Problem ReleaseNotes.Code.ReleaseNoteTemplate carries Velocity in both its title and its content:
ReleaseNotes.Code.HomeReleaseNotes copies that title and content verbatim onto each release note it creates, so every release note needs script right for its own title to render. Today it usually gets it by accident: the release note's content author ends up being the author of the creating script rather than the user who filled the form. When it does not — a user holding only edit right whose note is attributed to them — the note displays its title as raw Velocity source, which is the defect RN-79 fixed for the template page itself. This is reproducible on master and predates RN-111. It also blocks RN-111 from finishing the job. Enforcing required rights on a page caps the rights of everything it {}{{include{}}}s and forces enforcement onto every document its script saves, so ReleaseNotes.WebHome, ReleaseNotes.Data.WebHome, Code.HomeReleaseNotes and Code.ReleaseNoteTemplate had to be left as the four pages of the application that do not declare their required rights. Declaring script on the template instead would make script right a condition of editing a release note, which contradicts RN-30. Fix Make a release note need no rights of its own:
- have Code.HomeReleaseNotes set a resolved title on the page it creates ("Release Notes for
$product $version") instead of copying the template's Velocity title;
- take the {}{{velocity{}}} out of the template's heading, either by substituting the product name
into the copied content at creation time or by leaving a plain placeholder next to the <version - 1> one already there.
Then the four remaining pages can enforce their required rights too, and a user holding only edit right can author a release note whose content cannot execute script at all. Mind the upgrade path: Code.ReleaseNoteTemplate is a customizable XAR entry, so an install that has edited its template keeps the edited one. Such a template still needs script right, and once the four pages enforce, the notes created from it would render its Velocity as source. That needs a release-note entry, and possibly for Code.HomeReleaseNotes to keep copying the template's required rights (RN-68) for exactly that case. |