| ... |
... |
@@ -79,7 +79,10 @@ |
| 79 |
79 |
#set ($returnURL = $escapetool.url($doc.getURL('view', $request.queryString))) |
| 80 |
80 |
#set ($deleteURL = $targetAttachDocument.getAttachmentURL($attachment.filename, 'delattachment', "xredirect=${returnURL}&form_token=$!{services.csrf.getToken()}") ) |
| 81 |
81 |
#set ($viewURL = $targetAttachDocument.getAttachmentURL($attachment.filename) )##{'name' : 'download', 'url' : $viewURL, 'rel' : '__blank'} |
| 82 |
|
- #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, "${options.get('classname')}_${options.get('object')}_${options.get('property')}=${attachment.filename}&form_token=$!{services.csrf.getToken()}")) |
|
82 |
+ #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, $escapetool.url({ |
|
83 |
+ "${options.get('classname')}_${options.get('object')}_${options.get('property')}": ${attachment.filename}, |
|
84 |
+ 'form_token': $!{services.csrf.getToken()} |
|
85 |
+ }))) |
| 83 |
83 |
#attachmentPicker_displayEndFrame ([{'name' : 'select', 'url' : $selectURL}, {'name' : 'delete', 'url' : $deleteURL}]) |
| 84 |
84 |
#end |
| 85 |
85 |
|
| ... |
... |
@@ -92,7 +92,9 @@ |
| 92 |
92 |
*# |
| 93 |
93 |
#macro (attachmentPicker_displayStartFrame $boxOptions $currentValue) |
| 94 |
94 |
(% class="gallery_attachmentbox $!{boxOptions.cssClass} #if ("$!{boxOptions.value}" == $currentValue) current#{end}" %)((( |
| 95 |
|
- (% class="gallery_attachmenttitle" title="$!{boxOptions.value}" %)((($boxOptions.text))) |
|
98 |
+ (% class="gallery_attachmenttitle" title="$services.rendering.escape($!{boxOptions.value}, 'xwiki/2.1')" %)((( |
|
99 |
+ $services.rendering.escape($boxOptions.text, 'xwiki/2.1') |
|
100 |
+ ))) |
| 96 |
96 |
(% class="gallery_attachmentframe" %)((( |
| 97 |
97 |
#end |
| 98 |
98 |
|
| ... |
... |
@@ -108,13 +108,13 @@ |
| 108 |
108 |
## Compute the attachment reference because there's no getter. |
| 109 |
109 |
#set ($attachmentReference = $services.model.createAttachmentReference($attachment.document.documentReference, |
| 110 |
110 |
$attachment.filename)) |
| 111 |
|
- #set ($attachmentStringReference = $services.model.serialize($attachmentReference, 'default')) |
|
116 |
+ #set ($attachmentStringReference = $services.rendering.escape($services.model.serialize($attachmentReference, 'default'), 'xwiki/2.1')) |
| 112 |
112 |
#if ($attachment.isImage() && $options.displayImage) |
| 113 |
113 |
## We add the version to the query string in order to invalidate the cache when an image attachment is replaced. |
| 114 |
114 |
#set ($queryString = $escapetool.url({'version': $attachment.version})) |
| 115 |
115 |
[[[[image:${attachmentStringReference}||width=180 queryString="$queryString"]]>>attach:$attachmentStringReference]] |
| 116 |
116 |
#else |
| 117 |
|
- * (% class="mime" %){{html wiki=false clean=false}}#mimetypeimg($attachment.getMimeType().toLowerCase() $attachment.getFilename().toLowerCase()){{/html}}(%%) (% class="filename" %)$attachment.getFilename()(% %) |
|
122 |
+ * (% class="mime" %){{html wiki=false clean=false}}#mimetypeimg($attachment.getMimeType().toLowerCase() $attachment.getFilename().toLowerCase()){{/html}}(%%) (% class="filename" %)$services.rendering.escape($attachment.getFilename(), 'xwiki/2.1')(% %) |
| 118 |
118 |
* v$attachment.getVersion() (#dynamicsize($attachment.longSize)) |
| 119 |
119 |
* $services.localization.render('core.viewers.attachments.author', [$!{xwiki.getUserName($attachment.author, false)}]) $services.localization.render('core.viewers.attachments.date', [$!{xwiki.formatDate($attachment.date, 'dd/MM/yyyy hh:mm')}]) |
| 120 |
120 |
* (% class="buttonwrapper" %)[[${services.localization.render("${translationPrefix}.actions.download")}>>attach:${attachmentStringReference}||title="$services.localization.render("${translationPrefix}.actions.download")" rel="__blank" class="button"]](%%) |
