Index: core/xwiki-velocity/src/main/java/org/xwiki/velocity/internal/DefaultVelocityConfiguration.java =================================================================== --- core/xwiki-velocity/src/main/java/org/xwiki/velocity/internal/DefaultVelocityConfiguration.java (revision 25234) +++ core/xwiki-velocity/src/main/java/org/xwiki/velocity/internal/DefaultVelocityConfiguration.java (working copy) @@ -82,12 +82,17 @@ this.defaultTools.setProperty("regextool", RegexTool.class.getName()); // Default Velocity properties - this.defaultProperties.setProperty("resource.loader", "webapp"); + this.defaultProperties.setProperty("resource.loader", "webapp, string"); this.defaultProperties.setProperty("webapp.resource.loader.class", "org.apache.velocity.tools.view.servlet.WebappLoader"); + this.defaultProperties.setProperty("webapp.resource.loader.cache", Boolean.TRUE.toString()); + this.defaultProperties.setProperty("string.resource.loader.class", + "org.apache.velocity.runtime.resource.loader.StringResourceLoader"); + this.defaultProperties.setProperty("string.resource.loader.cache", Boolean.TRUE.toString()); + this.defaultProperties.setProperty("input.encoding", "UTF-8"); this.defaultProperties.setProperty("velocimacro.messages.on", Boolean.FALSE.toString()); this.defaultProperties.setProperty("resource.manager.logwhenfound", Boolean.FALSE.toString()); - this.defaultProperties.setProperty("velocimacro.permissions.allow.inline.local.scope", "true"); + this.defaultProperties.setProperty("velocimacro.permissions.allow.inline.local.scope", "false"); // Prevents users from writing dangerous Velocity code like using Class.forName or Java threading APIs. this.defaultProperties.setProperty("runtime.introspector.uberspect", "org.xwiki.velocity.introspection.ChainingUberspector"); Index: core/xwiki-velocity/src/main/java/org/xwiki/velocity/internal/DefaultVelocityEngine.java =================================================================== --- core/xwiki-velocity/src/main/java/org/xwiki/velocity/internal/DefaultVelocityEngine.java (revision 25234) +++ core/xwiki-velocity/src/main/java/org/xwiki/velocity/internal/DefaultVelocityEngine.java (working copy) @@ -21,17 +21,20 @@ package org.xwiki.velocity.internal; import java.io.Reader; -import java.io.StringReader; import java.io.Writer; import java.util.Enumeration; import java.util.Properties; +import org.apache.commons.lang.StringUtils; +import org.apache.velocity.Template; import org.apache.velocity.context.Context; import org.apache.velocity.context.InternalContextAdapterImpl; import org.apache.velocity.runtime.RuntimeConstants; import org.apache.velocity.runtime.RuntimeServices; import org.apache.velocity.runtime.log.LogChute; import org.apache.velocity.runtime.parser.node.SimpleNode; +import org.apache.velocity.runtime.resource.loader.StringResourceLoader; +import org.apache.velocity.runtime.resource.util.StringResourceRepository; import org.xwiki.component.annotation.Component; import org.xwiki.component.annotation.InstantiationStrategy; import org.xwiki.component.annotation.Requirement; @@ -101,7 +104,7 @@ // it's used to load resources from the webapp directory in WebapLoader. String resourceLoader = properties.getProperty(RESOURCE_LOADER, velocityProperties.getProperty(RESOURCE_LOADER)); - if (resourceLoader.equals("webapp")) { + if (resourceLoader.contains("webapp")) { ApplicationContext context = this.container.getApplicationContext(); if (context instanceof ServletApplicationContext) { getEngine().setApplicationAttribute("javax.servlet.ServletContext", @@ -153,7 +156,25 @@ public boolean evaluate(Context context, Writer out, String templateName, String source) throws XWikiVelocityException { - return evaluate(context, out, templateName, new StringReader(source)); + if (StringUtils.isBlank(source)) { + // nothing to write to the output + return true; + } + + try { + StringResourceRepository templateRepo = StringResourceLoader.getRepository(); + if (templateRepo.getStringResource(source)==null) { + templateRepo.putStringResource(source, source); + } + + Template template = getEngine().getTemplate(source); + template.merge(context, out); + + return true; + + } catch (Exception e) { + throw new XWikiVelocityException("Failed to evaluate content with id [" + templateName + "]", e); + } } /**