Samenvatting
-
Paginaeigenschappen (1 gewijzigd, 0 toegevoegd, 0 verwijderd)
-
Objecten (1 gewijzigd, 0 toegevoegd, 0 verwijderd)
Details
- Paginaeigenschappen
-
- Inhoud
-
... ... @@ -175,8 +175,10 @@ 175 175 (% class="gallery_actions" %)((( 176 176 #foreach ($action in $actions) 177 177 #set( $actionname = $services.localization.render("${translationPrefix}.actions.${action.name}") ) 178 + ## Escape the URL so that it cannot break out of the link syntax, whatever its origin. 179 + #set ($actionURL = $services.rendering.escape($action.url, 'xwiki/2.1')) 178 178 [[${services.icon.render($action.icon)}(% class="sr-only"%)${actionname}(%%)>>## 179 - path:${action .url}||class="tool ${action.name} $!{action.extraCssClass}"##181 + path:${actionURL}||class="tool ${action.name} $!{action.extraCssClass}"## 180 180 title="${actionname}" #if($action.rel) rel="${action.rel}"#end]]## 181 181 #end 182 182 $!additionalContent ... ... @@ -268,7 +268,10 @@ 268 268 #_attachmentPicker_displayStartFrame({'cssClass' : "gallery_emptyChoice $!{dcssClass}", 'text' : $services.localization.render("${translationPrefix}.default"), 'value' : "${options.defaultValue}"} $currentValue) 269 269 #_attachmentPicker_displayAttachmentDetails($defaultAttachment $options) 270 270 #set ($returnURL = $escapetool.url($doc.getURL('view', $request.queryString))) 271 - #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, "${options.get('classname')}_${options.get('object')}_${options.get('property')}=&form_token=$!{services.csrf.getToken()}")) 273 + #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, $escapetool.url({ 274 + "${options.get('classname')}_${options.get('object')}_${options.get('property')}": '', 275 + 'form_token': $!{services.csrf.getToken()} 276 + }))) 272 272 #_attachmentPicker_displayEndFrame ([{'name' : 'select', 'url' : $selectURL, 'icon' : 'check', 'extraCssClass' : 'btn btn-xs btn-success'}]) 273 273 #end 274 274 {{/velocity}}
- XWiki.WikiMacroClass[0]
-
- Macro code
-
... ... @@ -116,14 +116,32 @@ 116 116 #end 117 117 #end 118 118 #if ($attachmentRef) 119 - #set ($attachmentResource = $services.model.serialize($attachmentRef, 'local')) 119 + #set ($attachmentResource = $services.rendering.escape($services.model.serialize($attachmentRef, 'local'), 120 + 'xwiki/2.1')) 120 120 #else 121 121 #set ($attachmentResource = '') 122 122 #end 124 + #set ($escapedCssClass = $services.rendering.escape($!cssClass, 'xwiki/2.1')) 123 123 #if ($displayImage) 124 - (% class="${services.rendering.escape($!cssClass, 'xwiki/2.1')}#if (!$attachment) hidden#end" %)(((#if ("$!{attachmentResource}" != '' || $forceElement)#if($withLink)[[#end[[image:$services.rendering.escape(${attachmentResource}, 'xwiki/2.1')$!{imageParams}]]#if($withLink)>>attach:$services.rendering.escape(${attachmentResource},'xwiki/2.1')||rel=lightbox]]#{end}#end)))## 126 + (% class="${escapedCssClass}#if (!$attachment) hidden#end" %)(((## 127 + #if ("$!{attachmentResource}" != '' || $forceElement)## 128 + #if ($withLink)[[#{end}## 129 + [[image:${attachmentResource}$!{imageParams}]]## 130 + #if ($withLink)>>attach:${attachmentResource}||rel=lightbox]]#{end}## 131 + #{end}## 132 + )))## 125 125 #else 126 - (% class="${services.rendering.escape($!cssClass, 'xwiki/2.1')}" %)#if ("$!{attachmentResource}" != '' || $forceElement)#if ($withLink)[[attach:${attachmentResource}||rel=__blank]]#{else}(% class="displayed" %)#if($targetPermView)$!{services.rendering.escape($!{attachmentName}, 'xwiki/2.1')}#{else}Access Denied#{end}(% %)#{end}#end(%%)## 134 + (% class="${escapedCssClass}" %)## 135 + #if ("$!{attachmentResource}" != '' || $forceElement)## 136 + #if ($withLink)## 137 + [[attach:${attachmentResource}||rel=__blank]]## 138 + #{else}## 139 + (% class="displayed" %)## 140 + #if ($targetPermView)$!{services.rendering.escape($!{attachmentName}, 'xwiki/2.1')}#{else}Access Denied#{end}## 141 + (% %)## 142 + #{end}## 143 + #{end}## 144 + (%%)## 127 127 #end 128 128 #end 129 129