Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-14247

User without scripting rights can execute velocity/python scripts through velocity/python gadgets in Dashboard WebHome and User Profile dashboard.

    XMLWordPrintable

    Details

    • Tests:
      Unit
    • Development Priority:
      High
    • Difficulty:
      Easy
    • Documentation:
      N/A
    • Documentation in Release Notes:
      N/A
    • Similar issues:

      Description

      Steps to reproduce:
      1. Create new user.
      2. Deny scripting right for the new user.
      3. Log in with the new user.
      4. Click Dashboard from App Panel
      5. Edit
      6. Add Velocity Gadget and write some code.
      7. Save

      Code is executed.

      The same works for User Profile dashboard.
      The same for Python macro.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              surli Simon Urli
              Reporter:
              aifrim Alexandra Ifrim
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Date of First Response: