modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/bundle/create/BundleUploadDistroFileStep.java
| 5 ++++-
modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/bundle/deployment/BundleDeploymentView.java
| 7 ++++---
2 files changed, 8 insertions(+), 4 deletions(-)
New commits:
commit 981d97853714fb8c54e50fc608535c1b0fd27ebf
Author: Ian Springer <ian.springer(a)redhat.com>
Date: Fri Apr 1 12:40:35 2011 -0400
add some more HTML escaping to bundle views (includes fix for
https://bugzilla.redhat.com/show_bug.cgi?id=676768)
diff --git
a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/bundle/create/BundleUploadDistroFileStep.java
b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/bundle/create/BundleUploadDistroFileStep.java
index c188a42..ca08fdb 100644
---
a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/bundle/create/BundleUploadDistroFileStep.java
+++
b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/bundle/create/BundleUploadDistroFileStep.java
@@ -46,6 +46,7 @@ import
org.rhq.enterprise.gui.coregui.client.components.upload.TextFileRetriever
import org.rhq.enterprise.gui.coregui.client.components.wizard.AbstractWizardStep;
import org.rhq.enterprise.gui.coregui.client.gwt.BundleGWTServiceAsync;
import org.rhq.enterprise.gui.coregui.client.gwt.GWTServiceLookup;
+import org.rhq.enterprise.gui.coregui.client.util.StringUtility;
import org.rhq.enterprise.gui.coregui.client.util.message.Message;
import org.rhq.enterprise.gui.coregui.client.util.message.Message.Severity;
import org.rhq.enterprise.gui.coregui.client.util.selenium.Locatable;
@@ -231,7 +232,9 @@ public class BundleUploadDistroFileStep extends AbstractWizardStep {
}
public void onFailure(Throwable caught) {
- wizard.getView().showMessage(caught.getMessage());
+ // Escape it, since it contains the URL, which the user entered.
+ String message = StringUtility.escapeHtml(caught.getMessage());
+ wizard.getView().showMessage(message);
CoreGUI.getErrorHandler().handleError(MSG.view_bundle_createWizard_createFailure(),
caught);
wizard.setBundleVersion(null);
setButtonsDisableMode(false);
diff --git
a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/bundle/deployment/BundleDeploymentView.java
b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/bundle/deployment/BundleDeploymentView.java
index 62bf4ed..e220cfc 100644
---
a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/bundle/deployment/BundleDeploymentView.java
+++
b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/bundle/deployment/BundleDeploymentView.java
@@ -25,6 +25,7 @@ package org.rhq.enterprise.gui.coregui.client.bundle.deployment;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
+import java.util.List;
import com.google.gwt.user.client.rpc.AsyncCallback;
import com.smartgwt.client.types.AnimationEffect;
@@ -347,9 +348,9 @@ public class BundleDeploymentView extends LocatableVLayout implements
Bookmarkab
resource.setAutoFitWidth(true);
resource.setAutoFitWidthApproach(AutoFitWidthApproach.BOTH);
resource.setCellFormatter(new CellFormatter() {
- public String format(Object o, ListGridRecord listGridRecord, int i, int i1)
{
+ public String format(Object value, ListGridRecord listGridRecord, int i, int
i1) {
return "<a href=\"" +
LinkManager.getResourceLink(listGridRecord.getAttributeAsInt("resourceId"))
- + "\">" + o + "</a>";
+ + "\">" +
StringUtility.escapeHtml(String.valueOf(value)) + "</a>";
}
});
@@ -367,7 +368,7 @@ public class BundleDeploymentView extends LocatableVLayout implements
Bookmarkab
status.setShowValueIconOnly(true);
status.setWidth("*");
- ArrayList<ListGridRecord> records = new ArrayList<ListGridRecord>();
+ List<ListGridRecord> records = new ArrayList<ListGridRecord>();
for (BundleResourceDeployment rd : deployment.getResourceDeployments()) {
ListGridRecord record = new ListGridRecord();
Resource rr = rd.getResource();