XWIKI-20343: Sanitize template URLs

xwiki · Feb 3, 2023 · dbc92dc · dbc92dc
1 parent 8f5a889
commit dbc92dc
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/.../xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/resubmit.vm b/.../xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/resubmit.vm
@@ -29,8 +29,8 @@ $response.addHeader( "X-FRAME-OPTIONS", "DENY" )
 <div class="main layoutsubsection">
 <div id="mainContentArea">
 #xwikimessageboxstart($services.localization.render('warning') $services.localization.render('csrf.confirmation'))
-#set($resubmit = "$!{escapetool.xml($request.getParameter('resubmit'))}")
-#set($xback = "$!{escapetool.xml($request.getParameter('xback'))}")
+#getSanitizedURLAttributeValue('form','action', $request.getParameter('resubmit'), '', $resubmit)
+#getSanitizedURLAttributeValue('a','href', $request.getParameter('xback'), $doc.getURL(), $xback)
 <form action="$resubmit" method="post">
   <div class="hidden">
     ## Valid CSRF token