Modifications pour le document Pièces jointes
Modifié par john le 2026/09/15 12:33
Résumé
-
Propriétés de la Page (1 modifications, 0 ajouts, 0 suppressions)
Détails
- Propriétés de la Page
-
- Contenu
-
... ... @@ -175,8 +175,10 @@ 175 175 (% class="gallery_actions" %)((( 176 176 #foreach ($action in $actions) 177 177 #set( $actionname = $services.localization.render("${translationPrefix}.actions.${action.name}") ) 178 + ## Escape the URL so that it cannot break out of the link syntax, whatever its origin. 179 + #set ($actionURL = $services.rendering.escape($action.url, 'xwiki/2.1')) 178 178 [[${services.icon.render($action.icon)}(% class="sr-only"%)${actionname}(%%)>>## 179 - path:${action .url}||class="tool ${action.name} $!{action.extraCssClass}"##181 + path:${actionURL}||class="tool ${action.name} $!{action.extraCssClass}"## 180 180 title="${actionname}" #if($action.rel) rel="${action.rel}"#end]]## 181 181 #end 182 182 $!additionalContent ... ... @@ -268,7 +268,10 @@ 268 268 #_attachmentPicker_displayStartFrame({'cssClass' : "gallery_emptyChoice $!{dcssClass}", 'text' : $services.localization.render("${translationPrefix}.default"), 'value' : "${options.defaultValue}"} $currentValue) 269 269 #_attachmentPicker_displayAttachmentDetails($defaultAttachment $options) 270 270 #set ($returnURL = $escapetool.url($doc.getURL('view', $request.queryString))) 271 - #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, "${options.get('classname')}_${options.get('object')}_${options.get('property')}=&form_token=$!{services.csrf.getToken()}")) 273 + #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, $escapetool.url({ 274 + "${options.get('classname')}_${options.get('object')}_${options.get('property')}": '', 275 + 'form_token': $!{services.csrf.getToken()} 276 + }))) 272 272 #_attachmentPicker_displayEndFrame ([{'name' : 'select', 'url' : $selectURL, 'icon' : 'check', 'extraCssClass' : 'btn btn-xs btn-success'}]) 273 273 #end 274 274 {{/velocity}}