dhis2-devs team mailing list archive

[noreply@xxxxxxxxxxxxx]

------------------------------------------------------------
revno: 19684
committer: Halvdan Hoem Grelland <halvdanhg@xxxxxxxxx>
branch nick: dhis2
timestamp: Tue 2015-07-21 15:32:26 +0200
message:
  Fixed bug where the message list displayed single conversations senders with a ' ,' prefix. Also fixed potential NP vulnerabilities in getSenderDisplayName().
modified:
  dhis-2/dhis-api/src/main/java/org/hisp/dhis/message/MessageConversation.java


--
lp:dhis2
https://code.launchpad.net/~dhis2-devs-core/dhis2/trunk

Your team DHIS 2 developers is subscribed to branch lp:dhis2.
To unsubscribe from this branch go to https://code.launchpad.net/~dhis2-devs-core/dhis2/trunk/+edit-subscription

=== modified file 'dhis-2/dhis-api/src/main/java/org/hisp/dhis/message/MessageConversation.java'
--- dhis-2/dhis-api/src/main/java/org/hisp/dhis/message/MessageConversation.java	2015-06-08 17:43:26 +0000
+++ dhis-2/dhis-api/src/main/java/org/hisp/dhis/message/MessageConversation.java	2015-07-21 13:32:26 +0000
@@ -280,20 +280,19 @@
     
     public String getSenderDisplayName()
     {
-        boolean hasUser = userFirstname != null || userSurname != null;
-        
-        String displayName = hasUser ? ( userFirstname + " " + userSurname ) : StringUtils.EMPTY;
-        
-        boolean hasLastSender = lastSenderFirstname != null || lastSenderSurname != null;
-
-        String lastSenderName = hasLastSender ? ( lastSenderFirstname + " " + lastSenderSurname ) : StringUtils.EMPTY;
-        
-        if ( hasLastSender && !lastSenderName.equals( displayName ) )
-        {
-            displayName += ", " + lastSenderName;
-        }
-        
-        return StringUtils.trimToNull( StringUtils.substring( displayName, 0, 28 ) );
+        String userDisplayName = getFullNameNullSafe( userFirstname, userSurname );
+        String lastSenderName = getFullNameNullSafe( lastSenderFirstname, lastSenderSurname );
+
+        if ( !userDisplayName.isEmpty() && !lastSenderName.isEmpty() && !userDisplayName.equals( lastSenderName ) )
+        {
+            userDisplayName += ", " + lastSenderName;
+        }
+        else if ( !lastSenderName.isEmpty() )
+        {
+            userDisplayName = lastSenderName;
+        }
+
+        return StringUtils.trimToNull( StringUtils.substring( userDisplayName, 0, 28 ) );
     }
 
     public Set<User> getTopRecipients()
@@ -514,4 +513,14 @@
             messages.addAll( messageConversation.getMessages() );
         }
     }
+
+    // -------------------------------------------------------------------------------------------------------
+    // Supportive methods
+    // -------------------------------------------------------------------------------------------------------
+
+    private String getFullNameNullSafe( String firstName, String surname )
+    {
+        return StringUtils.defaultString( firstName ) +
+            ( StringUtils.isBlank( firstName ) ? StringUtils.EMPTY : " " ) + StringUtils.defaultString( surname );
+    }
 }