Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-11201

Users can render the User Directory non-functional by editing their profile

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Duplicate
    • Affects Version/s: 6.1
    • Fix Version/s: None
    • Component/s: User - User Directory
    • Labels:
      None
    • Similar issues:

      Description

      If a prankster edits ones own profile and e.g. sets last name to

      {{velocity}}

      the User Directory will fail to produce results as soon as the user would have been shown; the AJAX-reponse shows something like:

      {"reqNo":3,"matchingtags":{},"tags":[],"totalrows":3,"returnedrows":3,"offset":1,"rows":[{"doc_viewable":true,"doc_name":"Admin","doc_fullName":"xwiki:XWiki.Admin","doc_space":"XWiki","doc_url":"/xwiki/bin/view/XWiki/Admin","doc_space_url":"/xwiki/bin/view/XWiki/","doc_wiki":"xwiki","doc_wiki_url":"/xwiki/bin/view/Main/","doc_hasadmin":true,"doc_hasedit":true,"doc_hasdelete":true,"doc_hasrename":true,"doc_hasrights":true,"doc_edit_url":"/xwiki/bin/edit/XWiki/Admin","doc_copy_url":"/xwiki/bin/view/XWiki/Admin?xpage=copy","doc_delete_url":"/xwiki/bin/delete/XWiki/Admin","doc_rename_url":"/xwiki/bin/view/XWiki/Admin?xpage=rename&step=1","doc_rights_url":"/xwiki/bin/edit/XWiki/Admin?editor=rights","doc_author_url":"/xwiki/bin/view/XWiki/Admin","doc_date":"2014/10/09 14:53","doc_title":"Profile of Administrator Failed to execute the [velocity] macro org.xwiki.rendering.macro.MacroExecutionException: Nested scripts are not allowed
      	at org.xwiki.rendering.macro.script.AbstractScriptMacro.execute(AbstractScriptMacro.java:178)
      	at org.xwiki.rendering.macro.script.AbstractScriptMacro.execute(AbstractScriptMacro.java:58)
      	at org.xwiki.rendering.internal.transformation.macro.MacroTransformation.transformOnce(MacroTransformation.java:200)
      	at org.xwiki.rendering.internal.transformation.macro.MacroTransformation.transform(MacroTransformation.java:140)
      	at org.xwiki.rendering.internal.transformation.DefaultRenderingContext.transformInContext(DefaultRenderingContext.java:175)
      	at org.xwiki.rendering.internal.transformation.DefaultTransformationManager.performTransformations(DefaultTransformationManager.java:94)
      	at org.xwiki.display.internal.DocumentContentDisplayer.display(DocumentContentDisplayer.java:252)
      	at org.xwiki.display.internal.DocumentContentDisplayer.display(DocumentContentDisplayer.java:125)
      	at org.xwiki.display.internal.DocumentContentDisplayer.display(DocumentContentDisplayer.java:55)
      	at org.xwiki.display.internal.DefaultDocumentDisplayer.display(DefaultDocumentDisplayer.java:80)
      	at org.xwiki.display.internal.DefaultDocumentDisplayer.display(DefaultDocumentDisplayer.java:38)
      	at org.xwiki.sheet.internal.SheetDocumentDisplayer.display(SheetDocumentDisplayer.java:113)
      	at org.xwiki.sheet.internal.SheetDocumentDisplayer.display(SheetDocumentDisplayer.java:50)
      	at org.xwiki.display.internal.ConfiguredDocumentDisplayer.display(ConfiguredDocumentDisplayer.java:67)
      	at org.xwiki.display.internal.ConfiguredDocumentDisplayer.display(ConfiguredDocumentDisplayer.java:41)
      	at com.xpn.xwiki.doc.XWikiDocument.getRenderedContent(XWikiDocument.java:981)
      	at com.xpn.xwiki.doc.XWikiDocument.getRenderedContent(XWikiDocument.java:960)
      	at com.xpn.xwiki.api.Document.getRenderedContent(Document.java:663)
      	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
      	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      	at java.lang.reflect.Method.invoke(Method.java:606)
      	at org.apache.velocity.util.introspection.UberspectImpl$VelMethodImpl.doInvoke(UberspectImpl.java:395)
      	at org.apache.velocity.util.introspection.UberspectImpl$VelMethodImpl.invoke(UberspectImpl.java:384)
      	at org.apache.velocity.runtime.parser.node.ASTMethod.execute(ASTMethod.java:173)
      	at org.apache.velocity.runtime.parser.node.ASTReference.execute(ASTReference.java:280)
      	at org.apache.velocity.runtime.parser.node.ASTReference.render(ASTReference.java:369)
      	at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
      	at org.apache.velocity.runtime.parser.node.ASTIfStatement.render(ASTIfStatement.java:87)
      	at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:342)
      	at org.xwiki.velocity.internal.DefaultVelocityEngine.evaluate(DefaultVelocityEngine.java:228)
      	at org.xwiki.velocity.internal.DefaultVelocityEngine.evaluate(DefaultVelocityEngine.java:187)
      	at com.xpn.xwiki.render.XWikiVelocityRenderer.evaluate(XWikiVelocityRenderer.java:131)
      	at com.xpn.xwiki.internal.template.DefaultPrivilegedTemplateRenderer.evaluate(DefaultPrivilegedTemplateRenderer.java:147)
      	at com.xpn.xwiki.internal.template.DefaultPrivilegedTemplateRenderer.evaluateTemplate(DefaultPrivilegedTemplateRenderer.java:84)
      	at com.xpn.xwiki.XWiki.evaluateTemplate(XWiki.java:1622)
      	at com.xpn.xwiki.XWiki.parseTemplate(XWiki.java:1562)
      	at com.xpn.xwiki.api.XWiki.parseTemplate(XWiki.java:801)
      

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                camil7 Clemens Robbenhaar
                Reporter:
                camil7 Clemens Robbenhaar
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Date of First Response: