LPS-197276 Escape redirect

liferay · Oct 31, 2023 · 26277c2 · 26277c2
1 parent 72be466
commit 26277c2
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/...main/java/com/liferay/address/web/internal/portlet/action/EditRegionMVCActionCommand.java b/...main/java/com/liferay/address/web/internal/portlet/action/EditRegionMVCActionCommand.java
@@ -21,6 +21,7 @@
 import com.liferay.portal.kernel.util.HttpComponentsUtil;
 import com.liferay.portal.kernel.util.Localization;
 import com.liferay.portal.kernel.util.ParamUtil;
+import com.liferay.portal.kernel.util.Portal;
 import com.liferay.portal.kernel.util.WebKeys;
 
 import java.util.HashMap;
@@ -74,7 +75,8 @@ protected void doTransactionalCommand(
 				actionRequest.setAttribute(
 					WebKeys.REDIRECT,
 					HttpComponentsUtil.setParameter(
-						ParamUtil.getString(actionRequest, "redirect"),
+						_portal.escapeRedirect(
+							ParamUtil.getString(actionRequest, "redirect")),
 						actionResponse.getNamespace() + "regionId",
 						region.getRegionId()));
 			}
@@ -126,6 +128,9 @@ else if (throwable instanceof DuplicateRegionException ||
 	@Reference
 	private Localization _localization;
 
+	@Reference
+	private Portal _portal;
+
 	@Reference
 	private RegionLocalService _regionLocalService;