Details
-
Bug
-
Resolution: Fixed
-
Blocker
-
15.9-rc-1
Description
Steps to reproduce:
- As a user without programming right, add an object of type XWiki.ComponentClass to a page
- Try editing this page as a user with programming right.
Expected result:
There is a warning that editing will grant programming right to the component.
Actual result:
There is no warning.
Note: I'm currently not sure about the security impact. This can be used at best to break some existing component. It is not really possible to actually execute any code this way as this would require a XWiki.ComponentMethodClass with a script macro and for this one the generic required rights analyzer works and triggers warnings when rights are granted. This is created as a security issue mainly to be on the safe side in case on closer analysis we discover an actual security impact.
Attachments
Issue Links
- links to