modules/enterprise/gui/coregui/pom.xml
| 2 -
modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/dashboard/DashboardsView.java
| 4 --
modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/dashboard/portlets/util/MessagePortlet.java
| 15 ++++++++--
3 files changed, 14 insertions(+), 7 deletions(-)
New commits:
commit 4e5db13557b7252088110c795b7218c8c47fbd7f
Author: Ian Springer <ian.springer(a)redhat.com>
Date: Wed Apr 6 16:08:27 2011 -0400
only display HTML within the message portlet's content if the logged-in user is
rhqadmin; otherwise escape HTML to prevent XSS attacks
(
https://bugzilla.redhat.com/show_bug.cgi?id=636734)
diff --git
a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/dashboard/DashboardsView.java
b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/dashboard/DashboardsView.java
index 95780fd..d72abbf 100644
---
a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/dashboard/DashboardsView.java
+++
b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/dashboard/DashboardsView.java
@@ -268,7 +268,7 @@ public class DashboardsView extends LocatableVLayout implements
DashboardContain
}
/**
- * The stored name for a dashboard is initally set to a generated, localizable name.
It can later be edited
+ * The stored name for a dashboard is initially set to a generated, localizable name.
It can later be edited
* by the user. Automation tests must be valid independent of localization so we must
use repeatable locators.
* This method checks for generated dash names and returns a repeatable locator for
them.
*
@@ -363,8 +363,6 @@ public class DashboardsView extends LocatableVLayout implements
DashboardContain
// Left Column
DashboardPortlet welcome = new DashboardPortlet(MessagePortlet.NAME,
MessagePortlet.KEY, 250);
- welcome.getConfiguration().put(
- new PropertySimple("message",
MSG.view_dashboardsManager_message_title_details()));
dashboard.addPortlet(welcome, 0, 0);
DashboardPortlet summary = new DashboardPortlet(InventorySummaryPortlet.NAME,
InventorySummaryPortlet.KEY, 250);
diff --git
a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/dashboard/portlets/util/MessagePortlet.java
b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/dashboard/portlets/util/MessagePortlet.java
index ead9cc2..26b85a3 100644
---
a/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/dashboard/portlets/util/MessagePortlet.java
+++
b/modules/enterprise/gui/coregui/src/main/java/org/rhq/enterprise/gui/coregui/client/dashboard/portlets/util/MessagePortlet.java
@@ -1,6 +1,6 @@
/*
* RHQ Management Platform
- * Copyright (C) 2005-2010 Red Hat, Inc.
+ * Copyright (C) 2005-2011 Red Hat, Inc.
* All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
@@ -30,6 +30,8 @@ import
org.rhq.core.domain.configuration.definition.ConfigurationDefinition;
import org.rhq.core.domain.configuration.definition.PropertyDefinitionSimple;
import org.rhq.core.domain.configuration.definition.PropertySimpleType;
import org.rhq.core.domain.dashboard.DashboardPortlet;
+import org.rhq.enterprise.gui.coregui.client.UserSessionManager;
+import org.rhq.enterprise.gui.coregui.client.admin.users.UsersDataSource;
import org.rhq.enterprise.gui.coregui.client.dashboard.ConfigurablePortlet;
import org.rhq.enterprise.gui.coregui.client.dashboard.Portlet;
import org.rhq.enterprise.gui.coregui.client.dashboard.PortletViewFactory;
@@ -48,6 +50,7 @@ public class MessagePortlet extends LocatableHTMLPane implements
ConfigurablePor
public static final String NAME = MSG.view_portlet_defaultName_message();
private static final String MESSAGE_PROPERTY = "message";
+ private static final String DEFAULT_MESSAGE =
MSG.view_dashboardsManager_message_title_details();
public MessagePortlet(String locatorId) {
super(locatorId);
@@ -57,9 +60,15 @@ public class MessagePortlet extends LocatableHTMLPane implements
ConfigurablePor
public void configure(PortletWindow portletWindow, DashboardPortlet storedPortlet) {
String contents =
storedPortlet.getConfiguration().getSimpleValue(MESSAGE_PROPERTY, null);
if (contents != null) {
- setContents(StringUtility.sanitizeHtml(contents));
+ if (UserSessionManager.getSessionSubject().getId() !=
UsersDataSource.ID_RHQADMIN &&
+ !contents.equals(DEFAULT_MESSAGE)) {
+ // To avoid XSS attacks, don't allow non-superusers to enter HTML.
+ // TODO (ips, 04/06/11): Sanitize this, rather than escaping it, once we
upgrade to GWT 2.1 or later.
+ contents = StringUtility.escapeHtml(contents);
+ }
+ setContents(contents);
} else {
- setContents("<br/><i>" +
MSG.view_portlet_configure_needed() + "</i>");
+ setContents(DEFAULT_MESSAGE);
}
}
commit 0478d26932be341fa68c72edf05307d8de022a73
Author: Ian Springer <ian.springer(a)redhat.com>
Date: Wed Apr 6 16:04:39 2011 -0400
minor fix to config of gwt plugin
diff --git a/modules/enterprise/gui/coregui/pom.xml
b/modules/enterprise/gui/coregui/pom.xml
index bf14b52..527bd94 100644
--- a/modules/enterprise/gui/coregui/pom.xml
+++ b/modules/enterprise/gui/coregui/pom.xml
@@ -278,7 +278,7 @@
<servicePattern>**/gwt/*GWTService.java</servicePattern>
<i18nMessagesBundle>org.rhq.enterprise.gui.coregui.client.Messages</i18nMessagesBundle>
<i18nConstantsWithLookupBundle>org.rhq.enterprise.gui.coregui.client.MessageConstants</i18nConstantsWithLookupBundle>
-
<compileSourcesArtifacts>org.rhq:rhq-core-domain</compileSourcesArtifacts>
+
<compileSourcesArtifact>org.rhq:rhq-core-domain</compileSourcesArtifact>
<style>DETAILED</style>
</configuration>