From a4d6f8ff6618ee58e7704e627c509d15009e045b Mon Sep 17 00:00:00 2001
From: Alex O'Ree <alexoree@apache.org>
Date: Sun, 23 Aug 2026 10:34:50 -0400
Subject: [PATCH] JSPWIKI-1284 see jira for details

---
 jspwiki-war/src/main/webapp/templates/default/PageTab.jsp | 2 +-
 jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp b/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp
index 01e9cb43c9..db27c37473 100644
--- a/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp
+++ b/jspwiki-war/src/main/webapp/templates/default/PageTab.jsp
@@ -47,7 +47,7 @@
   <form action="<wiki:Link format='url' jsp='Wiki.jsp'/>"
         method="get"  accept-charset='UTF-8'>
 
-    <input type="hidden" name="page" value="${param.page}" />
+    <input type="hidden" name="page" value="${fn:escapeXml(param.page)}" />
     <wiki:CsrfProtection/>
     <div class="error center">
       <label>
diff --git a/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp b/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp
index 1f9e00a08a..9a43c3bb22 100644
--- a/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp
+++ b/jspwiki-war/src/main/webapp/templates/default/Sidebar.jsp
@@ -20,6 +20,7 @@
 <%@ taglib uri="http://jspwiki.apache.org/tags" prefix="wiki" %>
 <%@ taglib prefix="c" uri="jakarta.tags.core" %>
 <%@ taglib prefix="fmt" uri="jakarta.tags.fmt" %>
+<%@ taglib prefix="fn" uri="jakarta.tags.functions" %>
 <%@ page import="jakarta.servlet.jsp.jstl.fmt.*" %>
 <fmt:setLocale value="${prefs.Language}" />
 <fmt:setBundle basename="templates.default"/>
@@ -29,8 +30,8 @@
 
   <c:set var="isweblog"><%= ( String )Context.findContext( pageContext ).getPage().getAttribute( /*ATTR_ISWEBLOG*/ "weblogplugin.isweblog" ) %></c:set>
   <c:if test="${isweblog}">
-  <wiki:Calendar pageformat="'${param.page}_blogentry_'ddMMyy'_'" addindex="true"
-                 urlformat="'Wiki.jsp?page=${param.page}&weblog.startDate='ddMMyy'&weblog.days=1'"/>
+  <wiki:Calendar pageformat="'${fn:escapeXml(param.page)}_blogentry_'ddMMyy'_'" addindex="true"
+                 urlformat="'Wiki.jsp?page=${fn:escapeXml(param.page)}&weblog.startDate='ddMMyy'&weblog.days=1'"/>
   </c:if>
 
   <wiki:Permission permission="view">