[OFBIZ-2449] Secure targets in widget forms

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: Release Branch 09.04, Trunk
• Fix Version/s: jQuery, Release Branch 09.04, Release Branch 10.04, Trunk
• Component/s: ALL COMPONENTS
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 09/May/09 15:35
• Updated: 28/Jun/10 10:29
• Resolved: 28/Jun/10 10:29

Description

We have also targets with params in URL in forms, despite it's already using POST action

In form.xml look for

<<form(.*)target=(.*)\?(.*)=(.*)>> (24 instances)
<<form(.*)\R(.*)target=(.*)\?(.*)=(.*)>> ( 23 instances)

An easy example to use is ListPhysicalInventory.

So we should extend the param-name scheme to forms widget also.
Maybe some targets are not calling services and so are not real threats (no changes possible in DB). But we have already chosen to change all hyperlinks in the same case and not to try to filter them.