Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-7675

Investigate if we should turn Freemarker autoescaping on

    XMLWordPrintableJSON

Details

    • New Feature
    • Status: Closed
    • Minor
    • Resolution: Won't Do
    • Trunk
    • None
    • framework
    • None

    Description

      At OFBIZ-7041 fbr@14x.net suggested that we turn Freemarker autoescaping on. Quoting him there:

      This new version of FreeMarker includes auto-escaping and output formats. The <#escape> directive has been deprecated. Notice the comment at the very end of this page:

      "FreeMarker automatically escapes all values printed ... if it's properly configured (that's the responsibility of the programmers; see here how)."

      Would be good to turn autoescaping on, and set the configuration to match .ftl as HTML and .fo.ftl as XML.

      pfm.smits asked

      If we are going down that path I guess we have to visit a lot of Freemarker template files, right?

      Here is my answer

      We don' t use any <#escape> directives in all OFBiz. We have a couple of <#noescape> which should be replaced by <#noautoesc>. So I agree we could set the Freemarker environement to auto-escaping, and test if it has not unexpected side-effects.

      Could be that this will fix or complicate the issue I crossed (at bottom) of OFBIZ-7041 and more recently at OFBIZ-7343, let's see...

      Reply

      Attachments

        1. OFBIZ-7675.patch
          63 kB
          Deepak Dixit
        2. OFBIZ-7675-framework.patch
          699 kB
          Jacques Le Roux
        3. OFBIZ-7675-plugins.patch
          5 kB
          Deepak Dixit
        4. OFBIZ-7675-plugins.zip
          2.89 MB
          Jacques Le Roux

        Activity

          People

            jleroux Jacques Le Roux
            jleroux Jacques Le Roux
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: