Repository: wicket Updated Branches: refs/heads/master bbc5dbbdb -> f7fc5d095
WICKET-5782 Missing escaping in MultiFileUploadField.js - sort of XSS Rename 'char' to 'ch' (cherry picked from commit c41701506c862f761d56235e4d29e00938cf9330) Project: http://git-wip-us.apache.org/repos/asf/wicket/repo Commit: http://git-wip-us.apache.org/repos/asf/wicket/commit/f7fc5d09 Tree: http://git-wip-us.apache.org/repos/asf/wicket/tree/f7fc5d09 Diff: http://git-wip-us.apache.org/repos/asf/wicket/diff/f7fc5d09 Branch: refs/heads/master Commit: f7fc5d09517d9d774bc0d06a38f94a9b472d5bc7 Parents: bbc5dbb Author: Martin Tzvetanov Grigorov <[email protected]> Authored: Thu Dec 4 17:48:31 2014 +0100 Committer: Martin Tzvetanov Grigorov <[email protected]> Committed: Thu Dec 4 17:49:12 2014 +0100 ---------------------------------------------------------------------- .../wicket/markup/html/form/upload/MultiFileUploadField.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/wicket/blob/f7fc5d09/wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/MultiFileUploadField.js ---------------------------------------------------------------------- diff --git a/wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/MultiFileUploadField.js b/wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/MultiFileUploadField.js index 8b49b6c..114f37c 100644 --- a/wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/MultiFileUploadField.js +++ b/wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/MultiFileUploadField.js @@ -204,8 +204,8 @@ function MultiSelector( eprefix, list_target, max, useMultipleAttr, del_label ){ "'": ''' }; - function replaceChar(char) { - return toEscape[char] || char; + function replaceChar(ch) { + return toEscape[ch] || ch; } function htmlEscape(fileName) {
