[java-centralized-discovery COMMIT] /branches/REL_1/src/main/webapp/wayf.jsp

[noreply at shibboleth.net]

Author: rdw
Date: Tue Mar 13 11:42:08 2012
New Revision: 2213

URL: http://svn.shibboleth.net/view/java-centralized-discovery?rev=2213&view=rev
Log:
SDSJ105.  
"If it moves salute it.  If it doesn't put an ESAPI encoding around it".  Extend encoding to be around the entire href in generated 'last visted' links.  This then HTMLAttributeEncodes the URLEncoded entityID.  But browser appears puts it back together the way you want it.

Modified:
    branches/REL_1/src/main/webapp/wayf.jsp

Modified: branches/REL_1/src/main/webapp/wayf.jsp
URL: http://svn.shibboleth.net/view/java-centralized-discovery/branches/REL_1/src/main/webapp/wayf.jsp?rev=2213&r1=2212&r2=2213&view=diff
==============================================================================
--- branches/REL_1/src/main/webapp/wayf.jsp (original)
+++ branches/REL_1/src/main/webapp/wayf.jsp Tue Mar 13 11:42:08 2012
@@ -191,8 +191,8 @@
                 <bean:define id="re" name="returnX"/>
 
                  <a tabindex="10" href="
-<esapi:encodeForHTMLAttribute><bean:write name="requestURL" /></esapi:encodeForHTMLAttribute>?entityID=<%= java.net.URLEncoder.encode(ei.toString(), "utf-8") %>&return=<%= java.net.URLEncoder.encode(re.toString(), "utf-8") %>&returnIDxParam=<%= java.net.URLEncoder.encode( returnIDParam.toString(), "utf-8" ) %>&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%>
-">
+<esapi:encodeForHTMLAttribute><bean:write name="requestURL" />
+?entityID=<%= java.net.URLEncoder.encode(ei.toString(), "utf-8") %>&return=<%= java.net.URLEncoder.encode(re.toString(), "utf-8") %>&returnIDxParam=<%= java.net.URLEncoder.encode( returnIDParam.toString(), "utf-8" ) %>&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%></esapi:encodeForHTMLAttribute>">
                     <esapi:encodeForHTML><jsp:getProperty name="site" property="displayName" /></esapi:encodeForHTML>
                 </a>
               </logic:present>
@@ -200,7 +200,7 @@
                 <bean:define id="targ" name="target" />
                 <bean:define id="shire" name="shire" />
                 <bean:define id="pid" name="providerId" />
-                <a tabindex="10" href="<esapi:encodeForHTMLAttribute><bean:write name="requestURL" /></esapi:encodeForHTMLAttribute>?target=<%= java.net.URLEncoder.encode(targ.toString(),"utf-8") %>&shire=<%= java.net.URLEncoder.encode(shire.toString(),"utf-8") %>&providerId=<%= java.net.URLEncoder.encode(pid.toString(),"utf-8") %>&time=<esapi:encodeForHTMLAttribute><bean:write name="time" /></esapi:encodeForHTMLAttribute>&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%> ">
+                <a tabindex="10" href="<esapi:encodeForHTMLAttribute><bean:write name="requestURL" />?target=<%= java.net.URLEncoder.encode(targ.toString(),"utf-8") %>&shire=<%= java.net.URLEncoder.encode(shire.toString(),"utf-8") %>&providerId=<%= java.net.URLEncoder.encode(pid.toString(),"utf-8") %>&time=<esapi:encodeForHTMLAttribute><bean:write name="time" /></esapi:encodeForHTMLAttribute>&cache=perm&action=selection&origin=<%=java.net.URLEncoder.encode(((IdPSite)site).getName())%></esapi:encodeForHTMLAttribute> ">
                     <esapi:encodeForHTML><jsp:getProperty name="site" property="displayName" /></esapi:encodeForHTML>
                 </a>
               </logic:notPresent>