Branch: refs/heads/stable-16.10.x Home: https://github.com/xwiki/xwiki-platform Commit: a00d801dc9afa80a216347ffedd53083de5acb77 https://github.com/xwiki/xwiki-platform/commit/a00d801dc9afa80a216347ffedd53... Author: Michael Hamann <[email protected]> Date: 2026-06-09 (Tue, 09 Jun 2026) Changed paths: M xwiki-platform-core/xwiki-platform-ckeditor/xwiki-platform-ckeditor-plugins/src/main/webjar/xwiki-realtime/plugin.js M xwiki-platform-core/xwiki-platform-edit/xwiki-platform-edit-test/xwiki-platform-edit-test-docker/pom.xml M xwiki-platform-core/xwiki-platform-edit/xwiki-platform-edit-test/xwiki-platform-edit-test-docker/src/test/it/org/xwiki/edit/test/ui/InplaceEditIT.java M xwiki-platform-core/xwiki-platform-edit/xwiki-platform-edit-ui/src/main/resources/XWiki/InplaceEditing.xml M xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/edit.vm M xwiki-platform-core/xwiki-platform-realtime/xwiki-platform-realtime-wiki/xwiki-platform-realtime-wiki-webjar/src/main/webjar/loader.js M xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-requiredrights/xwiki-platform-security-requiredrights-test/xwiki-platform-security-requiredrights-test-docker/src/test/it/org/xwiki/security/requiredrights/test/ui/RequiredRightsIT.java A xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/po/editor/ForceEditLockModal.java A xwiki-platform-core/xwiki-platform-test/xwiki-platform-test-ui/src/main/java/org/xwiki/test/ui/po/editor/ForceEditLockPage.java M xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/edit_macros.vm M xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/inline.vm M xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/test/java/org/xwiki/web/EditMacrosPageTest.java Log Message: ----------- XWIKI-23764: Forcing editing should check a CSRF token * Add a CSRF token check in the edit macros. * Pass the CSRF token as force_token to only authorize the force-parameter and not also all other parameters. * Add a page test for the edit confirmation to check the CSRF token. * Pass the CSRF token in the force link when not present. * Pass the CSRF token in InplaceEditing. * Add page objects for the force edit lock modal and page. * Add integration tests for both inplace and standalone editing. * Load edit.vm in inline.vm so it behaves the same as edit.vm, just with a different default editor. * Don't force the lock in realtime editing as it shouldn't be required (the lock is automatically skipped when joining a realtime session), and the user should see and confirm any other warnings. (cherry picked from commit 34e3dfc6b5339e247d7983f5cbfecb0890dfa133) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications