Fix for SF bug [1896225] HTML tags not stripped in statistics display

git-svn-id: http://scm.dspace.org/svn/repo/branches/dspace-1_5_x@3341 9c30dcfa-912a-0410-8fc2-9e0234be79fd

dspace-api/src/main/java/org/dspace/app/statistics/HTMLReport.java

@@ -429,7 +429,7 @@ public class HTMLReport implements Report
                 frag.append("<a href=\"" + stats[i].getReference() + "\" ");
                 frag.append("target=\"_blank\">");
             }
-            frag.append(stats[i].getKey());
+            frag.append(this.clean(stats[i].getKey()));
             if (stats[i].getReference() != null)
             {
                 frag.append("</a>");
@@ -506,5 +506,19 @@ public class HTMLReport implements Report
     {
         return "";
     }
+
+    /**
+     * Clean Stirngs for display in HTML
+     *
+     * @param s The String to clean
+     * @return The cleaned String
+     */
+    private String clean(String s)
+    {
+        // Clean up the statistics keys
+        s = s.replace("<", "&lt;");
+        s = s.replaceAll(">", "&gt;");
+        return s;
+    }
     
 }

dspace/CHANGES

@@ -3,6 +3,7 @@
  - Enable ldap.login.specialgroup special group for all LDAP users
  - Fix for SF bug [2164955] DSpace1.5.1(XML) problem with Login to restricted bitstreams
  - Fix for SF bug [2343281] XHTML Head Dissimination Crosswalk exposes provenance info
+ - Fix for SF bug [1896225] HTML tags not stripped in statistics display
 
 (Stuart Lewis / Chris Yates / Flavio Botelho / Alex Barbieri / Reuben Pasquini)
  - [2057378] Hierarchical LDAP support