Details
-
Sub-task
-
Status: Closed
-
Major
-
Resolution: Fixed
-
None
-
Important
-
Bug Crush Event - 21/2/2015
Description
In Ofbiz form need to escape characters from description column in a display-entity tag to avoid XSS attacks.
<display-entity entity-name="Table" description="${description}" >
I tried to use bsh, as following:
<display-entity entity-name="Table" description="${bsh: org.apache.commons.lang.StringEscapeUtils.escapeHtml("${description}")}">
But I get this error:
Error rendering screen [component://my/widget/CommonScreens.xml#GlobalDecorator]: java.lang.IllegalStateException: This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.
(This object has been flagged as immutable (unchangeable), probably because it came from an Entity Engine cache. Cannot set a value in an immutable entity object.)
PS:
Also you can see here a similar issue:
http://stackoverflow.com/questions/30097370/how-to-escape-characters-in-ofbiz-widget