Reproduction steps
- Log out, so as to browse as guest
- Visit http://localhost:8080/xwiki/bin/view/Sandbox/
- Look at the HTML source of the page
Expected No realtime editing markup is present, since a guest cannot edit the page and we are not in an edit mode anyway. Actual About 8.5 KB of markup that is only useful while editing is emitted on every page view, for every user including guests:
- the templates realtime-edit-toolbar, realtime-user, realtime-spinner, realtime-status, realtime-version and realtime-warning
- three complete modals: realtime-changeSummaryModal, realtime-version-modal and realtime-leave-modal
- an inline JSON configuration containing the Netflux WebSocket URL and the current user's name and avatar URL
Rendering it also costs a #getUserAvatarURL(...) call and a $services.websocket.url('netflux') call per page view. In addition, /bin/ssx/XWiki/Realtime/Configuration is linked three times in the same page. Analysis Everything comes from a single UI extension in XWiki/Realtime/Configuration.xml, registered on org.xwiki.platform.template.header.after with scope=wiki, which flamingo/global.vm renders for every action. The extension content has no check on $xcontext.action, no hasAccess('edit') check and no guest check — the only conditionals it contains trim individual buttons. For comparison, the in-place editing UI extension uses the same extension point but does guard itself with $xcontext.action == 'view' and $hasEdit, so the mechanism to do this is already available and in use elsewhere. About the three SSX links: two of them are deliberate, because toolbar.js clones the realtime-spinner and realtime-status templates into shadow roots and the stylesheet has to be imported inside each shadow root. The third one is the regular skin extension link in the <head>, emitted because $xwiki.ssx.use() also registers the extension in the per-request list. Only that third one is redundant. Suggested fix Guard the UI extension so that it only renders for the actions where realtime editing can actually start. For the two shadow DOM copies, reference the stylesheet directly instead of re-emitting the skin extension import, so that it is not also added to the page <head>. |
