This issue has been created
 
 
XWiki Platform / cid:jira-generated-image-avatar-28b6acdb-1928-4e93-a529-79760adc1f20 XWIKI-25038 Open

Some XS pages use html macros without setting "clean" to "false"

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-081d9423-3026-46a0-8c41-473a86dd67da slauriere created this issue on 28/Sep/26 14:37
 
Summary: Some XS pages use html macros without setting "clean" to "false"
Issue Type: cid:jira-generated-image-avatar-28b6acdb-1928-4e93-a529-79760adc1f20 Improvement
Affects Versions: 18.7.0
Assignee: Unassigned
Created: 28/Sep/26 14:37
Priority: cid:jira-generated-image-static-major-405d6022-ea51-4f48-90c7-65a36a16b99e Major
Reporter: slauriere
Description:

Several occurrences of the html macro in XWiki Standard do not set "clean" to "false", which may cause unnecessary HTML cleaning, except for occurrences wrapping text submitted by users.

For example PageAuthorsUIX:

{{velocity}}
{{html}}
<div id="xdocAuthors">
<div class="xdocCreation"> ## Creation
    $services.localization.render('core.footer.creation', [$xwiki.getUserName($doc.creator), $xwiki.formatDate($doc.creationDate)])<br/>
    #if($tdoc.realLocale != $doc.realLocale)
      $services.localization.render('core.footer.translationCreation', [$tdoc.realLocale, $xwiki.getUserName($tdoc.creator), $xwiki.formatDate($tdoc.creationDate)])<br/>
    #end
</div>
</div>
{{/html}}
{{/velocity}}

The HTML is valid and getUserName already escapes XML.