juliocamarero/liferay-portal — pull request #426 by KocsisDaniel (2012-06-26 11:29:22+00:00)
Title: [TECH_SUPPORT] LPS-28132

Hi Julio,

for this pr you can find more details on the LPS ticket comments and on the LPP as well.

Briefly we had an initial issue some years ago with XSS and we provided a fix for that but later it was changed because the usage of escapedModel and the HtmlUtil.escape together caused bad results because we double escaped the strings. So these escape methods removed and we became unprotected. Now we tried to find a solution that wont re-produce any of these issues. Because of that on the view_questions.jps it is not allowed to use the escapemodel since the breadcrumb tag will escape it again but on the other jsp we can use escapedModel instead of many HtmlUtil calls just like on the other jsp's of the portlet. My only concers with that is inconsistency but I didn't want to change the taglibrary to remove escape, so please let me know your opinion!

Thanks,
Daniel