This issue has been created
There is 1 update.
 
 
XWiki Platform / cid:jira-generated-image-avatar-dc09cd22-caa5-4b18-8051-013efd9df3c6 XWIKI-23774 Open

HQL query validation should allow selecting static values with script right

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-e978e025-d3f9-4060-b7e8-386f945aa012 Michael Hamann created this issue on 28/Nov/25 11:35
 
Summary: HQL query validation should allow selecting static values with script right
Issue Type: cid:jira-generated-image-avatar-dc09cd22-caa5-4b18-8051-013efd9df3c6 Improvement
Affects Versions: 17.10.0
Assignee: Unassigned
Components: Old Core
Created: 28/Nov/25 11:35
Priority: cid:jira-generated-image-static-major-f337ea44-f3a3-4ddf-a069-3d3761e877f5 Major
Reporter: Michael Hamann
Description:

Queries like

{{velocity}}
$services.query.hql('select 1 from XWikiDocument').setLimit(1).execute()
{{/velocity}}

should be allowed without programming right. This can be useful if you're, e.g., just interested if a certain value exists in a database table without selecting any actual data from the table. It shouldn't be possible to learn anything about the data in the database tables that you cannot also learn from an inner join with that table which is already allowed.

 
 

1 update

 
cid:jira-generated-image-avatar-e978e025-d3f9-4060-b7e8-386f945aa012 Changes by Michael Hamann on 28/Nov/25 11:35
 
Assignee: Michael Hamann