From 022df1891d28fda903535ff447551fa274b287e2 Mon Sep 17 00:00:00 2001
From: Victor Saisa Lopez <victor@colosa.com>
Date: Fri, 27 Feb 2015 12:35:57 -0400
Subject: [PATCH 1/2] PM-1610 "Designer: Es posible crear 'Procesos' con
 caracteres..." SOLVED

Issue:
    Designer: Es posible crear 'Procesos' con caracteres especiales
    como <script>alert('Hey there!');</script>
Cause:
    En Front-end no se esta validando este campo
    cuando se ingresa texto con el tag <script>
Solution:
    Se ha agregado validacion para este campo,
    para impedir el ingreso de tags "<script>", "<iframe>"
---
 workflow/engine/templates/processes/main.js | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/workflow/engine/templates/processes/main.js b/workflow/engine/templates/processes/main.js
index 271be285b..5fb2d0669 100755
--- a/workflow/engine/templates/processes/main.js
+++ b/workflow/engine/templates/processes/main.js
@@ -32,6 +32,15 @@ new Ext.KeyMap(document, {
   }
 });
 
+Ext.apply(Ext.form.VTypes, {
+    processTitle: function (value, field)
+    {
+        var strAux = "a|applet|b|body|br|button|code|div|em|embed|form|frame|frameset|head|header|html|iframe|img|input|noscript|object|script|select|style|table|textarea";
+
+        return !(eval("/^.*\\x3C[\\s\\x2F]*(?:" + strAux + ")\\s*.*\\x3E.*$/").test(value));
+    },
+    processTitleText: ""
+});
 
 Ext.onReady(function(){
   Ext.state.Manager.setProvider(new Ext.state.CookieProvider());
@@ -520,7 +529,8 @@ function newProcess(params)
         xtype:'textfield',
         width: 260,
         maskRe: /^(?!^(PRN|AUX|CLOCK\$|NUL|CON|COM\d|LPT\d|\...*)(\..+)?$)[^\x00-\x1f\\?*\";|/]+$/i,
-        allowBlank: false
+        allowBlank: false,
+        vtype: "processTitle"
       },  {
         id: 'PRO_DESCRIPTION',
         fieldLabel: _('ID_DESCRIPTION'),

From 2e58046c8a8103b4cbb14bec5a52bb475ea18b5b Mon Sep 17 00:00:00 2001
From: Victor Saisa Lopez <victor@colosa.com>
Date: Fri, 27 Feb 2015 13:16:41 -0400
Subject: [PATCH 2/2] PM-1610 "Designer: Es posible crear 'Procesos' con
 caracteres..." SOLVED

Issue:
    Designer: Es posible crear 'Procesos' con caracteres especiales
    como <script>alert('Hey there!');</script>
Cause:
    En Front-end no se esta validando este campo
    cuando se ingresa texto con el tag <script>
Solution:
    Se ha agregado validacion para este campo,
    para impedir el ingreso de tags "<script>", "<iframe>"
---
 workflow/engine/templates/processes/main.js | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/workflow/engine/templates/processes/main.js b/workflow/engine/templates/processes/main.js
index 5fb2d0669..baab76ea3 100755
--- a/workflow/engine/templates/processes/main.js
+++ b/workflow/engine/templates/processes/main.js
@@ -33,13 +33,13 @@ new Ext.KeyMap(document, {
 });
 
 Ext.apply(Ext.form.VTypes, {
-    processTitle: function (value, field)
+    textWithoutTags: function (value, field)
     {
         var strAux = "a|applet|b|body|br|button|code|div|em|embed|form|frame|frameset|head|header|html|iframe|img|input|noscript|object|script|select|style|table|textarea";
 
         return !(eval("/^.*\\x3C[\\s\\x2F]*(?:" + strAux + ")\\s*.*\\x3E.*$/").test(value));
     },
-    processTitleText: ""
+    textWithoutTagsText: ""
 });
 
 Ext.onReady(function(){
@@ -530,7 +530,7 @@ function newProcess(params)
         width: 260,
         maskRe: /^(?!^(PRN|AUX|CLOCK\$|NUL|CON|COM\d|LPT\d|\...*)(\..+)?$)[^\x00-\x1f\\?*\";|/]+$/i,
         allowBlank: false,
-        vtype: "processTitle"
+        vtype: "textWithoutTags"
       },  {
         id: 'PRO_DESCRIPTION',
         fieldLabel: _('ID_DESCRIPTION'),