Problem Editing the wiki dashboard (Dashboard.WebHome) shows the required rights warning ("Editing this page may result in the execution of currently disabled scripts that could be malicious.") with a "Force editing" button to every user who doesn't have script right. These users have to confirm a warning about a script they don't modify each time they edit the dashboard. The warning comes from the {{velocity}} macro in the content of the page, which decides whether to display the personal dashboard of the current user or the wiki dashboard. Editing the dashboard only modifies the XWiki.GadgetClass objects of the page, not its content: the content author doesn't change and the script keeps working. But the edit confirmation can't know what the edit sheet allows to modify, so it always warns about the content. Proposed solution Move the script code out of the content of Dashboard.WebHome into a separate technical page, and either bind that page as the sheet of Dashboard.WebHome (it already has an empty XWiki.DocumentSheetBinding object) or call it with the {{display}} macro from the content. The content of Dashboard.WebHome then doesn't require script right anymore and editing the dashboard doesn't display the warning. Once this is done, remove the "Force editing" step from DashboardIT#editDashboard, which was added for XWIKI-24822 when the docker tests started to see this warning. |
