr.expandString(context);
+            StringUtil.SimpleEncoder simpleEncoder = (StringUtil.SimpleEncoder) context.get("simpleEncoder");
+            if (simpleEncoder != null) {
+                title = simpleEncoder.encode(title);
+            }
+            return title;
         }
 
         public Menu getNavigationMenu() {