Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-14247

User without scripting rights can execute velocity/python scripts through velocity/python gadgets in Dashboard WebHome and User Profile dashboard.

    Details

    • Tests:
      Unit
    • Development Priority:
      High
    • Difficulty:
      Easy
    • Documentation:
      N/A
    • Documentation in Release Notes:
      N/A
    • Similar issues:

      Description

      Steps to reproduce:
      1. Create new user.
      2. Deny scripting right for the new user.
      3. Log in with the new user.
      4. Click Dashboard from App Panel
      5. Edit
      6. Add Velocity Gadget and write some code.
      7. Save

      Code is executed.

      The same works for User Profile dashboard.
      The same for Python macro.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                surli Simon Urli
                Reporter:
                aifrim Alexandra Ifrim
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:
                  Date of First Response: