Index: lams_tool_wiki/src/java/org/lamsfoundation/lams/tool/wiki/util/WikiConstants.java
===================================================================
diff -u -r6672982c4b8130dc115da39d5e918a752a0bd67e -r31d297d14df060ae066a55e125b5025ed713d681
--- lams_tool_wiki/src/java/org/lamsfoundation/lams/tool/wiki/util/WikiConstants.java (.../WikiConstants.java) (revision 6672982c4b8130dc115da39d5e918a752a0bd67e)
+++ lams_tool_wiki/src/java/org/lamsfoundation/lams/tool/wiki/util/WikiConstants.java (.../WikiConstants.java) (revision 31d297d14df060ae066a55e125b5025ed713d681)
@@ -64,7 +64,6 @@
public static final String ATTR_CONTENT_EDITAVLE = "contentEditable";
public static final String ATTR_MAIN_PAGE_TITLE = "mainPageTitle";
public static final String ATTR_IS_GROUPED_ACTIVITY = "isGroupedActivity";
- public static final String ATTR_REFRESH_PAGE = "doRefreshPage";
// Events
public static final String EVENT_NOTIFY_TEACHERS = "wikiNotifyTeachers";
@@ -74,4 +73,7 @@
public static final String PARAM_PARENT_PAGE = "parentPage";
static final String FILTER_REPLACE_TEXT = "***";
+
+ public static final String JAVASCRIPT_TOKEN = "javascript";
+ public static final String JAVASCRIPT_REPLACE_TOKEN = "JAVASCRIPTREPLACE";
}
Index: lams_tool_wiki/src/java/org/lamsfoundation/lams/tool/wiki/web/actions/WikiPageAction.java
===================================================================
diff -u -r6672982c4b8130dc115da39d5e918a752a0bd67e -r31d297d14df060ae066a55e125b5025ed713d681
--- lams_tool_wiki/src/java/org/lamsfoundation/lams/tool/wiki/web/actions/WikiPageAction.java (.../WikiPageAction.java) (revision 6672982c4b8130dc115da39d5e918a752a0bd67e)
+++ lams_tool_wiki/src/java/org/lamsfoundation/lams/tool/wiki/web/actions/WikiPageAction.java (.../WikiPageAction.java) (revision 31d297d14df060ae066a55e125b5025ed713d681)
@@ -110,6 +110,7 @@
// Set up the wiki form
WikiPageForm wikiForm = (WikiPageForm) form;
+ revertJavascriptTokenReplacement(wikiForm);
// Get the current wiki page
WikiPage currentPage = wikiService.getWikiPageByUid(currentPageUid);
@@ -153,9 +154,6 @@
}
- // LDEV-2824 Refresh page after loading, so Chrome does not disable new javascript code
- request.setAttribute(WikiConstants.ATTR_REFRESH_PAGE, true);
-
// Make sure the current page is set correctly then return to the wiki
return returnToWiki(mapping, wikiForm, request, response, currentPageUid);
}
@@ -357,6 +355,7 @@
// Set up the authoring form
WikiPageForm wikiForm = (WikiPageForm) form;
+ revertJavascriptTokenReplacement(wikiForm);
// get the wiki by either toolContentId or tool session
if (toolSessionID == null) {
@@ -397,9 +396,6 @@
if (toolSessionID != null && user != null) {
notifyWikiChange(toolSessionID, "notify.pageAdded.subject", "notify.pageAdded.body", user, request);
}
-
- // LDEV-2824 Refresh page after loading, so Chrome does not disable new javascript code
- request.setAttribute(WikiConstants.ATTR_REFRESH_PAGE, true);
// go to the new wiki page
return returnToWiki(mapping, wikiForm, request, response, currentPageUid);
@@ -559,4 +555,21 @@
subject, body);
}
}
+
+ /**
+ * Replaces codeword back to "javascript", so the content works correctly after displaying.
