LPS-113314 Check url in Notifications

liferay · May 12, 2020 · 17019a9 · 17019a9
1 parent b220edf
commit 17019a9
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/...eb/src/main/java/com/liferay/notifications/web/internal/portlet/NotificationsPortlet.java b/...eb/src/main/java/com/liferay/notifications/web/internal/portlet/NotificationsPortlet.java
@@ -31,6 +31,7 @@
 import com.liferay.portal.kernel.servlet.SessionMessages;
 import com.liferay.portal.kernel.theme.ThemeDisplay;
 import com.liferay.portal.kernel.util.ParamUtil;
+import com.liferay.portal.kernel.util.Portal;
 import com.liferay.portal.kernel.util.ResourceBundleLoader;
 import com.liferay.portal.kernel.util.Validator;
 import com.liferay.portal.kernel.util.WebKeys;
@@ -399,6 +400,8 @@ private void _sendRedirect(
 
 		String redirect = ParamUtil.getString(actionRequest, "redirect");
 
+		redirect = _portal.escapeRedirect(redirect);
+
 		if (Validator.isNotNull(redirect)) {
 			actionResponse.sendRedirect(redirect);
 		}
@@ -438,6 +441,9 @@ private void _updateUserNotificationDelivery(
 			userNotificationDeliveryId, deliver);
 	}
 
+	@Reference
+	private Portal _portal;
+
 	@Reference(target = "(bundle.symbolic.name=com.liferay.notifications.web)")
 	private ResourceBundleLoader _resourceBundleLoader;