This issue has been created
There are 4 updates.
 
 
XWiki Platform / cid:jira-generated-image-avatar-5b078f47-00aa-436a-a083-14f6ff83cee7 XWIKI-23840 Open

Protected extension documents can be deleted
 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-e88730fd-23c3-4b7f-9f95-d15d0afae81d Max Linger created this issue on 22/Dec/25 09:44
 
Summary: Protected extension documents can be deleted
Issue Type: cid:jira-generated-image-avatar-5b078f47-00aa-436a-a083-14f6ff83cee7 Bug
Affects Versions: 17.4.7
Assignee: Unassigned
Attachments: docker-compose.yml, xwiki.properties
Created: 22/Dec/25 09:44
Priority: cid:jira-generated-image-static-major-35de089a-d00f-49a5-8471-d0a5baf22c61 Major
Reporter: Max Linger
Description:

Reproduction steps:

  1. Download https://github.com/xwiki/xwiki-docker/raw/refs/heads/master/17.4/postgres-tomcat/.env and https://github.com/xwiki/xwiki-docker/raw/refs/heads/master/17.4/postgres-tomcat/docker-compose.yml
  2. Overwrite xwiki.properties and add 
    extension.xar.protection=forcedDeny
  1. Start and initialize XWiki with test user and Standard Flavor
  2. Go to http://localhost:8080/bin/view/Help and click "Delete"
  3. Select the Help Application affected by the deletion
  4. Go back to Help page
 
 

4 updates

 
cid:jira-generated-image-avatar-e88730fd-23c3-4b7f-9f95-d15d0afae81d Changes by Max Linger on 22/Dec/25 09:48
 
Description: I think this bug could apply to other configuration options of extension.xar.protection too.

 Reproduction steps:
# Download [ https://github.com/xwiki/xwiki-docker/raw/refs/heads/master/17.4/postgres-tomcat/.env ] and [https://github.com/xwiki/xwiki-docker/raw/refs/heads/master/17.4/postgres-tomcat/docker-compose.yml]
# Overwrite xwiki.properties and add
{code:java}
extension.xar.protection=forcedDeny{code}

# Start and initialize XWiki with test user and Standard Flavor
# Go to [http://localhost:8080/bin/view/Help] and click "Delete"
# Select the Help Application affected by the deletion
# Go back to Help page
Assignee: Michael Hamann
Component: Security
Component: Extension - XAR
 
 
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6) Atlassian logo
If image attachments aren't displayed, see this article.