Branch: refs/heads/master Home: https://github.com/xwiki/xwiki-platform Commit: 199697127821a4b297690e0be721a74133eb4afc https://github.com/xwiki/xwiki-platform/commit/199697127821a4b297690e0be721a... Author: Simon Urli <[email protected]> Date: 2026-10-07 (Wed, 07 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/pom.xml M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/web/SkinActionTest.java Log Message: ----------- XWIKI-24730: Check the authors' script right before evaluating skin files * Evaluate the Velocity of XWikiSkins object properties only when the effective metadata author of the document has script right on it * Evaluate the Velocity of attachments with the rights of the attachment's author, and only when both that author and the effective metadata author of the document have script right on it * Don't evaluate any Velocity from a restricted document * Inject the components used by SkinAction instead of looking them up * Raise the oldcore coverage threshold to 0.44 Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications