Repository: wicket Updated Branches: refs/heads/wicket-6.x 354e07129 -> c41701506
WICKET-5782 Missing escaping in MultiFileUploadField.js - sort of XSS Rename 'char' to 'ch' Project: http://git-wip-us.apache.org/repos/asf/wicket/repo Commit: http://git-wip-us.apache.org/repos/asf/wicket/commit/c4170150 Tree: http://git-wip-us.apache.org/repos/asf/wicket/tree/c4170150 Diff: http://git-wip-us.apache.org/repos/asf/wicket/diff/c4170150 Branch: refs/heads/wicket-6.x Commit: c41701506c862f761d56235e4d29e00938cf9330 Parents: 354e071 Author: Martin Tzvetanov Grigorov <[email protected]> Authored: Thu Dec 4 17:48:31 2014 +0100 Committer: Martin Tzvetanov Grigorov <[email protected]> Committed: Thu Dec 4 17:48:31 2014 +0100 ---------------------------------------------------------------------- .../wicket/markup/html/form/upload/MultiFileUploadField.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/wicket/blob/c4170150/wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/MultiFileUploadField.js ---------------------------------------------------------------------- diff --git a/wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/MultiFileUploadField.js b/wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/MultiFileUploadField.js index 8b49b6c..114f37c 100644 --- a/wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/MultiFileUploadField.js +++ b/wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/MultiFileUploadField.js @@ -204,8 +204,8 @@ function MultiSelector( eprefix, list_target, max, useMultipleAttr, del_label ){ "'": ''' }; - function replaceChar(char) { - return toEscape[char] || char; + function replaceChar(ch) { + return toEscape[ch] || ch; } function htmlEscape(fileName) {
