[OFBIZ-11006] Create customer request screen breaks when entering special characters (CVE-2019-10074)

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Release Branch 13.07, Release Branch 14.12, Release Branch 15.12, Release Branch 16.11, Release Branch 17.12, Release Branch 18.12
• Fix Version/s: 17.12.01, 16.11.06, 18.12.01
• Component/s: order
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Scott Gray
• Reporter: Scott Gray
• Created: 02/May/19 08:56
• Updated: 13/Sep/19 08:05
• Resolved: 02/May/19 08:59

Description

For some reason the Create Customer Request form (component://order/widget/ordermgr/CustRequestForms.xml) doesn't encode the output of the "story" field. This breaks the screen when certain html or freemarker special characters are entered into the field.

I don't see any good reason why this field in particular shouldn't be using encoding so I'm going to enable it again.