Hi devs, $xwiki.parseMessage is used to parse velocity located in a translation message. Thing it for me it's very bad (bad design and very bad for performances and most of all for security) to have velocity in translation messages which makes $xwiki.parseMessage useless and some other would say a security hole (see http://jira.xwiki.org/jira/browse/XWIKI-5684). So I propose to deprecate it in 2.7 to make sure we don't use that anymore. WDYT ?

-- Thomas Mortagne

Hi devs, $xwiki.parseMessage is used to parse velocity located in a translation message. Thing it for me it's very bad (bad design and very bad for performances and most of all for security) to have velocity in translation messages which makes $xwiki.parseMessage useless and some other would say a security hole (see http://jira.xwiki.org/jira/browse/XWIKI-5684). So I propose to deprecate it in 2.7 to make sure we don't use that anymore. WDYT ? -- Thomas Mortagne _______________________________________________ devs mailing list devs(a)xwiki.org http://lists.xwiki.org/mailman/listinfo/devs

Hi devs, $xwiki.parseMessage is used to parse velocity located in a translation message. Thing it for me it's very bad (bad design and very bad for performances and most of all for security) to have velocity in translation messages which makes $xwiki.parseMessage useless and some other would say a security hole (see http://jira.xwiki.org/jira/browse/XWIKI-5684). So I propose to deprecate it in 2.7 to make sure we don't use that anymore. WDYT ?

Hi devs, $xwiki.parseMessage is used to parse velocity located in a translation message. Thing it for me it's very bad (bad design and very bad for performances and most of all for security) to have velocity in translation messages which makes $xwiki.parseMessage useless and some other would say a security hole (see http://jira.xwiki.org/jira/browse/XWIKI-5684). So I propose to deprecate it in 2.7 to make sure we don't use that anymore. WDYT ? -- Thomas Mortagne