aboutsummaryrefslogtreecommitdiff
path: root/id/server/moa-id-frontend-resources/src
diff options
context:
space:
mode:
authorThomas Lenz <tlenz@iaik.tugraz.at>2017-11-20 11:51:18 +0100
committerThomas Lenz <tlenz@iaik.tugraz.at>2017-11-20 11:51:18 +0100
commit1b5e11112af6bbe48bfb5c95c8b75ae90f3edb22 (patch)
treebffeb1e4042eff3da78c8ebb054ad68e823805a2 /id/server/moa-id-frontend-resources/src
parent26ed8e3cf67094f8348993b6a87210c49334cb97 (diff)
parent71680a1b57a22f64237bfaacb4511057f7637f8d (diff)
downloadmoa-id-spss-1b5e11112af6bbe48bfb5c95c8b75ae90f3edb22.tar.gz
moa-id-spss-1b5e11112af6bbe48bfb5c95c8b75ae90f3edb22.tar.bz2
moa-id-spss-1b5e11112af6bbe48bfb5c95c8b75ae90f3edb22.zip
Merge branch 'development_preview' into eIDAS_node_implementation
Diffstat (limited to 'id/server/moa-id-frontend-resources/src')
-rw-r--r--id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java4
-rw-r--r--id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java11
2 files changed, 13 insertions, 2 deletions
diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java
index da38e3bef..15bc92a54 100644
--- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java
+++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/AbstractServiceProviderSpecificGUIFormBuilderConfiguration.java
@@ -27,6 +27,8 @@ import java.io.InputStream;
import java.util.HashMap;
import java.util.Map;
+import org.apache.commons.lang.StringEscapeUtils;
+
import at.gv.egovernment.moa.id.auth.frontend.utils.FormBuildUtils;
import at.gv.egovernment.moa.id.commons.MOAIDAuthConstants;
import at.gv.egovernment.moa.id.commons.api.IOAAuthParameters;
@@ -100,7 +102,7 @@ public abstract class AbstractServiceProviderSpecificGUIFormBuilderConfiguration
params.put(PARAM_BKU_LOCAL, IOAAuthParameters.LOCALBKU);
if (pendingReq != null) {
- params.put(PARAM_PENDINGREQUESTID, pendingReq.getRequestID());
+ params.put(PARAM_PENDINGREQUESTID, StringEscapeUtils.escapeHtml(pendingReq.getRequestID()));
//add service-provider specific GUI parameters
IOAAuthParameters oaParam = pendingReq.getOnlineApplicationConfiguration();
diff --git a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java
index 2c2792b84..0c07ad3fb 100644
--- a/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java
+++ b/id/server/moa-id-frontend-resources/src/main/java/at/gv/egovernment/moa/id/auth/frontend/builder/DefaultGUIFormBuilderConfiguration.java
@@ -26,6 +26,8 @@ import java.io.InputStream;
import java.util.HashMap;
import java.util.Map;
+import org.apache.commons.lang.StringEscapeUtils;
+
import at.gv.egovernment.moa.id.commons.api.IRequest;
/**
@@ -68,6 +70,13 @@ public class DefaultGUIFormBuilderConfiguration extends AbstractGUIFormBuilderCo
}
+ /**
+ * Add a key/value pair into Velocity context.<br>
+ * <b>IMPORTANT:</b> external HTML escapetion is required, because it is NOT done internally
+ *
+ * @param key velocity context key
+ * @param value of this key
+ */
public void putCustomParameter(String key, Object value) {
if (customParameters == null)
customParameters = new HashMap<String, Object>();
@@ -82,7 +91,7 @@ public class DefaultGUIFormBuilderConfiguration extends AbstractGUIFormBuilderCo
public Map<String, Object> getSpecificViewParameters() {
Map<String, Object> params = new HashMap<String, Object>();
if (pendingReq != null) {
- params.put(PARAM_PENDINGREQUESTID, pendingReq.getRequestID());
+ params.put(PARAM_PENDINGREQUESTID, StringEscapeUtils.escapeHtml(pendingReq.getRequestID()));
}
if (customParameters != null)