Activity plugin report page includes unescaped angle brackets

XMLWordPrintable

    • Type: Bug
    • Resolution: Fixed
    • Priority: Medium
    • 2.5.1
    • Affects Version/s: 2.3, 2.4, 2.4.5
    • Component/s: None

      The activity (or usage) plugin includes properties with values like 'Next >>' unescaped in the HTML. This tag soup can be interpreted differently by different combinations of filters, servers and clients, so we need to fix it.

      For example, on the following line:

      http://svn.atlassian.com/fisheye/browse/public/contrib/confluence/usage-plugin/trunk/src/main/resources/templates/usage/report-controls.vm?r=6456#l27

      It currently reads:

      $action.getText("previous.name")</a> |

      And should be:

      $generalUtil.htmlEncode($action.getText("previous.name"))</a> |

      A simple workaround for customers is to remove the angle brackets from the properties with keys 'previous.name' and 'next.name' in the file:

      confluence/WEB-INF/classes/com/atlassian/confluence/core/ConfluenceActionSupport.properties

              Assignee:
              Agnes Ro
              Reporter:
              Matt Ryall
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: