CVE-2018-11688 (Other, published 2018-06-13T16:29Z)
Description: value: Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/igniterealtime/Openfire
Files changed:
src/web/audit-policy.jsp
src/web/available-plugins.jsp
src/web/clearspace-status.jsp
src/web/component-session-details.jsp
src/web/component-session-summary.jsp
src/web/error.jsp
src/web/external-components-settings.jsp
src/web/group-create.jsp
src/web/group-delete.jsp
src/web/group-edit.jsp
src/web/group-summary.jsp
src/web/http-bind.jsp
src/web/import-certificate.jsp
src/web/log.jsp
src/web/login.jsp
src/web/logviewer.jsp
src/web/manage-updates.jsp
src/web/media-proxy.jsp
src/web/muc-create-permission.jsp
src/web/muc-default-settings.jsp
src/web/muc-history-settings.jsp
src/web/muc-room-affiliations.jsp
src/web/muc-room-delete.jsp
src/web/muc-room-edit-form.jsp
src/web/muc-room-occupants.jsp
src/web/muc-room-summary.jsp
src/web/muc-service-delete.jsp
src/web/muc-service-edit-form.jsp
src/web/muc-service-summary.jsp
src/web/muc-sysadmins.jsp
src/web/muc-tasks.jsp
src/web/security-audit-viewer.jsp
src/web/server-properties.jsp
src/web/server-session-row.jspf
src/web/session-details.jsp
src/web/session-row.jspf
src/web/session-summary.jsp
src/web/ssl-certificates.jsp
src/web/ssl-signing-request.jsp
src/web/system-cache.jsp
src/web/system-clustering.jsp
src/web/system-email.jsp
src/web/system-emailtest.jsp
src/web/user-create.jsp
src/web/user-delete.jsp
src/web/user-edit-form.jsp
src/web/user-lockout.jsp
src/web/user-message.jsp
src/web/user-password.jsp
src/web/user-properties.jsp
src/web/user-roster-add.jsp
src/web/user-roster-delete.jsp
src/web/user-roster-edit.jsp
src/web/user-roster-view.jsp
src/web/user-roster.jsp
src/web/user-search.jsp
src/web/user-summary.jsp
Commit message: xss filter


Vulnerable code:
                   org.jivesoftware.openfire.XMPPServer,
                   org.jivesoftware.openfire.audit.AuditManager,
							 value="<%= ((logDir != null) ? logDir : "") %>">
							<textarea name="ignore" cols="40" rows="3" wrap="virtual"><%= ((ignore != null) ? ignore : "") %></textarea>
</html>
                                       org.jivesoftware.openfire.container.Plugin"
        <img src="<%= plugin.getIcon() %>" width="16" height="16" alt="Plugin">
        <%= (pluginName != null ? pluginName : "") %> &nbsp;
        <a href="<%= plugin.getReadme() %>"
        <a href="<%= plugin.getChangelog() %>"
        <%= pluginDescription != null ? pluginDescription : "" %>
        <%= pluginVersion != null ? pluginVersion : "" %>
        <%= pluginAuthor != null ? pluginAuthor : "" %>  &nbsp;
        <%= fileSize %>
        <a href="javascript:downloadPlugin('<%=updateURL%>', '<%= plugin.hashCode()%>')"><span id="<%= plugin.hashCode() %>-image"><img src="images/add-16x16.gif" width="16" height="16" border="0"
        <img src="<%= plugin.getIcon()%>" width="16" height="16" alt=""/>
    <td colspan="6" nowrap class="line-bottom-border"><%= plugin.getName()%> <fmt:message key="plugin.available.installation.success" /></td>
        <img src="<%= plugin.getIcon() %>" width="16" height="16" alt="Plugin">
        <%= (pluginName != null ? pluginName : "") %> &nbsp;
        <a href="<%= plugin.getReadme() %>"
        <a href="<%= plugin.getChangelog() %>"
        <%= pluginDescription != null ? pluginDescription : "" %>
        <%= pluginVersion != null ? pluginVersion : "" %>
        <%= pluginAuthor != null ? pluginAuthor : "" %>  &nbsp;
        <%= fileSize  %>
        <span id="<%= plugin.hashCode() %>-image"><a href="javascript:downloadPlugin('<%=updateURL%>', '<%= plugin.hashCode()%>')"><img src="images/add-16x16.gif" width="16" height="16" border="0"
        <img src="<%= plugin.getIcon()%>" width="16" height="16" alt=""/>
    <td colspan="6" nowrap class="line-bottom-border"><%= plugin.getName()%> <fmt:message key="plugin.available.installation.success" /></td>
                <%= pluginDescription %>
                <%= pluginVersion%>
                <%= pluginAuthor%>
</html>
            <%= cs.getHostAddress() %>
            <%= cs.getHostName() %>
            <%= cs.getHostAddress() %>
            <%= cs.getHostName() %>
</html>
            <%= componentSession.getExternalComponent().getName() %>
            <%= componentSession.getExternalComponent().getCategory() %>
            <%= componentSession.getExternalComponent().getType() %>
            <%= componentSession.getHostAddress() %>
            <%= componentSession.getHostName() %>
</html>
            <%= componentSession.getExternalComponent().getName() %>
            <%= componentSession.getExternalComponent().getCategory() %>
            <td><%= componentSession.getExternalComponent().getType() %></td>
</html>
<%= sout.toString() %>
<%  } %>
                 java.util.Collection"
                <fmt:message key="component.settings.modification.denied" /> <%= operationFailedDetail != null ? operationFailedDetail : ""%>
							 value="<%= ((defaultSecret != null) ? defaultSecret : "") %>">
					<%= configuration.getSubdomain() %>
					<a href="#" onclick="if (confirm('<fmt:message key="component.settings.confirm_delete" />')) { location.replace('external-components-settings.jsp?deleteConf=<%= configuration.getSubdomain() %>'); } "
    <input type="hidden" name="group" value="<%= groupName %>" id="existingName">
             value="<%= ((name != null) ? name : "") %>" id="gname">
             ><%= ((description != null) ? description : "") %></textarea>
</html>%>
<input type="hidden" name="group" value="<%= groupName %>">
</html>
        <%= errorBuf %>
<input type="hidden" name="group" value="<%= groupName %>"/>
	               <input type="text" name="groupDisplayName" size="30" maxlength="100" value="<%= (groupDisplayName != null ? groupDisplayName : "") %>"><br>
        <input type="hidden" name="group" value="<%= groupName %>">
        <input type="hidden" name="group" value="<%= groupName %>">
                    <td><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= JID.unescapeNode(user.getUsername()) %></a><% if (!isLocal) { showRemoteJIDsWarning = true; %> <font color="red"><b>*</b></font><%}%></td>
%>
            <a href="group-edit.jsp?group=<%= groupName %>"><%= StringUtils.escapeHTMLTags(group.getName()) %></a>
            <a href="group-edit.jsp?group=<%= groupName %>"
            <a href="group-delete.jsp?group=<%= groupName %>"
</html>
                                <input id="CORSDomains" type="text" size="80" name="CORSDomains" value="<%= serverManager.getCORSAllowOrigin() %>">
                                <input id="XFFHeader" type="text" size="40" name="XFFHeader"  value="<%= xffHeader == null ? "" : xffHeader %>">
                                <input id="XFFServerHeader" type="text" size="40" name="XFFServerHeader" value="<%= xffServerHeader == null ? "" : xffServerHeader %>">
                                <input id="XFFHostHeader" type="text" size="40" name="XFFHostHeader" value="<%= xffHostHeader == null ? "" : xffHostHeader %>">
                                <input id="XFFHostName" type="text" size="40" name="XFFHostName" value="<%= xffHostName == null ? "" : xffHostName %>">
</html>
              <fmt:message key="ssl.certificates.error_messenge" />: <%= e.getMessage() %>
    <title><%= log %></title>
</html>
    <input type="hidden" name="url" value="<%= url %>">
<input type="hidden" name="log" value="<%= log %>">
                <td nowrap><b><%= logFile.getName() %></b> (<%= byteFormatter.format(logFile.length()) %>)</td>
<iframe src="log.jsp?log=<%= log %>&mode=<%= mode %>&lines=<%= ("All".equals(numLinesParam) ? "All" : String.valueOf(numLines)) %>"
</html>
								 value="<%= ((proxyHost != null) ? proxyHost : "") %>">
                    <%=proxySession.getCreator()%>
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
    <input type="hidden" name="mucname" value="<%= mucname %>" />
    <input type="hidden" name="mucname" value="<%= mucname %>" />
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
    <input type="hidden" name="mucname" value="<%= mucname %>" />
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
    <input type="hidden" name="mucname" value="<%= mucname %>" />
</html>
                    <%= userDisplay %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=owner"
                    <%= userDisplay %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=admin"
                    <%= userDisplay %><%=  nickname %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=member"
                    <%= userDisplay %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= user %>&delete=true&affiliation=outcast"
<b><a href="muc-room-edit-form.jsp?roomJID=<%= URLEncoder.encode(room.getJID().toBareJID(), "UTF-8") %>"><%= room.getJID().toBareJID() %></a></b>
<input type="hidden" name="roomJID" value="<%= roomJID.toBareJID() %>">
                <%= room.getJID().toBareJID() %>
</html>
            <td><%= room.getName() %></td>
    <input type="hidden" name="roomJID" value="<%= roomJID.toBareJID() %>">
                    <td><input type="text" name="roomName" value="<%= roomName %>">
                        <option value="<%= service.getServiceDomain() %>"<%= service.getServiceDomain().equals(mucName) ? " selected='selected'" : "" %>><%= service.getServiceDomain() %></option>
                                out.print("<input type='hidden' name='mucName' value='"+service.getServiceDomain()+"'/>"+service.getServiceDomain());
                   <td><%= roomJID.getDomain() %></td>
                    <td><input type="text" name="roomconfig_roomname" value="<%= (naturalName == null ? "" : naturalName) %>">
                    <td><input name="roomconfig_roomdesc" value="<%= (description == null ? "" : description) %>" type="text" size="40">
                    <td><input name="room_topic" value="<%= (roomSubject == null ? "" : roomSubject) %>" type="text" size="40">
                 java.text.DateFormat,
                 java.util.List"
        List<MUCRole> roles = room.getOccupantsByNickname(nickName);
        if (roles != null && roles.size() > 0) {
            	for (MUCRole role : roles) {
                    room.kickOccupant(role.getUserAddress(), XMPPServer.getInstance().createJID(webManager.getUser().getUsername(), null), "");
            	}
                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+
                	"&nickName="+URLEncoder.encode(nickName, "UTF-8")+"&deletesuccess=true");
                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+
                	"&nickName="+URLEncoder.encode(nickName, "UTF-8")+"&deletefailed=true");
                <fmt:param value="<%= nickName %>"/>
                <fmt:param value="<%= nickName %>"/>
            <td><%= room.getName() %></td>
            <td><%= role.getUserAddress() %></td>
            <td><%= role.getNickname() %></td>
            <td><%= role.getRole() %></td>
            <td><%= role.getAffiliation() %></td>
<a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucService.getServiceName(), "UTF-8")%>"><%= mucService.getServiceDomain() %></a>
    <option value="<%= service.getServiceName() %>"<%= mucService.getServiceName().equals(service.getServiceName()) ? " selected='selected'" : "" %>><%= service.getServiceDomain() %></option>
        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : mucname %>&start=<%= (i*range) %>"
        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : mucname %>&start=<%= (i*range) %>"
</html>
<b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
<input type="hidden" name="mucname" value="<%= mucname %>">
                <%= mucname %>
</html>
<%@ page import="org.jivesoftware.util.ParamUtils,
<input type="hidden" name="mucname" value="<%= mucname %>">
                    <input type="text" size="30" maxlength="150" name="mucname" value="<%= (mucname != null ? mucname : "") %>">
                    <%= mucname %>
                    <input type="text" size="30" maxlength="150" name="mucdesc" value="<%= (mucdesc != null ? mucdesc : "") %>">
</html>
                 org.jivesoftware.util.ParamUtils"
            <a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(service.getServiceName(), "UTF-8") %>"><%= JID.unescapeNode(service.getServiceName()) %></a>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
    <input type="hidden" name="mucname" value="<%= mucname %>" />
		<input type="text" name="userJID" size="30" maxlength="100" value="<%= (userJID != null ? userJID : "") %>"
							<%= userDisplay %>
							<a href="muc-sysadmins.jsp?userJID=<%= user.toString() %>&delete=true&mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= mucname %></a></b>
    <input type="hidden" name="mucname" value="<%= mucname %>" />
    <input type="hidden" name="mucname" value="<%= mucname %>" />
</html>
    <input type="text" size="30" maxlength="150" name="username" value="<%= username != null ? username : "" %>"/>
            <a href="user-properties.jsp?username=<%= URLEncoder.encode(event.getUsername(), "UTF-8") %>"><%= JID.unescapeNode(event.getUsername()) %></a>
                <span title="<%= StringUtils.escapeHTMLTags(n) %>">
                <input type="hidden" name="propName" value="<%= StringUtils.escapeHTMLTags(propName) %>">
                <input type="text" name="propName" size="40" maxlength="100" value="<%= (propName != null ? StringUtils.escapeHTMLTags(propName) : "") %>">
</html>
            <td width="1%" ><img src="getFavicon?host=<%=host%>" width="16" height="16" alt=""></td>
            <td><a href="server-session-details.jsp?hostname=<%= URLEncoder.encode(host, "UTF-8") %>" title="<fmt:message key='session.row.cliked' />"><%= host %></a></td>
</tr>
            <%= StringUtils.escapeForXML(address.toString()) %>
                <i> <fmt:message key="session.details.anonymous" /> </i> - <%= address.getResource()==null?"":StringUtils.escapeForXML(address.getResource()) %>
                <a href="user-properties.jsp?username=<%= URLEncoder.encode(n, "UTF-8") %>"><%= JID.unescapeNode(n) %></a>
                    statusTxt = " -- " + StringUtils.escapeForXML(statusTxt);
</html>
        <%= StringUtils.escapeForXML(sess.getAddress().getResource()) %>
                <%= _stat %>
                <%= sess.getPresence().getStatus() %>
                <%= sess.getPresence().getStatus() %>
</tr>
</html>
              <%= identities.toString() %> (<%= a %>)
              <a href="ssl-certificates.jsp?alias=<%= a %>&type=server&delete=true"
      <input name="alias" type="hidden" value="<%= a%>">
                               value="<%= ((name!=null) ? name : "") %>" id="namef">
                        <input type="text" name="ou" size="50" maxlength="75" value="<%= ((organizationalUnit!=null) ? organizationalUnit : "") %>" id="ouf">
                        <input type="text" name="o" size="50" maxlength="75" value="<%= ((organization!=null) ? organization : "") %>" id="of">
                        <input type="text" name="city" size="50" maxlength="75" value="<%= ((city!=null) ? city : "") %>" id="cityf">
                        <input type="text" name="state" size="30" maxlength="75" value="<%= ((state!=null) ? state : "") %>" id="statef">
                        <input type="text" name="country" size="2" maxlength="2" value="<%= ((countryCode!=null) ? countryCode : "") %>" id="countryf">
</html>
                <td><%= cache.getName() %></td>
                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= nodeID %>"
                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= nodeID %>">
				<input type="text" name="host" value="<%= (host != null)?host:"" %>" size="40" maxlength="150">
				<input type="text" name="server_username" value="<%= (username != null) ? username : "" %>" size="40" maxlength="150">
</html>
                        (Message: <%= mex.getMessage() %>)
                <%= host %>:<%= JiveGlobals.getIntProperty("mail.smtp.port", 25)  %>
            <input type="hidden" name="from" value="<%= from %>">
            (<a href="user-edit-form.jsp?username=<%=user.getUsername()%>">Update Address</a>)
            <input type="text" name="to" value="<%= ((to != null) ? to : "") %>"
            <input type="text" name="subject" value="<%= ((subject != null) ? subject : "") %>"
            <textarea name="body" cols="45" rows="5" wrap="virtual"><%= body %></textarea>
</html>
				<input type="text" name="username" size="30" maxlength="75" value="<%= ((username!=null) ? username : "") %>"
				<input type="text" name="name" size="30" maxlength="75" value="<%= ((name!=null) ? name : "") %>"
				<input type="text" name="email" size="30" maxlength="75" value="<%= ((email!=null) ? email : "") %>"
</html>
<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= JID.unescapeNode(user.getUsername()) %></a></b>
<input type="hidden" name="username" value="<%= username %>">
<input type="hidden" name="username" value="<%= username %>">
                <%= JID.unescapeNode(user.getUsername()) %>
                 value="<%= user.getName() %>">
                 value="<%= ((user.getEmail()!=null) ? user.getEmail() : "") %>">
    <fmt:param value="<%= "<b><a href='user-properties.jsp?username="+URLEncoder.encode(username, "UTF-8")+"'>"+JID.unescapeNode(username)+"</a></b>" %>"/>
    <input type="hidden" name="username" value="<%= username %>">
<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(username, "UTF-8") %>"><%= JID.unescapeNode(username) %></a></b>
    <input type="hidden" name="username" value="<%= username %>">
<input type="hidden" name="username" value="<%= username %>">
</html>
<input type="hidden" name="username" value="<%= username %>">
                <%= JID.unescapeNode(user.getUsername()) %>
            <%= JID.unescapeNode(user.getUsername()) %>
                <%= user.getName() %>
                <a href="mailto:<%= user.getEmail() %>"><%= user.getEmail() %></a>
<input type="hidden" name="username" value="<%= user.getUsername() %>">
</html>
        <fmt:param value="<%= username %>"/>
<input type="hidden" name="username" value="<%= username %>">
				<input type="text" name="jid" size="30" maxlength="255" value="<%= ((jid!=null) ? jid : "") %>"
				<input type="text" name="nickname" size="30" maxlength="255" value="<%= ((nickname!=null) ? nickname : "") %>"
				<input type="text" name="groups" size="30" maxlength="255" value="<%= ((groups!=null) ? groups : "") %>"
</html>
        <fmt:param value="<%= "<b>"+jid+"</b>" %>" />
        <fmt:param value="<%= "<b>"+username+"</b>" %>" />
    <input type="hidden" name="username" value="<%= username %>">
    <input type="hidden" name="jid" value="<%= jid %>">
    <fmt:param value="<%= username %>"/>
<input type="hidden" name="username" value="<%= username %>">
<input type="hidden" name="jid" value="<%= jid %>">
                <%= jid %>
                 value="<%= item.getNickname() %>">
                        out.print(group);
                        out.print(group.getName());
</html>
    <fmt:param value="<%= username %>"/>
                <%= jid %>
                <%= item.getNickname() %>
                            out.print(group);
                            out.print(group.getName());
                <%= item.getSubStatus().getName() %>
<input type="hidden" name="jid" value="<%= jid %>">
<input type="hidden" name="username" value="<%= username %>">
<input type="hidden" name="jid" value="<%= jid %>">
<input type="hidden" name="username" value="<%= username %>">
</html>
    <fmt:param value="<%= "<b>"+JID.unescapeNode(username)+"</b>" %>" />
            <%= (rosterItem.getNickname() != null ? rosterItem.getNickname() : "<i>None</i>") %>
</html>
          <input type="text" name="username" value="<%= ((username!=null) ? username : "") %>" size="30" maxlength="75"/>
            <a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"<%= lockedOut ? " style='text-decoration: line-through underline;'" : "" %>><%= JID.unescapeNode(user.getUsername()) %></a>
            <%= user.getName() %> &nbsp;

Fixed code:
                 org.jivesoftware.openfire.XMPPServer,
                 org.jivesoftware.openfire.audit.AuditManager,
                 org.jivesoftware.util.StringUtils,
							 value="<%= ((logDir != null) ? StringUtils.escapeForXML(logDir) : "") %>">
							<textarea name="ignore" cols="40" rows="3" wrap="virtual"><%= ((ignore != null) ? StringUtils.escapeHTMLTags(ignore) : "") %></textarea>
</html>
                                       org.jivesoftware.openfire.container.Plugin,
                                       org.jivesoftware.util.StringUtils"
        <img src="<%= StringUtils.escapeForXML(plugin.getIcon()) %>" width="16" height="16" alt="Plugin">
        <%= (pluginName != null ? StringUtils.escapeHTMLTags(pluginName) : "") %> &nbsp;
        <a href="<%= StringUtils.escapeForXML(plugin.getReadme()) %>"
        <a href="<%= StringUtils.escapeForXML(plugin.getChangelog()) %>"
        <%= pluginDescription != null ? StringUtils.escapeHTMLTags(pluginDescription) : "" %>
        <%= pluginVersion != null ? StringUtils.escapeHTMLTags(pluginVersion) : "" %>
        <%= pluginAuthor != null ? StringUtils.escapeHTMLTags(pluginAuthor) : "" %>  &nbsp;
        <%= StringUtils.escapeHTMLTags(fileSize) %>
        <a href="javascript:downloadPlugin('<%=StringUtils.escapeForXML(updateURL)%>', '<%= plugin.hashCode()%>')"><span id="<%= plugin.hashCode() %>-image"><img src="images/add-16x16.gif" width="16" height="16" border="0"
        <img src="<%= StringUtils.escapeForXML(plugin.getIcon())%>" width="16" height="16" alt=""/>
    <td colspan="6" nowrap class="line-bottom-border"><%= StringUtils.escapeHTMLTags(plugin.getName())%> <fmt:message key="plugin.available.installation.success" /></td>
        <img src="<%= StringUtils.escapeForXML(plugin.getIcon()) %>" width="16" height="16" alt="Plugin">
        <%= (pluginName != null ? StringUtils.escapeHTMLTags(pluginName) : "") %> &nbsp;
        <a href="<%= StringUtils.escapeForXML(plugin.getReadme()) %>"
        <a href="<%= StringUtils.escapeForXML(plugin.getChangelog()) %>"
        <%= pluginDescription != null ? StringUtils.escapeHTMLTags(pluginDescription) : "" %>
        <%= pluginVersion != null ? StringUtils.escapeHTMLTags(pluginVersion) : "" %>
        <%= pluginAuthor != null ? StringUtils.escapeHTMLTags(pluginAuthor) : "" %>  &nbsp;
        <%= StringUtils.escapeHTMLTags(fileSize)  %>
        <span id="<%= plugin.hashCode() %>-image"><a href="javascript:downloadPlugin('<%=StringUtils.escapeForXML(updateURL) %>', '<%= plugin.hashCode() %>')"><img src="images/add-16x16.gif" width="16" height="16" border="0"
        <img src="<%= StringUtils.escapeForXML(plugin.getIcon())%>" width="16" height="16" alt=""/>
    <td colspan="6" nowrap class="line-bottom-border"><%= StringUtils.escapeHTMLTags(plugin.getName())%> <fmt:message key="plugin.available.installation.success" /></td>
                <%= StringUtils.escapeHTMLTags(pluginDescription) %>
                <%= StringUtils.escapeHTMLTags(pluginVersion) %>
                <%= StringUtils.escapeHTMLTags(pluginAuthor) %>
</html>
<%@ page import="org.jivesoftware.util.StringUtils" %>
            <%= StringUtils.escapeHTMLTags(cs.getHostAddress()) %>
            <%= StringUtils.escapeHTMLTags(cs.getHostName()) %>
            <%= StringUtils.escapeHTMLTags(cs.getHostAddress()) %>
            <%= StringUtils.escapeHTMLTags(cs.getHostName()) %>
</html>
                 org.jivesoftware.util.StringUtils,
            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getName()) %>
            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getCategory()) %>
            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getType()) %>
            <%= StringUtils.escapeHTMLTags(componentSession.getHostAddress()) %>
            <%= StringUtils.escapeHTMLTags(componentSession.getHostName()) %>
</html>
                 org.jivesoftware.util.StringUtils,
            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getName()) %>
            <%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getCategory()) %>
            <td><%= StringUtils.escapeHTMLTags(componentSession.getExternalComponent().getType()) %></td>
</html>
                 org.jivesoftware.util.StringUtils,
<%= StringUtils.escapeHTMLTags(sout.toString()) %>
<%  } %>
                 org.jivesoftware.util.StringUtils,
                 java.util.Collection,
                 java.net.URLEncoder"
                <fmt:message key="component.settings.modification.denied" /> <%= operationFailedDetail != null ? StringUtils.escapeHTMLTags(operationFailedDetail) : ""%>
							 value="<%= ((defaultSecret != null) ? StringUtils.escapeForXML(defaultSecret) : "") %>">
					<%= StringUtils.escapeHTMLTags(configuration.getSubdomain()) %>
					<a href="#" onclick="if (confirm('<fmt:message key="component.settings.confirm_delete" />')) { location.replace('external-components-settings.jsp?deleteConf=<%= URLEncoder.encode(configuration.getSubdomain(),"UTF-8") %>'); } "
                 org.jivesoftware.util.StringUtils,
    <input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>" id="existingName">
             value="<%= ((name != null) ? StringUtils.escapeForXML(name) : "") %>" id="gname">
             ><%= ((description != null) ? StringUtils.escapeHTMLTags(description) : "") %></textarea>
</html>%>
<input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>">
</html>
        <%= StringUtils.escapeHTMLTags(errorBuf.toString()) %>
<input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>"/>
	               <input type="text" name="groupDisplayName" size="30" maxlength="100" value="<%= (groupDisplayName != null ? StringUtils.escapeForXML(groupDisplayName) : "") %>"><br>
        <input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>">
        <input type="hidden" name="group" value="<%= StringUtils.escapeForXML(groupName) %>">
                    <td><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %></a><% if (!isLocal) { showRemoteJIDsWarning = true; %> <font color="red"><b>*</b></font><%}%></td>
%>
            <a href="group-edit.jsp?group=<%= URLEncoder.encode(groupName,"UTF-8") %>"><%= StringUtils.escapeHTMLTags(group.getName()) %></a>
            <a href="group-edit.jsp?group=<%= URLEncoder.encode(groupName,"UTF-8") %>"
            <a href="group-delete.jsp?group=<%= URLEncoder.encode(groupName,"UTF-8") %>"
</html>
<%@ page import="org.jivesoftware.util.StringUtils" %>
                                <input id="CORSDomains" type="text" size="80" name="CORSDomains" value="<%= StringUtils.escapeForXML(serverManager.getCORSAllowOrigin()) %>">
                                <input id="XFFHeader" type="text" size="40" name="XFFHeader"  value="<%= xffHeader == null ? "" : StringUtils.escapeForXML(xffHeader) %>">
                                <input id="XFFServerHeader" type="text" size="40" name="XFFServerHeader" value="<%= xffServerHeader == null ? "" : StringUtils.escapeForXML(xffServerHeader) %>">
                                <input id="XFFHostHeader" type="text" size="40" name="XFFHostHeader" value="<%= xffHostHeader == null ? "" : StringUtils.escapeForXML(xffHostHeader) %>">
                                <input id="XFFHostName" type="text" size="40" name="XFFHostName" value="<%= xffHostName == null ? "" : StringUtils.escapeForXML(xffHostName) %>">
</html>
                org.jivesoftware.util.StringUtils,
              <fmt:message key="ssl.certificates.error_messenge" />: <%= StringUtils.escapeHTMLTags(e.getMessage()) %>
    <title><%= StringUtils.escapeHTMLTags(log) %></title>
</html>
