Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@
import org.apache.commons.lang3.builder.EqualsBuilder;
import org.apache.commons.lang3.builder.HashCodeBuilder;
import org.apache.roller.util.UUIDGenerator;
import org.apache.roller.weblogger.util.CommentAuthorUrl;


/**
Expand Down Expand Up @@ -130,6 +131,13 @@ public String getUrl() {
public void setUrl(String url) {
this.url = url;
}

/**
* URL of the comment writer when it can be safely rendered as a link.
*/
public String getSafeUrl() {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: this runs the validator (regex + DomainValidator lookup) on every call, and Comments.jsp evaluates #comment.safeUrl three times per row while weblog.vm evaluates $comment.url twice per comment. Compute once per render (an s:set in the JSP, a local in the macro, or memoize in the wrapper).

return CommentAuthorUrl.normalize(this.url);
}


/**
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ public String getEmail() {
* Value is always html escaped.
*/
public String getUrl() {
return StringEscapeUtils.escapeHtml4(this.pojo.getUrl());
return StringEscapeUtils.escapeHtml4(this.pojo.getSafeUrl());

@mraible mraible Aug 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CommentServlet stores "" for a blank URL, so this used to return "" and the javadoc promises a non-null escaped value; escapeHtml4(null) is null, and with strict mode off a custom template that writes $comment.url without an isEmpty guard now prints the literal $comment.url into href for every comment without a URL. Return "" when getSafeUrl() is null.

}


Expand Down Expand Up @@ -147,7 +147,7 @@ public String getRemoteHost() {


/**
* Get the http referrer of the comment poster, used for trackbacks.
* Get the HTTP referrer of the comment poster.
*
* Value is always html escaped.
*/
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,6 @@ public class WeblogRequestMapper implements RequestMapper {
private static final String RSD_SERVLET = "/roller-ui/rendering/rsd";

private static final String COMMENT_SERVLET = "/roller-ui/rendering/comment";
private static final String TRACKBACK_SERVLET = "/roller-ui/rendering/trackback";


// url patterns that are not allowed to be considered weblog handles
Expand Down Expand Up @@ -259,45 +258,24 @@ private String calculateForwardUrl(HttpServletRequest request,

StringBuilder forwardUrl = new StringBuilder(64);

// POST urls, like comment and trackback servlets
// POST URLs for the comment servlet
if("POST".equals(request.getMethod())) {
// posting to permalink, this means comment or trackback
if(context.equals("entry")) {
// trackback requests are required to have an "excerpt" param
if(request.getParameter("excerpt") != null) {
// Comment requests post content to a permalink.
if("entry".equals(context) && request.getParameter("content") != null) {

forwardUrl.append(TRACKBACK_SERVLET);
forwardUrl.append('/');
forwardUrl.append(handle);
if(locale != null) {
forwardUrl.append('/');
forwardUrl.append(locale);
}
forwardUrl.append('/');
forwardUrl.append(context);
if(data != null) {
forwardUrl.append('/');
forwardUrl.append(data);
}

// comment requests are required to have a "content" param
} else if(request.getParameter("content") != null) {

forwardUrl.append(COMMENT_SERVLET);
forwardUrl.append(COMMENT_SERVLET);
forwardUrl.append('/');
forwardUrl.append(handle);
if(locale != null) {
forwardUrl.append('/');
forwardUrl.append(handle);
if(locale != null) {
forwardUrl.append('/');
forwardUrl.append(locale);
}
forwardUrl.append(locale);
}
forwardUrl.append('/');
forwardUrl.append(context);
if(data != null) {
forwardUrl.append('/');
forwardUrl.append(context);
if(data != null) {
forwardUrl.append('/');
forwardUrl.append(data);
}
forwardUrl.append(data);
}

} else {
// someone posting data where they aren't supposed to
return null;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -101,11 +101,6 @@ public boolean getCommentEmailNotify() {
return getBooleanProperty("users.comments.emailnotify");
}

public boolean getTrackbacksEnabled() {
return getBooleanProperty("users.trackbacks.enabled");
}


/** Get Roller version string */
public String getRollerVersion() {
return WebloggerFactory.getWeblogger().getVersion();
Expand Down Expand Up @@ -146,4 +141,3 @@ private boolean getBooleanProperty(String name) {
}

}

Original file line number Diff line number Diff line change
Expand Up @@ -184,11 +184,6 @@ public String comments(String anchor) {
}


public String trackback(String anchor) {
return urlStrategy.getWeblogEntryURL(weblog, locale, anchor, true);
}


public String date(String dateString) {
return urlStrategy.getWeblogCollectionURL(weblog, locale, null, dateString, null, -1, true);
}
Expand Down

This file was deleted.

Loading