jonathanmccann/liferay-portal — pull request #43 by bensonlau (2013-08-29 19:54:17+00:00)
Title: LPS-38723  Removing escape methods that result in incorrect values for flagged emails

LPP-8070 for your reference.

edit_entry.jsp
-removed the escape methods here for the different values because the escape method will cause any values here that contain special characters such as &<> to render incorrectly.
-although we are looking to escape this values on the jsp level, the values (contentTitle, contentUrl) are passed from edit_entry.jsp to the FlagsRequestMessageListener, so escaping them in edit_entry.jsp actually means that when it is used in FlagsRequestMessageListener, the values are incorrect.
-removed the escape method for the className
-removed it from the url because if you use &javascript=0 for example in the url, escaping it will cause the ampersand sign to result in ;amp and thus causing the URL to be incorrect

e.g. contentTitle displays as subject ba<>#$%^&, but because of our current implementation of taking the user to a dialog box, the values of contentTitle, contentURL are then escaped in edit_entry.jsp and thus values like contentTitle after being escaped, become subject ba<>#$%^&

FlagsRequestMessageListener.java
Removed escape methods for groupName and reportedUserName, because the doReceive method doesn't need these to be escaped. In 114 and 117 of this class, the escape methods were added in by Wes Gong it seems to address the issue with needing to escape these values in jsp's. The FlagsRequestMessageListener class does not need to have the reportedUserName values escaped as the values here will be used in the emails sent to the owner of the thread that is flagged. Escaping reportedUserName doesn't do anything as it is already displaying the special characters correctly (this was the concern originally brought up by the LPS that added in those escape methods in this class). Also, in a couple lines earlier, we are using the same method for getting the reporterUser and we do not escape the characters there, so removing the escape method from the reportedUser allows for more consistency.