This issue has been created
 
 
Release Notes Application / cid:jira-generated-image-avatar-56b8f31e-c21e-41b7-8f68-1368b15b8d90 RN-112 Open

A release note needs script right because the release note template is written in Velocity

 
View issue   ·   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-416636c5-64dd-4a1c-adb2-355497a24f61 Vincent Massol created this issue on 06/Sep/26 18:58
 
Summary: A release note needs script right because the release note template is written in Velocity
Issue Type: cid:jira-generated-image-avatar-56b8f31e-c21e-41b7-8f68-1368b15b8d90 Improvement
Affects Versions: 2.0
Assignee: Unassigned
Components: Application
Created: 06/Sep/26 18:58
Priority: cid:jira-generated-image-static-major-d99ccd28-6d23-4077-a935-ad368c395934 Major
Reporter: Vincent Massol
Description:

Problem

ReleaseNotes.Code.ReleaseNoteTemplate carries Velocity in both its title and its content:

  • the title is {{#if ("$!doc.getValue('product')" != '')Release Notes for $doc.getValue('product') $doc.getValue('version')# {else}

    Release Note Template#end}}

  • the "New and Noteworthy" heading interpolates the product with {}{{velocity$doc.getValue('product')/velocity{}}}

ReleaseNotes.Code.HomeReleaseNotes copies that title and content verbatim onto each release note
it creates, so every release note needs script right for its own title to render. Today it usually
gets it by accident: the release note's content author ends up being the author of the creating
script rather than the user who filled the form. When it does not — a user holding only edit right
whose note is attributed to them — the note displays its title as raw Velocity source, which is the
defect RN-79 fixed for the template page itself. This is reproducible on master and predates
RN-111.

It also blocks RN-111 from finishing the job. Enforcing required rights on a page caps the rights of
everything it {}{{include{}}}s and forces enforcement onto every document its script saves, so
ReleaseNotes.WebHome, ReleaseNotes.Data.WebHome, Code.HomeReleaseNotes and
Code.ReleaseNoteTemplate had to be left as the four pages of the application that do not declare
their required rights. Declaring script on the template instead would make script right a
condition of editing a release note, which contradicts RN-30.

Fix

Make a release note need no rights of its own:

  • have Code.HomeReleaseNotes set a resolved title on the page it creates ("Release Notes for
    $product $version") instead of copying the template's Velocity title;
  • take the {}{{velocity{}}} out of the template's heading, either by substituting the product name
    into the copied content at creation time or by leaving a plain placeholder next to the
    <version - 1> one already there.

Then the four remaining pages can enforce their required rights too, and a user holding only edit
right can author a release note whose content cannot execute script at all.

Mind the upgrade path: Code.ReleaseNoteTemplate is a customizable XAR entry, so an install
that has edited its template keeps the edited one. Such a template still needs script right, and once
the four pages enforce, the notes created from it would render its Velocity as source. That needs a
release-note entry, and possibly for Code.HomeReleaseNotes to keep copying the template's
required rights (RN-68) for exactly that case.