Details
-
Improvement
-
Resolution: Unresolved
-
Major
-
None
-
18.7.0
-
None
-
None
-
Unknown
-
Description
Several occurrences of the html macro in XWiki Standard do not set "clean" to "false", which may cause unnecessary HTML cleaning, except for occurrences wrapping text submitted by users.
For example PageAuthorsUIX:
{{velocity}}
{{html}}
<div id="xdocAuthors">
<div class="xdocCreation"> ## Creation
$services.localization.render('core.footer.creation', [$xwiki.getUserName($doc.creator), $xwiki.formatDate($doc.creationDate)])<br/>
#if($tdoc.realLocale != $doc.realLocale)
$services.localization.render('core.footer.translationCreation', [$tdoc.realLocale, $xwiki.getUserName($tdoc.creator), $xwiki.formatDate($tdoc.creationDate)])<br/>
#end
</div>
</div>
{{/html}}
{{/velocity}}
The HTML is valid and getUserName already escapes XML.