From 319578f39062b098dcbcd4b34a38233f23a3e9f7 Mon Sep 17 00:00:00 2001
From: Stian Thorgersen <stianst@gmail.com>
Date: Thu, 23 Oct 2014 20:42:45 +0200
Subject: [PATCH] KEYCLOAK-786

Value in input fields should be escaped
---
 .../src/main/resources/theme/account/base/account.ftl     | 8 ++++----
 .../resources/theme/login/base/login-update-profile.ftl   | 6 +++---
 .../src/main/resources/theme/login/base/login.ftl         | 2 +-
 .../src/main/resources/theme/login/base/register.ftl      | 8 ++++----
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/forms/common-themes/src/main/resources/theme/account/base/account.ftl b/forms/common-themes/src/main/resources/theme/account/base/account.ftl
index f26f9206dc..0b8d18e301 100755
--- a/forms/common-themes/src/main/resources/theme/account/base/account.ftl
+++ b/forms/common-themes/src/main/resources/theme/account/base/account.ftl
@@ -20,7 +20,7 @@
             </div>
 
             <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="username" name="username" disabled="disabled" value="${account.username!''}"/>
+                <input type="text" class="form-control" id="username" name="username" disabled="disabled" value="${(account.username!'')?html}"/>
             </div>
         </div>
 
@@ -30,7 +30,7 @@
             </div>
 
             <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="email" name="email" autofocus value="${account.email!''}"/>
+                <input type="text" class="form-control" id="email" name="email" autofocus value="${(account.email!'')?html}"/>
             </div>
         </div>
 
@@ -41,7 +41,7 @@
             </div>
 
             <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="lastName" name="lastName" value="${account.lastName!''}"/>
+                <input type="text" class="form-control" id="lastName" name="lastName" value="${(account.lastName!'')?html}"/>
             </div>
         </div>
 
@@ -51,7 +51,7 @@
             </div>
 
             <div class="col-sm-10 col-md-10">
-                <input type="text" class="form-control" id="firstName" name="firstName" value="${account.firstName!''}"/>
+                <input type="text" class="form-control" id="firstName" name="firstName" value="${(account.firstName!'')?html}"/>
             </div>
         </div>
 
diff --git a/forms/common-themes/src/main/resources/theme/login/base/login-update-profile.ftl b/forms/common-themes/src/main/resources/theme/login/base/login-update-profile.ftl
index 1089e210d5..812e29eb70 100755
--- a/forms/common-themes/src/main/resources/theme/login/base/login-update-profile.ftl
+++ b/forms/common-themes/src/main/resources/theme/login/base/login-update-profile.ftl
@@ -11,7 +11,7 @@
                     <label for="email" class="${properties.kcLabelClass!}">${rb.email}</label>
                 </div>
                 <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="email" name="email" value="${user.email!''}" class="${properties.kcInputClass!}" />
+                    <input type="text" id="email" name="email" value="${(user.email!'')?html}" class="${properties.kcInputClass!}" />
                 </div>
             </div>
 
@@ -20,7 +20,7 @@
                     <label for="firstName" class="${properties.kcLabelClass!}">${rb.firstName}</label>
                 </div>
                 <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="firstName" name="firstName" value="${user.firstName!''}" class="${properties.kcInputClass!}" />
+                    <input type="text" id="firstName" name="firstName" value="${(user.firstName!'')?html}" class="${properties.kcInputClass!}" />
                 </div>
             </div>
 
@@ -29,7 +29,7 @@
                     <label for="lastName" class="${properties.kcLabelClass!}">${rb.lastName}</label>
                 </div>
                 <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="lastName" name="lastName" value="${user.lastName!''}" class="${properties.kcInputClass!}" />
+                    <input type="text" id="lastName" name="lastName" value="${(user.lastName!'')?html}" class="${properties.kcInputClass!}" />
                 </div>
             </div>
 
diff --git a/forms/common-themes/src/main/resources/theme/login/base/login.ftl b/forms/common-themes/src/main/resources/theme/login/base/login.ftl
index 8ec24702ac..a1a3b23249 100755
--- a/forms/common-themes/src/main/resources/theme/login/base/login.ftl
+++ b/forms/common-themes/src/main/resources/theme/login/base/login.ftl
@@ -21,7 +21,7 @@
                     </div>
 
                     <div class="${properties.kcInputWrapperClass!}">
-                        <input id="username" class="${properties.kcInputClass!}" name="username" value="${login.username!''}" type="text" autofocus />
+                        <input id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')?html}" type="text" autofocus />
                     </div>
                 </div>
 
diff --git a/forms/common-themes/src/main/resources/theme/login/base/register.ftl b/forms/common-themes/src/main/resources/theme/login/base/register.ftl
index 0e17aa6634..113351b629 100755
--- a/forms/common-themes/src/main/resources/theme/login/base/register.ftl
+++ b/forms/common-themes/src/main/resources/theme/login/base/register.ftl
@@ -11,7 +11,7 @@
                     <label for="username" class="${properties.kcLabelClass!}">${rb.username}</label>
                 </div>
                 <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="username" class="${properties.kcInputClass!}" name="username" value="${register.formData.username!''}" />
+                    <input type="text" id="username" class="${properties.kcInputClass!}" name="username" value="${(register.formData.username!'')?html}" />
                 </div>
             </div>
 
@@ -20,7 +20,7 @@
                     <label for="firstName" class="${properties.kcLabelClass!}">${rb.firstName}</label>
                 </div>
                 <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="firstName" class="${properties.kcInputClass!}" name="firstName" value="${register.formData.firstName!''}" />
+                    <input type="text" id="firstName" class="${properties.kcInputClass!}" name="firstName" value="${(register.formData.firstName!'')?html}" />
                 </div>
             </div>
 
@@ -29,7 +29,7 @@
                     <label for="lastName" class="${properties.kcLabelClass!}">${rb.lastName}</label>
                 </div>
                 <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="lastName" class="${properties.kcInputClass!}" name="lastName" value="${register.formData.lastName!''}" />
+                    <input type="text" id="lastName" class="${properties.kcInputClass!}" name="lastName" value="${(register.formData.lastName!'')?html}" />
                 </div>
             </div>
 
@@ -38,7 +38,7 @@
                     <label for="email" class="${properties.kcLabelClass!}">${rb.email}</label>
                 </div>
                 <div class="${properties.kcInputWrapperClass!}">
-                    <input type="text" id="email" class="${properties.kcInputClass!}" name="email" value="${register.formData.email!''}" />
+                    <input type="text" id="email" class="${properties.kcInputClass!}" name="email" value="${(register.formData.email!'')?html}" />
                 </div>
             </div>