Branch: refs/heads/stable-17.10.x Home: https://github.com/xwiki/xwiki-platform Commit: 003c500a39bba61d0674d594683dba8978b6fc32 https://github.com/xwiki/xwiki-platform/commit/003c500a39bba61d0674d594683db... Author: Simon Urli <[email protected]> Date: 2026-10-07 (Wed, 07 Oct 2026) Changed paths: M xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/web/SkinAction.java M xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/web/SkinActionTest.java Log Message: ----------- XWIKI-24730: Check the authors' script right before evaluating skin files * Evaluate the Velocity of XWikiSkins object properties only when the effective metadata author of the document has script right on it * Evaluate the Velocity of attachments with the rights of the attachment's author, and only when both that author and the effective metadata author of the document have script right on it * Don't evaluate any Velocity from a restricted document * Inject the components used by SkinAction instead of looking them up Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> (cherry picked from commit 199697127821a4b297690e0be721a74133eb4afc) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications