From 3f5e0b57cd73d94c13ba591e230720d3e175537f Mon Sep 17 00:00:00 2001
From: Elia Mezzano <elia.mezzano@realt.it>
Date: Wed, 2 Sep 2026 18:20:40 +0200
Subject: [PATCH] Multiple request parameters: - managed in PageURL - exposed
 in freemarker - fixed bug in XSSRequestWrapper - enhanced URLTag with
 excludeParameters parametrized

---
 .../services/url/AbstractURLManager.java      |  9 ++-
 .../aps/system/services/url/PageURL.java      |  8 ++-
 engine/src/main/tld/aps-core.tld              |  2 +-
 .../aps/servlet/ControllerServlet.java        |  1 +
 .../RequestParameterValuesHashModel.java      | 72 +++++++++++++++++++
 .../aps/servlet/XSSRequestWrapper.java        |  6 +-
 6 files changed, 93 insertions(+), 5 deletions(-)
 create mode 100644 portal-ui/src/main/java/org/entando/entando/aps/servlet/RequestParameterValuesHashModel.java

diff --git a/engine/src/main/java/com/agiletec/aps/system/services/url/AbstractURLManager.java b/engine/src/main/java/com/agiletec/aps/system/services/url/AbstractURLManager.java
index 05169d45a2..a4590a8021 100644
--- a/engine/src/main/java/com/agiletec/aps/system/services/url/AbstractURLManager.java
+++ b/engine/src/main/java/com/agiletec/aps/system/services/url/AbstractURLManager.java
@@ -71,7 +71,14 @@ protected String createQueryString(Map<String, String> params, boolean escapeAmp
 			String paramSeparator = escapeAmp ? "&amp;" : "&";
 			while (keyIter.hasNext()) {
 				String name = keyIter.next();
-				buf.append(this.encodeParam(name)).append("=").append(this.encodeParam(params.get(name)));
+				String encodeName = this.encodeParam(name);
+				String[] paramValues = params.get(name).split(PageURL.PARAMETERS_SEAPARATOR);
+				for (int i = 0; i < paramValues.length; i++ ) {
+					buf.append(encodeName).append("=").append(this.encodeParam(paramValues[i]));
+					if (i < paramValues.length -1) {
+						buf.append(paramSeparator);
+					}
+				}
 				if (index != params.size()) {
 					buf.append(paramSeparator);
 					index++;
diff --git a/engine/src/main/java/com/agiletec/aps/system/services/url/PageURL.java b/engine/src/main/java/com/agiletec/aps/system/services/url/PageURL.java
index ef8ed4b9d9..6adbcaec77 100644
--- a/engine/src/main/java/com/agiletec/aps/system/services/url/PageURL.java
+++ b/engine/src/main/java/com/agiletec/aps/system/services/url/PageURL.java
@@ -21,6 +21,7 @@
 import java.util.List;
 import java.util.Map;
 import jakarta.servlet.http.HttpServletRequest;
+import org.apache.commons.lang3.StringUtils;
 
 /**
  * Rappresenta un URL ad una pagina del sistema. Oggetti di questa classe
@@ -141,7 +142,9 @@ public void setParamRepeat(List<String> parametersToExclude) {
 		if (null != paramsMap && !paramsMap.isEmpty()) {
 			for(String key : paramsMap.keySet()) {
 				if (null == parametersToExclude || !parametersToExclude.contains(key)) {
-					this.addParam(key, req.getParameter(key));
+					String[] values = req.getParameterValues(key);
+					String fullString = StringUtils.join(values, PARAMETERS_SEAPARATOR);
+					this.addParam(key, fullString);
 				}
 			}
 		}
@@ -170,5 +173,6 @@ public void setBaseUrlMode(String baseUrlMode) {
 	private Map<String, String> params;
 	
