Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-12447

Skin resources are evaluated with the rights of the current document

    Details

    • Difficulty:
      Unknown
    • Documentation:
      N/A
    • Documentation in Release Notes:
      N/A
    • Similar issues:

      Description

      The skin action currently evaluates parsable resources (.css, .js and, for filesystem, .less files) using the current document as security document. This means that if the current document has PR (like most standard XE xar documents are), the skin resource will be executed with PR.

      On the flipside, this also means that filesystem resources that get resolved to having XWikiGuest (null) as their contentAuthor will never have the Script Rights to evaluate a velocity code that ends up rendering a script (velocity, etc) macro from inside a wiki page for instance.

      This is currently affecting (at least) searchSuggest.js right now and the result is that the list of suggestion sources is not populated.

      The idea is to be consistent with what we do for skin templates (e.g. XWIKI-11202) where if the template is overridden in a skin document (as object or attachment), the skin document's last author is used when checking Script/Programming Rights.

      For skin resources coming directly from the filesystem, the superadmin user should be used for checking rights, since their author can not be verified but the security should be more or less guaranteed by the fact that they are located on the filesystem and not on the wiki.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                enygma Eduard Moraru
                Reporter:
                enygma Eduard Moraru
              • Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 4 hours
                  4h