Skip to content

Commit 07b9d5a

Browse files
author
Dave Syer
committed
Ensure fragment for menu items is not itself rendered
Formerly there was a "ghost" menu item with no text and no icon because Thymeleaf had not been instructed to remove the fragment definition. This change tidies that up and also removes the use of the "path" variable, which Thymeleaf populates from the current request context, and poses a potential security threat as a result (if users type malicious characters in the URL).
1 parent d173555 commit 07b9d5a

1 file changed

Lines changed: 74 additions & 64 deletions

File tree

‎src/main/resources/templates/fragments/layout.html‎

Lines changed: 74 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1,88 +1,98 @@
11
<!doctype html>
22
<html th:fragment="layout (template, menu)">
33

4-
<head>
4+
<head>
55

6-
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
7-
<meta charset="utf-8">
8-
<meta http-equiv="X-UA-Compatible" content="IE=edge">
9-
<meta name="viewport" content="width=device-width, initial-scale=1">
6+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
7+
<meta charset="utf-8">
8+
<meta http-equiv="X-UA-Compatible" content="IE=edge">
9+
<meta name="viewport" content="width=device-width, initial-scale=1">
1010

11-
<link rel="shortcut icon" type="image/x-icon" th:href="@{/resources/images/favicon.png}">
11+
<link rel="shortcut icon" type="image/x-icon" th:href="@{/resources/images/favicon.png}">
1212

13-
<title>PetClinic :: a Spring Framework demonstration</title>
13+
<title>PetClinic :: a Spring Framework demonstration</title>
1414

15-
<!--[if lt IE 9]>
15+
<!--[if lt IE 9]>
1616
<script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
1717
<script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
1818
<![endif]-->
1919

20-
<link rel="stylesheet" th:href="@{/resources/css/petclinic.css}"/>
20+
<link rel="stylesheet" th:href="@{/resources/css/petclinic.css}" />
2121

22-
</head>
22+
</head>
2323

2424
<body>
2525

2626
<nav class="navbar navbar-default" role="navigation">
27-
<div class="container">
28-
<div class="navbar-header">
29-
<a class="navbar-brand" th:href="@{/}"><span></span></a>
30-
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target="#main-navbar">
31-
<span class="sr-only"><os-p>Toggle navigation</os-p></span>
32-
<span class="icon-bar"></span>
33-
<span class="icon-bar"></span>
34-
<span class="icon-bar"></span>
35-
</button>
36-
</div>
37-
<div class="navbar-collapse collapse" id="main-navbar">
38-
<ul class="nav navbar-nav navbar-right">
39-
40-
<li th:fragment="menuItem (path,active,title,glyph,text)" class="active" th:class="${active==menu ? 'active' : ''}">
41-
<a th:href="@{__${path}__}" th:title="${title}">
42-
<span th:class="'glyphicon glyphicon-'+${glyph}" class="glyphicon glyphicon-home" aria-hidden="true"></span>
43-
<span th:text="${text}">Template</span>
44-
</a>
45-
</li>
46-
47-
<li th:replace="::menuItem ('/','home','home page','home','Home')">
48-
<span class="glyphicon glyphicon-home" aria-hidden="true"></span>
49-
<span>Home</span>
50-
</li>
51-
52-
<li th:replace="::menuItem ('/owners/find','owners','find owners','search','Find owners')">
53-
<span class="glyphicon glyphicon-search" aria-hidden="true"></span>
54-
<span>Find owners</span>
55-
</li>
56-
57-
<li th:replace="::menuItem ('/vets.html','vets','veterinarians','th-list','Veterinarians')">
58-
<span class="glyphicon glyphicon-th-list" aria-hidden="true"></span>
59-
<span>Veterinarians</span>
60-
</li>
61-
62-
<li th:replace="::menuItem ('/oups','error','trigger a RuntimeException to see how it is handled','warning-sign','Error')">
63-
<span class="glyphicon glyphicon-warning-sign" aria-hidden="true"></span>
64-
<span>Error</span>
65-
</li>
66-
67-
</ul>
68-
</div>
27+
<div class="container">
28+
<div class="navbar-header">
29+
<a class="navbar-brand" th:href="@{/}"><span></span></a>
30+
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target="#main-navbar">
31+
<span class="sr-only">
32+
<os-p>Toggle navigation</os-p>
33+
</span>
34+
<span class="icon-bar"></span>
35+
<span class="icon-bar"></span>
36+
<span class="icon-bar"></span>
37+
</button>
38+
</div>
39+
<div class="navbar-collapse collapse" id="main-navbar">
40+
41+
<ul class="nav navbar-nav navbar-right" th:remove="all">
42+
43+
<li th:fragment="menuItem (link,active,title,glyph,text)" class="active"
44+
th:class="${active==menu ? 'active' : ''}">
45+
<a th:href="@{__${link}__}" th:title="${title}">
46+
<span th:class="'glyphicon glyphicon-'+${glyph}" class="glyphicon glyphicon-home"
47+
aria-hidden="true"></span>
48+
<span th:text="${text}">Template</span>
49+
</a>
50+
</li>
51+
52+
</ul>
53+
54+
<ul class="nav navbar-nav navbar-right">
55+
56+
<li th:replace="::menuItem ('/','home','home page','home','Home')">
57+
<span class="glyphicon glyphicon-home" aria-hidden="true"></span>
58+
<span>Home</span>
59+
</li>
60+
61+
<li th:replace="::menuItem ('/owners/find','owners','find owners','search','Find owners')">
62+
<span class="glyphicon glyphicon-search" aria-hidden="true"></span>
63+
<span>Find owners</span>
64+
</li>
65+
66+
<li th:replace="::menuItem ('/vets.html','vets','veterinarians','th-list','Veterinarians')">
67+
<span class="glyphicon glyphicon-th-list" aria-hidden="true"></span>
68+
<span>Veterinarians</span>
69+
</li>
70+
71+
<li
72+
th:replace="::menuItem ('/oups','error','trigger a RuntimeException to see how it is handled','warning-sign','Error')">
73+
<span class="glyphicon glyphicon-warning-sign" aria-hidden="true"></span>
74+
<span>Error</span>
75+
</li>
76+
77+
</ul>
6978
</div>
79+
</div>
7080
</nav>
7181
<div class="container-fluid">
72-
<div class="container xd-container">
73-
74-
<th:block th:include="${template}"/>
75-
76-
<br/>
77-
<br/>
78-
<div class="container">
79-
<div class="row">
80-
<div class="col-12 text-center">
81-
<img src="../static/resources/images/spring-pivotal-logo.png" th:src="@{/resources/images/spring-pivotal-logo.png}"
82-
alt="Sponsored by Pivotal"/></div>
83-
</div>
82+
<div class="container xd-container">
83+
84+
<th:block th:include="${template}" />
85+
86+
<br />
87+
<br />
88+
<div class="container">
89+
<div class="row">
90+
<div class="col-12 text-center">
91+
<img src="../static/resources/images/spring-pivotal-logo.png"
92+
th:src="@{/resources/images/spring-pivotal-logo.png}" alt="Sponsored by Pivotal" /></div>
8493
</div>
8594
</div>
95+
</div>
8696
</div>
8797

8898
<script th:src="@{/webjars/jquery/jquery.min.js}"></script>

0 commit comments

Comments
 (0)