 	private boolean escapeAmp = true;
-	
+	public static final String PARAMETERS_SEAPARATOR = "__ENTANDO_PARAM_SEP__";
+
 }
diff --git a/engine/src/main/tld/aps-core.tld b/engine/src/main/tld/aps-core.tld
index edfde32559..9c93da0ac7 100644
--- a/engine/src/main/tld/aps-core.tld
+++ b/engine/src/main/tld/aps-core.tld
@@ -694,7 +694,7 @@
 				Used only when paramRepeat="true".]]></description>
 			<name>excludeParameters</name>
 			<required>no</required>
-			<rtexprvalue>false</rtexprvalue>
+			<rtexprvalue>true</rtexprvalue>
 		</attribute>
 		<attribute>
 			<description><![CDATA[Override of the configuration of baseUrl mode.
diff --git a/portal-ui/src/main/java/org/entando/entando/aps/servlet/ControllerServlet.java b/portal-ui/src/main/java/org/entando/entando/aps/servlet/ControllerServlet.java
index af1af32f0c..4aab87342e 100644
--- a/portal-ui/src/main/java/org/entando/entando/aps/servlet/ControllerServlet.java
+++ b/portal-ui/src/main/java/org/entando/entando/aps/servlet/ControllerServlet.java
@@ -156,6 +156,7 @@ protected TemplateModel createModel(ObjectWrapper wrapper, ServletContext servle
 		TemplateModel template = super.createModel(wrapper, servletContext, request, response);
 		if (template instanceof AllHttpScopesHashModel) {
 			AllHttpScopesHashModel hashModel = ((AllHttpScopesHashModel) template);
+			hashModel.put("RequestParameterValues", new RequestParameterValuesHashModel(request, wrapper));
 			ServletContextHashModel servletContextModel = (ServletContextHashModel) hashModel.get(KEY_APPLICATION);
 			if (null == servletContextModel.getServlet()) {
 				ServletContextHashModel newServletContextModel = new ServletContextHashModel(this, wrapper);
diff --git a/portal-ui/src/main/java/org/entando/entando/aps/servlet/RequestParameterValuesHashModel.java b/portal-ui/src/main/java/org/entando/entando/aps/servlet/RequestParameterValuesHashModel.java
new file mode 100644
index 0000000000..98ddd1f93d
--- /dev/null
+++ b/portal-ui/src/main/java/org/entando/entando/aps/servlet/RequestParameterValuesHashModel.java
@@ -0,0 +1,72 @@
+package org.entando.entando.aps.servlet;
+
+import freemarker.template.*;
+import jakarta.servlet.http.HttpServletRequest;
+import java.util.ArrayList;
+import java.util.Enumeration;
+import java.util.Iterator;
+import java.util.List;
+
+public class RequestParameterValuesHashModel implements TemplateHashModelEx {
+
+    private final HttpServletRequest request;
+    private final ObjectWrapper wrapper;
+    private List keys;
+
+    public RequestParameterValuesHashModel(HttpServletRequest request, ObjectWrapper wrapper) {
+        this.request = request;
+        this.wrapper = wrapper;
+    }
+
+    @Override
+    public TemplateModel get(String key) throws TemplateModelException {
+        String[] value = this.request.getParameterValues(key);
+        return value == null ? null : wrapper.wrap(request.getParameterValues(key));
+    }
+
+    @Override
+    public boolean isEmpty() throws TemplateModelException {
+        return !this.request.getParameterNames().hasMoreElements();
+    }
+
+    @Override
+    public int size() {
+        return this.getKeys().size();
+    }
+
+    @Override
+    public TemplateCollectionModel keys() {
+        return new SimpleCollection(this.getKeys().iterator());
+    }
+
+    @Override
+    public TemplateCollectionModel values() {
+        final Iterator iter = this.getKeys().iterator();
+        return new SimpleCollection(new Iterator() {
+            public boolean hasNext() {
+                return iter.hasNext();
+            }
+
+            public Object next() {
+                return RequestParameterValuesHashModel.this.request.getParameterValues((String) iter.next());
+            }
+
+            public void remove() {
+                throw new UnsupportedOperationException();
+            }
+        });
+    }
+
+    private synchronized List getKeys() {
+        if (this.keys == null) {
+            this.keys = new ArrayList();
+            Enumeration enumeration = this.request.getParameterNames();
+
+            while(enumeration.hasMoreElements()) {
+                this.keys.add(enumeration.nextElement());
+            }
+        }
+        return this.keys;
+    }
+
+}
diff --git a/portal-ui/src/main/java/org/entando/entando/aps/servlet/XSSRequestWrapper.java b/portal-ui/src/main/java/org/entando/entando/aps/servlet/XSSRequestWrapper.java
index f281540fc6..54dc8e597d 100644
--- a/portal-ui/src/main/java/org/entando/entando/aps/servlet/XSSRequestWrapper.java
+++ b/portal-ui/src/main/java/org/entando/entando/aps/servlet/XSSRequestWrapper.java
@@ -39,7 +39,7 @@ public String[] getParameterValues(String parameter) {
         int count = values.length;
         String[] encodedValues = new String[count];
         for (int i = 0; i < count; i++) {
-            encodedValues[i] = validatedParameter(values[i]);
+            encodedValues[i] = validateValue(parameter, values[i]);
         }
         return encodedValues;
     }
@@ -56,6 +56,10 @@ public String getHeader(String name) {
 
     private String validatedParameter(String name) {
         String value = super.getParameter(name);
+        return validateValue(name, value);
+    }
+
+    private String validateValue(String name, String value) {
         if (StringUtils.isBlank(value)) {
             return value;
         }