Details
-
Bug
-
Resolution: Won't Fix
-
Blocker
-
None
-
12.8, 12.6.3, 11.10.11
-
Unknown
-
N/A
-
N/A
-
Description
Hello,
Like I explain on https://forum.xwiki.org/t/regression-issues-on-xwiki-11-10-11-lts/7733/2
Livetable html parameter working well on XWiki 10.11.3 but not on 11.10.11 version.
To test html issue in live table:
- add a property “test” test (test: String) inXWiki.XWikiUsers
- edit a user in object mode: add some html code in “test” property:
<a href="mailto:prenom.nom@no-spam.fr">prenom.nom@no-spam.fr</a>
save it
- in sandbox page, paste this code:
{{velocity}} #set($columns = ["_avatar", "first_name", "last_name", "email","test", "doc.creationDate", "_actions"]) #set($columnsProperties = {"_avatar" : { "type" : "none", "link" : "none", "html" : "true", "sortable":false }, "first_name" : { "type" : "text" , "size" : 20, "link" : "view"}, "last_name" : { "type" : "text", "link" : "view"}, "email" : { "type" : "text", "html" : "true"}, "test" : { "type" : "text", "html" : "true"} }) #set($options = { "className":"XWiki.XWikiUsers", "translationPrefix" : "xe.userdirectory.", "tagCloud" : true, "rowCount": 10}) #livetable("userdirectory" $columns $columnsProperties $options) {{/velocity}}
- display live table display html code none interpreted:
Source code of the page contains something like and not HTML code:
<span class="wikilink"><a href="/bin/view/XWiki/xxxxx">Christoxx xxxx<span class="ServAuteur">SG/xxxx</span></a></span>
Thxs
Attachments
Issue Links
- is related to
-
XWIKI-17374 XSS Cross Site Scripting
- Closed