LeventeHudak/liferay-portal — pull request #21 by laszlocsontos (2013-01-09 12:55:14+00:00)
Title: [TECHNICAL SUPPORT] LPS-31778

Hi Levi,

I've recreated the fix, taking into account @sergiogonzalez comments here: https://github.com/juliocamarero/liferay-portal/pull/970#issuecomment-11611789.

* With your code in record_row_value.jspf, we could escape the value twice if dataType.equals(FieldConstants.HTML) is true, so I guess that the second escape in the following line is not necessary.

Yes, that's right, so I removed that change.

* About the second file where we you are escaping the header before adding it to headerNames, I think that we shouldn't escape that at this point. I think that the search_iterator taglib should take care of escaping the headerNames when rendering the search container (this is the approach we are following for taglibs, the input shouldn't be escaped and the taglib itself should do it)

I've been following this pattern as many places as possible, but in a certain case I had to do escaping in record_row_value.jspf, bacause in search_iterator/page.jsp (near line 340) the following code might print HTML directly to the output. (As you can see that among others in TextSearchEntry or portlet/sites_admin/site_columns.jspf)

<%
entry.print(pageContext);
%>

Cheers,
Laci.