    <input type="hidden" name="url" value="<%= StringUtils.escapeForXML(url) %>">
                 java.net.URLEncoder,
<input type="hidden" name="log" value="<%= StringUtils.escapeForXML(log) %>">
                <td nowrap><b><%= StringUtils.escapeHTMLTags(logFile.getName()) %></b> (<%= byteFormatter.format(logFile.length()) %>)</td>
<iframe src="log.jsp?log=<%= URLEncoder.encode(log) %>&mode=<%= URLEncoder.encode(mode) %>&lines=<%= ("All".equals(numLinesParam) ? "All" : String.valueOf(numLines)) %>"
</html>
                 org.jivesoftware.util.StringUtils,
								 value="<%= ((proxyHost != null) ? StringUtils.escapeForXML(proxyHost) : "") %>">
<%@ page import="org.jivesoftware.util.StringUtils" %>
                    <%= StringUtils.escapeHTMLTags(proxySession.getCreator())%>
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
</html>
                 org.jivesoftware.util.StringUtils,
                    <%= StringUtils.escapeHTMLTags(userDisplay) %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=owner"
                    <%= StringUtils.escapeHTMLTags(userDisplay) %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=admin"
                    <%= StringUtils.escapeHTMLTags(userDisplay) %><%=  StringUtils.escapeHTMLTags(nickname) %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=member"
                    <%= StringUtils.escapeHTMLTags(userDisplay) %>
                    <a href="muc-room-affiliations.jsp?roomJID=<%= URLEncoder.encode(roomJID.toBareJID(), "UTF-8") %>&userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&affiliation=outcast"
<b><a href="muc-room-edit-form.jsp?roomJID=<%= URLEncoder.encode(room.getJID().toBareJID(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(room.getJID().toBareJID()) %></a></b>
<input type="hidden" name="roomJID" value="<%= StringUtils.escapeForXML(roomJID.toBareJID()) %>">
                <%= StringUtils.escapeHTMLTags(room.getJID().toBareJID()) %>
</html>
                 org.jivesoftware.util.StringUtils,
            <td><%= StringUtils.escapeHTMLTags(room.getName()) %></td>
    <input type="hidden" name="roomJID" value="<%= StringUtils.escapeForXML(roomJID.toBareJID()) %>">
                    <td><input type="text" name="roomName" value="<%= StringUtils.escapeForXML(roomName) %>">
                        <option value="<%= StringUtils.escapeForXML(service.getServiceDomain()) %>"<%= service.getServiceDomain().equals(mucName) ? " selected='selected'" : "" %>><%= StringUtils.escapeHTMLTags(service.getServiceDomain()) %></option>
                                out.print("<input type='hidden' name='mucName' value='"+StringUtils.escapeForXML(service.getServiceDomain())+"'/>"+StringUtils.escapeHTMLTags(service.getServiceDomain()));
                   <td><%= StringUtils.escapeHTMLTags(roomJID.getDomain()) %></td>
                    <td><input type="text" name="roomconfig_roomname" value="<%= (naturalName == null ? "" : StringUtils.escapeForXML(naturalName)) %>">
                    <td><input name="roomconfig_roomdesc" value="<%= (description == null ? "" : StringUtils.escapeForXML(description)) %>" type="text" size="40">
                    <td><input name="room_topic" value="<%= (roomSubject == null ? "" : StringUtils.escapeForXML(roomSubject)) %>" type="text" size="40">
                 org.jivesoftware.util.StringUtils,
                 java.text.DateFormat"
        MUCRole role = room.getOccupant(nickName);
        if (role != null) {
                room.kickOccupant(role.getUserAddress(), XMPPServer.getInstance().createJID(webManager.getUser().getUsername(), null), "");
                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+"&nickName="+URLEncoder.encode(role.getNickname(), "UTF-8")+"&deletesuccess=true");
                response.sendRedirect("muc-room-occupants.jsp?roomJID="+URLEncoder.encode(room.getJID().toBareJID(), "UTF-8")+"&nickName="+URLEncoder.encode(role.getNickname(), "UTF-8")+"&deletefailed=true");
                <fmt:param value="<%= StringUtils.escapeForXML(nickName) %>"/>
                <fmt:param value="<%= StringUtils.escapeForXML(nickName) %>"/>
            <td><%= StringUtils.escapeHTMLTags(room.getName()) %></td>
            <td><%= StringUtils.escapeHTMLTags(role.getUserAddress().toString()) %></td>
            <td><%= StringUtils.escapeHTMLTags(role.getNickname().toString()) %></td>
            <td><%= StringUtils.escapeHTMLTags(role.getRole().toString()) %></td>
            <td><%= StringUtils.escapeHTMLTags(role.getAffiliation().toString()) %></td>
<a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucService.getServiceName(), "UTF-8")%>"><%= StringUtils.escapeHTMLTags(mucService.getServiceDomain()) %></a>
    <option value="<%= StringUtils.escapeForXML(service.getServiceName()) %>"<%= mucService.getServiceName().equals(service.getServiceName()) ? " selected='selected'" : "" %>><%= StringUtils.escapeHTMLTags(service.getServiceDomain()) %></option>
        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : URLEncoder.encode(mucname) %>&start=<%= (i*range) %>"
        <a href="muc-room-summary.jsp?mucname=<%= mucname == null ? "" : URLEncoder.encode(mucname) %>&start=<%= (i*range) %>"
</html>
<b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
<input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>">
                <%= StringUtils.escapeHTMLTags(mucname) %>
</html>
<%@ page import="org.jivesoftware.util.StringUtils,
                 org.jivesoftware.util.ParamUtils,
<input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>">
                    <input type="text" size="30" maxlength="150" name="mucname" value="<%= (mucname != null ? StringUtils.escapeForXML(mucname) : "") %>">
                    <%= StringUtils.escapeHTMLTags(mucname) %>
                    <input type="text" size="30" maxlength="150" name="mucdesc" value="<%= (mucdesc != null ? StringUtils.escapeForXML(mucdesc) : "") %>">
</html>
                 org.jivesoftware.util.ParamUtils,
                 org.jivesoftware.util.StringUtils"
            <a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(service.getServiceName(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(service.getServiceName())) %></a>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
		<input type="text" name="userJID" size="30" maxlength="100" value="<%= (userJID != null ? StringUtils.escapeForXML(userJID) : "") %>"
							<%= StringUtils.escapeHTMLTags(userDisplay) %>
							<a href="muc-sysadmins.jsp?userJID=<%= URLEncoder.encode(user.toString()) %>&delete=true&mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"
</html>
<fmt:message key="groupchat.service.settings_affect" /> <b><a href="muc-service-edit-form.jsp?mucname=<%= URLEncoder.encode(mucname, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(mucname) %></a></b>
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
    <input type="hidden" name="mucname" value="<%= StringUtils.escapeForXML(mucname) %>" />
</html>
    <input type="text" size="30" maxlength="150" name="username" value="<%= username != null ? StringUtils.escapeForXML(username) : "" %>"/>
            <a href="user-properties.jsp?username=<%= URLEncoder.encode(event.getUsername(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(event.getUsername())) %></a>
                <span title="<%= StringUtils.escapeForXML(n) %>">
                <input type="hidden" name="propName" value="<%= StringUtils.escapeForXML(propName) %>">
                <input type="text" name="propName" size="40" maxlength="100" value="<%= (propName != null ? StringUtils.escapeForXML(propName) : "") %>">
</html>
                 org.jivesoftware.util.StringUtils,
            <td width="1%" ><img src="getFavicon?host=<%=URLEncoder.encode(host, "UTF-8")%>" width="16" height="16" alt=""></td>
            <td><a href="server-session-details.jsp?hostname=<%= URLEncoder.encode(host, "UTF-8") %>" title="<fmt:message key='session.row.cliked' />"><%= StringUtils.escapeHTMLTags(host) %></a></td>
</tr>
                 org.jivesoftware.util.StringUtils,
            <%= StringUtils.escapeHTMLTags(address.toString()) %>
                <i> <fmt:message key="session.details.anonymous" /> </i> - <%= address.getResource()==null?"":StringUtils.escapeHTMLTags(address.getResource()) %>
                <a href="user-properties.jsp?username=<%= URLEncoder.encode(n, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(n)) %></a>
                    statusTxt = " -- " + StringUtils.escapeHTMLTags(statusTxt);
</html>
        <%= StringUtils.escapeHTMLTags(sess.getAddress().getResource()) %>
                <%= StringUtils.escapeHTMLTags(_stat) %>
                <%= StringUtils.escapeHTMLTags(sess.getPresence().getStatus()) %>
                <%= StringUtils.escapeHTMLTags(sess.getPresence().getStatus()) %>
</tr>
</html>
<%@ page import="java.net.URLEncoder" %>
              <%= StringUtils.escapeHTMLTags(identities.toString()) %> (<%= StringUtils.escapeHTMLTags(a) %>)
              <a href="ssl-certificates.jsp?alias=<%= URLEncoder.encode(a) %>&type=server&delete=true"
      <input name="alias" type="hidden" value="<%= StringUtils.escapeForXML(a)%>">
<%@ page import="org.jivesoftware.util.StringUtils" %>
                               value="<%= ((name!=null) ? StringUtils.escapeForXML(name) : "") %>" id="namef">
                        <input type="text" name="ou" size="50" maxlength="75" value="<%= ((organizationalUnit!=null) ? StringUtils.escapeForXML(organizationalUnit) : "") %>" id="ouf">
                        <input type="text" name="o" size="50" maxlength="75" value="<%= ((organization!=null) ? StringUtils.escapeForXML(organization) : "") %>" id="of">
                        <input type="text" name="city" size="50" maxlength="75" value="<%= ((city!=null) ? StringUtils.escapeForXML(city) : "") %>" id="cityf">
                        <input type="text" name="state" size="30" maxlength="75" value="<%= ((state!=null) ? StringUtils.escapeForXML(state) : "") %>" id="statef">
                        <input type="text" name="country" size="2" maxlength="2" value="<%= ((countryCode!=null) ? StringUtils.escapeForXML(countryCode) : "") %>" id="countryf">
</html>
<%@ page import="org.jivesoftware.util.StringUtils"%>
                <td><%= StringUtils.escapeHTMLTags(cache.getName()) %></td>
<%@ page import="java.net.URLEncoder" %>
                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= URLEncoder.encode(nodeID) %>"
                      <a href="plugins/<%= CacheFactory.getPluginName() %>/system-clustering-node.jsp?UID=<%= URLEncoder.encode(nodeID) %>">
				<input type="text" name="host" value="<%= (host != null)? StringUtils.escapeForXML(host):"" %>" size="40" maxlength="150">
				<input type="text" name="server_username" value="<%= (username != null) ? StringUtils.escapeForXML(username) : "" %>" size="40" maxlength="150">
</html>
                 java.net.URLEncoder,
                        (Message: <%= StringUtils.escapeHTMLTags(mex.getMessage()) %>)
                <%= StringUtils.escapeHTMLTags(host) %>:<%= JiveGlobals.getIntProperty("mail.smtp.port", 25)  %>
            <input type="hidden" name="from" value="<%= StringUtils.escapeForXML(from) %>">
            (<a href="user-edit-form.jsp?username=<%= URLEncoder.encode(user.getUsername())%>">Update Address</a>)
            <input type="text" name="to" value="<%= ((to != null) ? StringUtils.escapeForXML(to) : "") %>"
            <input type="text" name="subject" value="<%= ((subject != null) ? StringUtils.escapeForXML(subject) : "") %>"
            <textarea name="body" cols="45" rows="5" wrap="virtual"><%= StringUtils.escapeHTMLTags(body) %></textarea>
</html>
				<input type="text" name="username" size="30" maxlength="75" value="<%= ((username!=null) ? StringUtils.escapeForXML(username) : "") %>"
				<input type="text" name="name" size="30" maxlength="75" value="<%= ((name!=null) ? StringUtils.escapeForXML(name) : "") %>"
				<input type="text" name="email" size="30" maxlength="75" value="<%= ((email!=null) ? StringUtils.escapeForXML(email) : "") %>"
</html>
<%@ page import="org.jivesoftware.util.StringUtils" %>
<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %></a></b>
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
                 org.jivesoftware.util.StringUtils,
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
                <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %>
                 value="<%= StringUtils.escapeForXML(user.getName()) %>">
                 value="<%= ((user.getEmail()!=null) ? StringUtils.escapeForXML(user.getEmail()) : "") %>">
<%@ page import="org.jivesoftware.util.StringUtils" %>
    <fmt:param value="<%= "<b><a href='user-properties.jsp?username="+URLEncoder.encode(username, "UTF-8")+"'>"+StringUtils.escapeHTMLTags(JID.unescapeNode(username))+"</a></b>" %>"/>
    <input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
<b><a href="user-properties.jsp?username=<%= URLEncoder.encode(username, "UTF-8") %>"><%= StringUtils.escapeHTMLTags(JID.unescapeNode(username)) %></a></b>
    <input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
                 org.jivesoftware.util.StringUtils,
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
</html>
<input type="hidden" name="username" value="<%=StringUtils.escapeForXML(username) %>">
                <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %>
<%@ page import="org.jivesoftware.util.StringUtils"%>
            <%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %>
                <%= StringUtils.escapeHTMLTags(user.getName()) %>
                <a href="mailto:<%= StringUtils.escapeForXML(user.getEmail()) %>"><%= StringUtils.escapeHTMLTags(user.getEmail()) %></a>
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(user.getUsername()) %>">
</html>
        <fmt:param value="<%= StringUtils.escapeForXML(username) %>"/>
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
				<input type="text" name="jid" size="30" maxlength="255" value="<%= ((jid!=null) ? StringUtils.escapeForXML(jid) : "") %>"
				<input type="text" name="nickname" size="30" maxlength="255" value="<%= ((nickname!=null) ? StringUtils.escapeForXML(nickname) : "") %>"
				<input type="text" name="groups" size="30" maxlength="255" value="<%= ((groups!=null) ? StringUtils.escapeForXML(groups) : "") %>"
</html>
        <fmt:param value="<%= "<b>"+StringUtils.escapeForXML(jid)+"</b>" %>" />
        <fmt:param value="<%= "<b>"+StringUtils.escapeForXML(username)+"</b>" %>" />
    <input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
    <input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
                 org.jivesoftware.util.StringUtils,
    <fmt:param value="<%= StringUtils.escapeForXML(username) %>"/>
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
<input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
                <%= StringUtils.escapeHTMLTags(jid) %>
                 value="<%= StringUtils.escapeForXML(item.getNickname()) %>">
                        out.print(StringUtils.escapeForXML(group));
                        out.print(StringUtils.escapeForXML(group.getName()));
</html>
                 org.jivesoftware.util.StringUtils,
    <fmt:param value="<%= StringUtils.escapeForXML(username) %>"/>
                <%= StringUtils.escapeHTMLTags(jid) %>
                <%= StringUtils.escapeHTMLTags(item.getNickname()) %>
                            out.print(StringUtils.escapeForXML(group));
                            out.print(StringUtils.escapeForXML(group.getName()));
                <%= StringUtils.escapeHTMLTags(item.getSubStatus().getName()) %>
<input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
<input type="hidden" name="jid" value="<%= StringUtils.escapeForXML(jid) %>">
<input type="hidden" name="username" value="<%= StringUtils.escapeForXML(username) %>">
</html>
    <fmt:param value="<%= "<b>"+StringUtils.escapeForXML(JID.unescapeNode(username))+"</b>" %>" />
            <%= (rosterItem.getNickname() != null ? StringUtils.escapeHTMLTags(rosterItem.getNickname()) : "<i>None</i>") %>
</html>
          <input type="text" name="username" value="<%= ((username!=null) ? StringUtils.escapeForXML(username) : "") %>" size="30" maxlength="75"/>
            <a href="user-properties.jsp?username=<%= URLEncoder.encode(user.getUsername(), "UTF-8") %>"<%= lockedOut ? " style='text-decoration: line-through underline;'" : "" %>><%= StringUtils.escapeHTMLTags(JID.unescapeNode(user.getUsername())) %></a>
            <%= StringUtils.escapeHTMLTags(user.getName()) %> &nbsp;