... |
... |
@@ -66,7 +66,7 @@ |
66 |
66 |
#foreach ($category in $services.query.xwql($categoryListStatement).execute()) |
67 |
67 |
#set ($categoryDoc = $xwiki.getDocument($category)) |
68 |
68 |
<li> |
69 |
|
- <div class="category">$categoryDoc.plainTitle</div> |
|
69 |
+ <div class="category">$escapetool.xml($categoryDoc.plainTitle)</div> |
70 |
70 |
#set ($formFieldsForCategoryStatement = "from doc.object($formFieldClassName) as field where field.category = :category order by field.priority") |
71 |
71 |
#set ($formFieldsForCategoryQuery = $services.query.xwql($formFieldsForCategoryStatement).bindValue('category', $category)) |
72 |
72 |
<ul> |
... |
... |
@@ -81,7 +81,7 @@ |
81 |
81 |
#else |
82 |
82 |
#set ($formFieldIconURL = $formFieldDoc.getAttachmentURL($formFieldIcon)) |
83 |
83 |
#end |
84 |
|
- #set ($formFieldIconRendered = "<img src='$formFieldIconURL' alt='$escapetool.xml($formFieldDoc.plainTitle)' class='icon' />") |
|
84 |
+ #set ($formFieldIconRendered = "<img src='$escapetool.xml($formFieldIconURL)' alt='$escapetool.xml($formFieldDoc.plainTitle)' class='icon' />") |
85 |
85 |
#end |
86 |
86 |
<li class="field"> |
87 |
87 |
$formFieldIconRendered |
... |
... |
@@ -97,11 +97,12 @@ |
97 |
97 |
#set ($fieldURL = $doc.getURL('edit', $escapetool.url({ |
98 |
98 |
'xpage': 'plain', |
99 |
99 |
'sheet': 'AppWithinMinutes.ClassEditSheet', |
|
100 |
+ 'form_token': $services.csrf.getToken(), |
100 |
100 |
'template': 'AppWithinMinutes.ClassTemplate', |
101 |
101 |
'field': $formFieldDoc.fullName, |
102 |
102 |
'xeditmode': 'text' |
103 |
103 |
}))) |
104 |
|
- <input type="hidden" value="$fieldURL" class="data"/> |
|
105 |
+ <input type="hidden" value="$escapetool.xml($fieldURL)" class="data"/> |
105 |
105 |
</li> |
106 |
106 |
#end |
107 |
107 |
</ul> |
... |
... |
@@ -388,8 +388,6 @@ |
388 |
388 |
* Display the edit class form. |
389 |
389 |
*# |
390 |
390 |
#macro (displayEditForm) |
391 |
|
- #set ($discard = $xwiki.jsfx.use('js/scriptaculous/effects.js')) |
392 |
|
- #set ($discard = $xwiki.jsfx.use('js/scriptaculous/dragdrop.js')) |
393 |
393 |
#set ($discard = $xwiki.jsx.use('AppWithinMinutes.ClassEditSheet')) |
394 |
394 |
#set ($discard = $xwiki.ssx.use('AppWithinMinutes.ClassEditSheet')) |
395 |
395 |
#set ($discard = $xwiki.ssx.use('AppWithinMinutes.ClassSheetGenerator')) |
... |
... |
@@ -679,6 +679,7 @@ |
679 |
679 |
}) |
680 |
680 |
#if (!$xwiki.exists($templateProviderReference)) |
681 |
681 |
#set ($discard = $queryString.putAll({ |
|
681 |
+ 'form_token': $services.csrf.getToken(), |
682 |
682 |
'template': 'XWiki.TemplateProviderTemplate', |
683 |
683 |
'parent': $doc.fullName |
684 |
684 |
})) |