diff --git a/source/java/org/alfresco/repo/web/scripts/facet/AbstractSolrFacetConfigAdminWebScript.java b/source/java/org/alfresco/repo/web/scripts/facet/AbstractSolrFacetConfigAdminWebScript.java index 247fc20adb..5f76fb44ba 100644 --- a/source/java/org/alfresco/repo/web/scripts/facet/AbstractSolrFacetConfigAdminWebScript.java +++ b/source/java/org/alfresco/repo/web/scripts/facet/AbstractSolrFacetConfigAdminWebScript.java @@ -25,6 +25,8 @@ import java.util.Collections; import java.util.HashSet; import java.util.Map; import java.util.Set; +import java.util.regex.Matcher; +import java.util.regex.Pattern; import javax.servlet.http.HttpServletResponse; @@ -70,6 +72,9 @@ public abstract class AbstractSolrFacetConfigAdminWebScript extends DeclarativeW protected static final String CUSTOM_PARAM_NAME = "name"; protected static final String CUSTOM_PARAM_VALUE = "value"; + // The pattern is equivalent to the pattern defined in the forms-runtime.js + protected static final Pattern FILTER_ID_PATTERN = Pattern.compile("([\"\\*\\\\\\>\\<\\?\\/\\:\\|]+)|([\\.]?[\\.]+$)"); + protected SolrFacetService facetService; /** @@ -190,6 +195,16 @@ public abstract class AbstractSolrFacetConfigAdminWebScript extends DeclarativeW } + protected void validateFilterID(String filterID) + { + Matcher matcher = FILTER_ID_PATTERN.matcher(filterID); + if (matcher.find()) + { + throw new WebScriptException(HttpServletResponse.SC_BAD_REQUEST, + "Invalid Filter Id. The characters \" * \\ < > ? / : | are not allowed. The Filter Id cannot end with a dot."); + } + } + private Serializable getSerializableValue(Object object) throws JSONException { if (!(object instanceof Serializable)) diff --git a/source/java/org/alfresco/repo/web/scripts/facet/SolrFacetConfigAdminPost.java b/source/java/org/alfresco/repo/web/scripts/facet/SolrFacetConfigAdminPost.java index 78dee22bc4..4b5a7c1932 100644 --- a/source/java/org/alfresco/repo/web/scripts/facet/SolrFacetConfigAdminPost.java +++ b/source/java/org/alfresco/repo/web/scripts/facet/SolrFacetConfigAdminPost.java @@ -77,6 +77,8 @@ public class SolrFacetConfigAdminPost extends AbstractSolrFacetConfigAdminWebScr json = new JSONObject(new JSONTokener(req.getContent().getContent())); final String filterID = json.getString(PARAM_FILTER_ID); + validateFilterID(filterID); + final String facetQNameStr = json.getString(PARAM_FACET_QNAME); final QName facetQName = QName.createQName(facetQNameStr); final String displayName = json.getString(PARAM_DISPLAY_NAME);