Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-21949

Restrict the execution of script macros during a realtime WYSIWYG editing session

    XMLWordPrintable

Details

    • Integration
    • Unknown
    • N/A

    Description

      Starting with XWIKI-21767 a change in a macro parameter / content triggers a re-rendering of the macro output for each participant. This creates a security vulnerability: a user without script rights will be able to execute scripts if any other participant has script right because whatever script macro they insert will be executed automatically by the rest of the users.

      In order to fix this we could:

      • prevent users with different script/programming level enter the same realtime WYSIWYG editing session
      • or prevent the execution of script macros during a realtime WYSIWYG editing session (but this will remove the WYSIWYG aspect).

      Attachments

        Issue Links

          blocks

          New Feature - A new feature of the product, which has yet to be developed. XWIKI-22128 Enable realtime editing for the WYSIWYG editor by default

          • Major - Major loss of function.
          • Closed
          depends on

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-21767 Dynamic macros are not properly synchronized

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          New Feature - A new feature of the product, which has yet to be developed. XCOMMONS-3052 Add support for implementing Netflux channel bots as components

          • Major - Major loss of function.
          • Closed

          New Feature - A new feature of the product, which has yet to be developed. XWIKI-22222 Add the concept of "request effective author"

          • Major - Major loss of function.
          • Closed
          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-22777 Privilege Escalation via Realtime Collaboration

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            People

              mflorea Marius Dumitru Florea
              mflorea Marius Dumitru Florea
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: