Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
1.1 M2
-
Unknown
-
N/A
-
N/A
-
Description
Steps to reproduce:
- As an admin, add the Panels.IncludedDocuments panel on one column
- As a user without script or programming right open your user account (or any other document you can edit with the wiki editor.
- Set the content to
{{display reference="{{cache~}~}{{groovy~}~}println(~"Hello from Groovy~" + ~" in included document!~"){{/groovy~}~}{{/cache~}~}"/}}
.
- Click "Save and continue"
Expected result:
The panel displays
One included page: {{cache}}{{groovy}}println("Hello from Groovy" + " in included document!"){{/groovy}}{{/cache}}
.
Actual result:
The panel displays the text
One included page: XWiki.Hello from Groovy in included document!
This demonstrates a privilege escalation from simple user account to programming rights.
Attachments
Issue Links
- links to