Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
8.1-milestone-1
Description
Steps to reproduce:
- As a user without script or programming rights, edit your user profile with the object editor (enable the advanced user type first if necessary).
- Add an object of type UIExtensionClass
- Set "Extension Point ID" to org.xwiki.platform.help.tipsPanel
- Set "Extension ID" to org.xwiki.platform.user.test (needs to be unique but otherwise doesn't matter)
- Set "Extension Parameters" to
tip={{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}
- Set "Extension Scope" to "Current User".
- Click "Save & View"
- Open the "Help.TipsPanel" document at <xwiki-host>/xwiki/bin/view/Help/TipsPanel where <xwiki-host> is the URL of your XWiki installation and press refresh repeatedly.
Expected result:
Either, the provided tip is never displayed, or the entered tip is displayed as-is or an error that the user cannot execute Groovy macros is displayed.
Actual result:
At some point, "Hello from groovy!" is displayed. As the displayed tip is selected randomly, this may need many refreshes. This shows that the Groovy macro has been executed and thus demonstrates a privilege escalation from a simple user account to programming rights.
Attachments
Issue Links
- depends on
-
XWIKI-20570 Add support for restricted mode to the context macro
- Closed
-
XWIKI-20592 Introduce a "source" parameter in the context macro
- Closed
- is caused by
-
XWIKI-20604 Refactor tips panel UIX to store the tip in the content instead of a property
- Closed
- relates to
-
XWIKI-20604 Refactor tips panel UIX to store the tip in the content instead of a property
- Closed