Merge pull request #354 from hisanhunais/SECURITYINTERNAL-1225

Minor UI Fix in Delete Comments Functionality
wso2 · Jan 6, 2021 · 878fc7e · 878fc7e
2 parents 7952d2f + 4ca15ea
commit 878fc7e
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/...wso2.carbon.registry.info.ui/src/main/resources/web/info/comment-delete-ajaxprocessor.jsp b/...wso2.carbon.registry.info.ui/src/main/resources/web/info/comment-delete-ajaxprocessor.jsp
@@ -25,6 +25,7 @@
 <%@ page import="org.wso2.carbon.utils.ServerConstants" %>
 <%@ page import="org.wso2.carbon.registry.common.beans.CommentBean" %>
 <%@ page import="org.wso2.carbon.registry.common.beans.utils.Comment" %>
+<%@ page import="org.owasp.encoder.Encode" %>
 <carbon:jsi18n resourceBundle="org.wso2.carbon.registry.info.ui.i18n.JSResources"
 		request="<%=request%>" namespace="org.wso2.carbon.registry.info.ui" />
 <script type="text/javascript" src="../info/js/info.js"></script>
@@ -86,12 +87,12 @@
                             <a class="closeButton icon-link registryWriteOperation" onclick="delComment('<%=request.getParameter("path")%>','<%=commentPath%>')" id="closeC<%=i%>" title="<fmt:message key="delete"/>" style="background-image: url(../admin/images/delete.gif);position:relative;float:right">&nbsp;</a>
                             <% } %>
                             <fmt:message key="comment">
-                                <fmt:param value="<%=commentString%>"/>
+                                <fmt:param value="<%=Encode.forHtml(commentString)%>"/>
                             </fmt:message>
                             <br/>
                             <fmt:message key="posted.on.by">
-                                <fmt:param value="<%=commentedTime%>"/>
-                                <fmt:param value="<%=commentedUser%>"/>
+                                <fmt:param value="<%=Encode.forHtml(commentedTime)%>"/>
+                                <fmt:param value="<%=Encode.forHtml(commentedUser)%>"/>
                             </fmt:message>
                             <div style="clear:both;"></div>
                         </div>