Details
-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
12.6.7, 12.10.3, 13.0
-
None
-
Unknown
-
Description
Steps to reproduce:
- As a user without script right, add a gadget in the "My dashboard" section of the user profile (like a "Page Tree").
- Save the user profile.
Expected result:
The gadget's title is shown as "Page Tree".
Actual result:
The gadget's title is shown as "$services.localization.render('rendering.macro.documentTree.name')".
This is because the user doesn't have script right and as XWIKI-17794 has been fixed, users without script right cannot execute scripts in gadget titles anymore. While this is expected, it is not good that the gadget titles aren't displayed anymore.
Attachments
Issue Links
- is caused by
-
XWIKI-17794 RCE via Gadget title
-
- Closed
-