+ */
+ private void revertJavascriptTokenReplacement(WikiPageForm form) {
+ String encodedWikiBody = form.getNewPageWikiBody();
+ if (encodedWikiBody != null) {
+ form.setNewPageWikiBody(encodedWikiBody.replace(WikiConstants.JAVASCRIPT_REPLACE_TOKEN,
+ WikiConstants.JAVASCRIPT_TOKEN));
+ }
+
+ encodedWikiBody = form.getWikiBody();
+ if (encodedWikiBody != null) {
+ form.setWikiBody(encodedWikiBody.replace(WikiConstants.JAVASCRIPT_REPLACE_TOKEN,
+ WikiConstants.JAVASCRIPT_TOKEN));
+ }
+ }
}
Index: lams_tool_wiki/web/includes/javascript/authoring.js
===================================================================
diff -u -r16b67860ab51e6ba2a8f91220dda61d67334e1b0 -r31d297d14df060ae066a55e125b5025ed713d681
--- lams_tool_wiki/web/includes/javascript/authoring.js (.../authoring.js) (revision 16b67860ab51e6ba2a8f91220dda61d67334e1b0)
+++ lams_tool_wiki/web/includes/javascript/authoring.js (.../authoring.js) (revision 31d297d14df060ae066a55e125b5025ed713d681)
@@ -25,12 +25,7 @@
finishButtonDiv.style.display = "block";
}
}
-function doSubmit(method) {
- document.authoringForm.dispatch.value = method;
- document.authoringForm.submit();
-}
function deleteAttachment(dispatch, uuid) {
- document.authoringForm.dispatch.value = dispatch;
document.authoringForm.deleteFileUuid.value = uuid;
- document.authoringForm.submit();
+ submitWiki(dispatch);
}
Index: lams_tool_wiki/web/includes/javascript/monitoring.js
===================================================================
diff -u -r1082bdcc357c105126a5641cecc68acfa645b66b -r31d297d14df060ae066a55e125b5025ed713d681
--- lams_tool_wiki/web/includes/javascript/monitoring.js (.../monitoring.js) (revision 1082bdcc357c105126a5641cecc68acfa645b66b)
+++ lams_tool_wiki/web/includes/javascript/monitoring.js (.../monitoring.js) (revision 31d297d14df060ae066a55e125b5025ed713d681)
@@ -8,9 +8,4 @@
}
function doSelectTab(tabId) {
selectTab(tabId);
-}
-function doSubmit(method, tabId) {
- document.monitoringForm.method.value = method;
- document.monitoringForm.submit();
-}
-
+}
\ No newline at end of file
Index: lams_tool_wiki/web/includes/javascript/wikiCommon.js
===================================================================
diff -u -r8179037dc958585c054547eb7de9be14c6aed233 -r31d297d14df060ae066a55e125b5025ed713d681
--- lams_tool_wiki/web/includes/javascript/wikiCommon.js (.../wikiCommon.js) (revision 8179037dc958585c054547eb7de9be14c6aed233)
+++ lams_tool_wiki/web/includes/javascript/wikiCommon.js (.../wikiCommon.js) (revision 31d297d14df060ae066a55e125b5025ed713d681)
@@ -88,3 +88,14 @@
wikiListImage.src = webUrl + "/images/tree_open.gif";
}
}
+
+// LDEV-2824 Replace "javascript" with another word before posting so browser does not detect it as XSS attack
+function replaceJavascriptToken()
+{
+ for (var instanceId in CKEDITOR.instances){
+ var instance = CKEDITOR.instances[instanceId];
+ var data = instance.getData();
+ var encodedData = data.replace(/javascript/g,"JAVASCRIPTREPLACE");
+ instance.setData(encodedData);
+ }
+}
Index: lams_tool_wiki/web/pages/authoring/basic.jsp
===================================================================
diff -u -r8179037dc958585c054547eb7de9be14c6aed233 -r31d297d14df060ae066a55e125b5025ed713d681
--- lams_tool_wiki/web/pages/authoring/basic.jsp (.../basic.jsp) (revision 8179037dc958585c054547eb7de9be14c6aed233)
+++ lams_tool_wiki/web/pages/authoring/basic.jsp (.../basic.jsp) (revision 31d297d14df060ae066a55e125b5025ed713d681)
@@ -269,6 +269,7 @@
function submitWiki(dispatch)
{
document.getElementById("dispatch").value=dispatch;
+ replaceJavascriptToken();
document.getElementById("authoringForm").submit();
}
Index: lams_tool_wiki/web/pages/authoring/instructions.jsp
===================================================================
diff -u -r1082bdcc357c105126a5641cecc68acfa645b66b -r31d297d14df060ae066a55e125b5025ed713d681
--- lams_tool_wiki/web/pages/authoring/instructions.jsp (.../instructions.jsp) (revision 1082bdcc357c105126a5641cecc68acfa645b66b)
+++ lams_tool_wiki/web/pages/authoring/instructions.jsp (.../instructions.jsp) (revision 31d297d14df060ae066a55e125b5025ed713d681)
@@ -92,7 +92,7 @@
-
@@ -196,7 +196,7 @@
-
Index: lams_tool_wiki/web/pages/learning/wiki.jsp
===================================================================
diff -u -r6672982c4b8130dc115da39d5e918a752a0bd67e -r31d297d14df060ae066a55e125b5025ed713d681
--- lams_tool_wiki/web/pages/learning/wiki.jsp (.../wiki.jsp) (revision 6672982c4b8130dc115da39d5e918a752a0bd67e)
+++ lams_tool_wiki/web/pages/learning/wiki.jsp (.../wiki.jsp) (revision 31d297d14df060ae066a55e125b5025ed713d681)
@@ -463,6 +463,7 @@
function submitWiki(dispatch)
{
document.getElementById("dispatch").value=dispatch;
+ replaceJavascriptToken();
document.getElementById("learningForm").submit();
}
@@ -494,10 +495,5 @@
window.location=url;
}
- var doRefreshPage = "${doRefreshPage}";
- if (doRefreshPage == "true"){
- refreshPage();
- }
-
-->
Index: lams_tool_wiki/web/pages/monitoring/wikiDisplay.jsp
===================================================================
diff -u -r6d29456e3a6b018730d32c60729d6f2e693ac55e -r31d297d14df060ae066a55e125b5025ed713d681
--- lams_tool_wiki/web/pages/monitoring/wikiDisplay.jsp (.../wikiDisplay.jsp) (revision 6d29456e3a6b018730d32c60729d6f2e693ac55e)
+++ lams_tool_wiki/web/pages/monitoring/wikiDisplay.jsp (.../wikiDisplay.jsp) (revision 31d297d14df060ae066a55e125b5025ed713d681)
@@ -363,6 +363,7 @@
function submitWiki(dispatch)
{
document.getElementById("dispatch").value=dispatch;
+ replaceJavascriptToken();
document.getElementById("monitoringForm").submit();
}