Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-25466

Editing the wiki dashboard displays a required rights warning to users without script right

    XMLWordPrintable

Details

    • Improvement
    • Resolution: Unresolved
    • Major
    • None
    • 16.10.2, 15.10.16, 16.4.7
    • Dashboard
    • None
    • Unknown

    Description

      Problem

      Editing the wiki dashboard (Dashboard.WebHome) shows the required rights warning ("Editing this page may result in the execution of currently disabled scripts that could be malicious.") with a "Force editing" button to every user who doesn't have script right. These users have to confirm a warning about a script they don't modify each time they edit the dashboard.

      The warning comes from the {{velocity}} macro in the content of the page, which decides whether to display the personal dashboard of the current user or the wiki dashboard. Editing the dashboard only modifies the XWiki.GadgetClass objects of the page, not its content: the content author doesn't change and the script keeps working. But the edit confirmation can't know what the edit sheet allows to modify, so it always warns about the content.

      Proposed solution

      Move the script code out of the content of Dashboard.WebHome into a separate technical page, and either bind that page as the sheet of Dashboard.WebHome (it already has an empty XWiki.DocumentSheetBinding object) or call it with the {{display}} macro from the content. The content of Dashboard.WebHome then doesn't require script right anymore and editing the dashboard doesn't display the warning.

      Once this is done, remove the "Force editing" step from DashboardIT#editDashboard, which was added for XWIKI-24822 when the docker tests started to see this warning.

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              MichaelHamann Michael Hamann
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated: