- xwiki-devs@xwiki.org - lists.xwiki.org

[xwiki-devs] filtering by com.xpn.xwiki.objects.LargeStringProperty properties values

by [Ricardo Rodriguez] eBioTIC.

Hi! Caleb and I have been chatting this afternoon about a solution to pass the value of a variable to a query string. Thanks Caleb! Something like this... ##$species is defined simply by... #set($species = '%babo%') ##and the query string is constructed by using + to concatenate stubs including the value of that variable... #set($query = ", BaseObject as obj, StringProperty as prop where doc.fullName = obj.name and obj.className='Users.PdrUserClass' and obj.id=prop.id.id and prop.id.name='Species' and prop.value like '" + $species + "' order by doc.fullName asc") This works great with com.xpn.xwiki.objects.StringProperty properties, but not with com.xpn.xwiki.objects.StringProperty ones. Please, do you know why and what is required to filter by properties of that type? Thanks! Ricardo -- Ricardo Rodríguez CTO eBioTIC. Life Sciences, Data Modeling and Information Management Systems

14 years, 12 months

2
2
0 0

Re: [xwiki-devs] [xwiki-notifications] r31359 - enterprise/trunk/wiki/src/main/resources/Main

by Thomas Mortagne

On Sat, Sep 25, 2010 at 14:50, Thomas Mortagne <thomas.mortagne(a)xwiki.com> wrote: > On Sat, Sep 25, 2010 at 14:44, sdumitriu > <enterprise-notifications(a)xwiki.org> wrote: >> Author: sdumitriu >> Date: 2010-09-25 14:44:23 +0200 (Sat, 25 Sep 2010) >> New Revision: 31359 >> >> Modified: >> enterprise/trunk/wiki/src/main/resources/Main/Spaces.xml >> Log: >> XE-542: Apache proxy breaks icons on the Dashboard. >> Fixed. >> >> Modified: enterprise/trunk/wiki/src/main/resources/Main/Spaces.xml >> =================================================================== >> --- enterprise/trunk/wiki/src/main/resources/Main/Spaces.xml 2010-09-25 09:59:48 UTC (rev 31358) >> +++ enterprise/trunk/wiki/src/main/resources/Main/Spaces.xml 2010-09-25 12:44:23 UTC (rev 31359) >> @@ -191,16 +191,16 @@ >> <div class="spSpaceName">[[${space}>>${space}.WebHome]]</div> >> <div class="xshowonhover spSpaceActions"> >> ## Link to the space index. >> - <a href="$xwiki.getURL('Main.SpaceIndex', 'view', "space=$escapetool.url($space)")" title="$msg.get('xe.spaces.action.index')"> >> - <img src="$xwiki.getSkinFile('icons/silk/book_open.gif')" alt="$msg.get('xe.spaces.action.index.alt')"/> >> + <a href="{{html wiki="false"}}$xwiki.getURL('Main.SpaceIndex', 'view', "space=$escapetool.url($space)"){{/html}}" title="$msg.get('xe.spaces.action.index')"> > > Note that wiki=false is alre (sorry, Gmail shortcuts) Note that wiki=false is already the default > >> + <img src="{{html wiki="false"}}$xwiki.getSkinFile('icons/silk/book_open.gif'){{/html}}" alt="$msg.get('xe.spaces.action.index.alt')"/> >> </a> >> ## If the user has admin right on the space display links to administration and delete. >> #if($xwiki.hasAccessLevel('admin', "${space}.XWikiPreferences")) >> - <a href="$xwiki.getURL("${space}.WebPreferences", 'admin')" title="$msg.get('xe.spaces.action.admin')"> >> - <img src="$xwiki.getSkinFile('icons/silk/cog.gif')" alt="$msg.get('xe.spaces.action.admin.alt')"/> >> + <a href="{{html wiki="false"}}$xwiki.getURL("${space}.WebPreferences", 'admin'){{/html}}" title="$msg.get('xe.spaces.action.admin')"> >> + <img src="{{html wiki="false"}}$xwiki.getSkinFile('icons/silk/cog.gif'){{/html}}" alt="$msg.get('xe.spaces.action.admin.alt')"/> >> </a> >> - ## <a href="#" onclick="confirm('ALL THE PAGES WITHIN THE SPACE &ldquo;${space}&rdquo; WILL BE DELETED, are you sure that you want to continue ?'); this.href='$spaceListDoc.getURL('view', "deleteSpace=${space}&amp;xredirect=$doc.getExternalURL()&amp;form_token=$!{services.csrf.getToken()}")'" title="$msg.get('xe.spaces.action.delete')"> >> - ## <img src="$xwiki.getSkinFile('icons/silk/cross.gif')" alt="$msg.get('xe.spaces.action.delete.alt')" /> >> + ## <a href="#" onclick="confirm('ALL THE PAGES WITHIN THE SPACE &ldquo;${space}&rdquo; WILL BE DELETED, are you sure that you want to continue ?'); this.href='{{html wiki="false"}}$spaceListDoc.getURL('view', "deleteSpace=${space}&amp;xredirect=$doc.getExternalURL()&amp;form_token=$!{services.csrf.getToken()}"){{/html}}'" title="$msg.get('xe.spaces.action.delete')"> >> + ## <img src="{{html wiki="false"}}$xwiki.getSkinFile('icons/silk/cross.gif'){{/html}}" alt="$msg.get('xe.spaces.action.delete.alt')" /> >> ## </a> >> #end >> </div> >> @@ -215,10 +215,10 @@ >> #if($xwiki.hasAdminRights()) >> <li id="spSpaceCreateItem" class="xitem space"> >> <div class="xitemcontainer"> >> - <div id="spSpaceCreateLabel" class="spSpaceName"><a href="$xwiki.getURL('XWiki.CreatePage', 'view', 'tocreate=space')" onclick="toggleClass($('spSpaceCreateForm'), 'hidden'); return false;">$msg.get('xe.spaces.createspace')</a></div> >> + <div id="spSpaceCreateLabel" class="spSpaceName"><a href="{{html wiki="false"}}$xwiki.getURL('XWiki.CreatePage', 'view', 'tocreate=space'){{/html}}" onclick="toggleClass($('spSpaceCreateForm'), 'hidden'); return false;">$msg.get('xe.spaces.createspace')</a></div> >> <div class="spacer">&nbsp;</div> >> <div id="spSpaceCreateForm" class="hidden"> >> - <form method="post" action="$doc.getURL('view', 'xpage=create')"> >> + <form method="post" action="{{html wiki="false"}}$doc.getURL('view', 'xpage=create'){{/html}}"> >> <div> >> <input name="tocreate" type="hidden" value="space" /> >> #set($newSpaceName = $escapetool.xml($msg.get('xe.spaces.createspace.defaultname'))) >> >> _______________________________________________ >> notifications mailing list >> notifications(a)xwiki.org >> http://lists.xwiki.org/mailman/listinfo/notifications >> > > > > -- > Thomas Mortagne > -- Thomas Mortagne

15 years

1
0
0 0

[xwiki-devs] Issue with DBList cache

by Ludovic Dubost

Hi, I've reported bug http://jira.xwiki.org/jira/browse/XWIKI-5525. In my view we should cancel the patch from http://jira.xwiki.org/jira/browse/XWIKI-1725. The context level cache has been made ineffective. This has an impact on LiveTable speeds in particular. Ludovic -- Ludovic Dubost Blog: http://blog.ludovic.org/ XWiki: http://www.xwiki.com Skype: ldubost GTalk: ldubost

15 years

1
0
0 0

[xwiki-devs] [ANN] XWiki Enterprise and XWiki Enterprise Manager 2.4.2 Released

by Thomas Mortagne

The XWiki development team is pleased to announce the release of XWiki Enterprise and XWiki Enterprise Manager 2.4.2. It fixes a critical issue in some applications that fail with the following error: Can't find descriptor for the component xwiki.script.service.Script Service? hint = csrf?] For more information see the Releases notes at: http://www.xwiki.org/xwiki/bin/view/Main/ReleaseNotesXWikiEnterprise242 and http://www.xwiki.org/xwiki/bin/view/Main/ReleaseNotesXEM242 Thanks -The XWiki dev team

15 years

1
1
0 0

[xwiki-devs] [ANN] XWiki Enterprise and XWiki Enterprise Manager 2.4.1 Released

by Thomas Mortagne

The XWiki development team is pleased to announce the release of XWiki Enterprise and XWiki Enterprise Manager 2.4.1. This is a bug fix release for the 2.4 branch. Important Bugs fixed: * XWIKI-5511 - In some conditions a newly created wiki does not have the standard classes * XWIKI-5492 - Can't move the focus outside of the rich text area in Opera * XWIKI-5440 - user.isUserInGroup return false if User in Master and group in virtual * XWIKI-5452 - "cache.path" configuration is not taken into account by JBossCache module * XWIKI-5414 - Keyboard shortcuts are not ignored when trying to navigate with keys in a select input * XWIKI-5391 - MediaWikiScanner#docElements() raises unexpected ParseException when encountering <D_TABLE_CAPTION> tokens * XWIKI-5515 - NPE when accessing an not existing wiki and autowww = 0 * XWIKI-5363 - PeriodFactory#createSinceMonthsPeriod creates a "since weeks" period instead * XWIKI-5476 - Problem with non-px image dimensions in wysiwyg mode only with IE7 * XWIKI-5457 - Propeditor cannot work anymore with recent livetable code * XWIKI-5243 - Reflected XSS in edit(wiki|wysiwyg|wysiwygnew).vm * XWIKI-5450 - SQL injection in suggest.vm * XWIKI-5428 - Save and Continue doesn't validate the mandatory document title * XWIKI-5434 - Saved request parameters are not restored on relogin * XWIKI-5244 - Stored XSS via user/group name * XWIKI-5510 - Text and background color don't match the color themev * XWIKI-5417 - xwiki/2.0 renderer should escape any (% it can find * XWIKI-5453 - includeMacro() no longer works in XE 2.4 * XASEARCH-10 - Escaping issue in Main.DatabaseSearch * XAADMINISTRATION-156 - Cannot add "global" user in groups * XAADMINISTRATION-155 - Improper search icon position in Administration Application * XAADMINISTRATION-168 - Small inconsistency in DOM of some elements that use ConfigurationClass Class For more information see the Releases notes at: http://www.xwiki.org/xwiki/bin/view/Main/ReleaseNotesXWikiEnterprise241 and http://www.xwiki.org/xwiki/bin/view/Main/ReleaseNotesXEM241 Thanks -The XWiki dev team

15 years

1
2
0 0

[xwiki-devs] [Vote] Resize images on the server side to reduce page loading time

by Marius Dumitru Florea

Hi devs, Currently the image plugin [1] allows us to create image thumbnails by specifying the image width and/or height in the query string of the image attachment download URL: /xwiki/bin/download/Spage/Page/image.jpg?width=100 I propose that we: (A) Use the image width and/or height (when they are specified in the image syntax using pixel unit) to resize the image on the server side. For instance: [[image:logo.jpg||width="100px"]] will be linked to /xwiki/bin/download/Spage/Page/logo.jpg?width=100 and [[image:logo.jpg||style="height: 50px; width: 70px"]] will be linked to /xwiki/bin/download/Spage/Page/logo.jpg?width=70&height=50 The image plugin also accepts a quality parameter that controls the compression quality when encoding jpeg images. The default value of this parameter (i.e. when not specified in the URL) is configurable. I propose we use 0.3 by default, 1 representing the best quality. (B) Add the ability to limit the image dimensions (preserving aspect ratio) when the image width and/or height are not specified in the image syntax (or when they are not using pixel unit). The width and height limit will be configurable and -1 by default (i.e. no limitation). For instance: image:logo.jpg will be linked to /xwiki/bin/download/Spage/Page/logo.jpg?width=1024 when width limit is 1024, and to /xwiki/bin/download/Spage/Page/logo.jpg?width=1024&height=768&keepAspectRatio=true when width limit is 1024 and height limit is 768. Note that in this case the image aspect ratio is preserved. The image is resized to best fit the limits. If the user want to bypass the limit he has to specify the image width/height in the image syntax. I'm +1 for both (A) and (B). WDYT? Thanks, Marius [1] http://svn.xwiki.org/svnroot/xwiki/platform/core/trunk/xwiki-core/src/main/…

15 years

6
12
0 0

[xwiki-devs] Extend model service with methods for creating and resolving attachment references

by Marius Dumitru Florea

Hi devs, I created http://jira.xwiki.org/jira/browse/XWIKI-5519 and attached a patch. I'd like to commit this before 2.5M2. Let me know if you don't agree. Thanks, Marius

15 years

1
0
0 0

Re: [xwiki-devs] [xwiki-notifications] r31271 - platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web

by Vincent Massol

Hi Alex, Couldn't we add the check in some Abstract<XXX>XWikiAction where <XXX> qualifies actions that modify data in order to prevent code duplication and in order to prevent forgetting to do the check when people add new actions (at least make it easier)? Thanks -Vincent On Sep 22, 2010, at 11:00 PM, abusenius (SVN) wrote: > Author: abusenius > Date: 2010-09-22 23:00:46 +0200 (Wed, 22 Sep 2010) > New Revision: 31271 > > Modified: > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/AbstractPropChangeAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/CommentAddAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteAttachmentAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteVersionsAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ObjectAddAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ObjectRemoveAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/PropAddAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/PropUpdateAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/RegisterAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ResetVersionsAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/RollbackAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/SaveAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/SaveAndContinueAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/UndeleteAction.java > platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/UploadAction.java > Log: > XWIKI-5464: Added CSRF checks to all actions that modify data > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/AbstractPropChangeAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/AbstractPropChangeAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/AbstractPropChangeAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -55,6 +55,10 @@ > BaseClass xclass = doc.getXClass(); > > if (propertyName != null && xclass.get(propertyName) != null) { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > changePropertyDefinition(xclass, propertyName, context); > } else { > return true; > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/CommentAddAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/CommentAddAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/CommentAddAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -54,6 +54,11 @@ > @Override > public boolean action(XWikiContext context) throws XWikiException > { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > XWiki xwiki = context.getWiki(); > XWikiResponse response = context.getResponse(); > XWikiDocument doc = context.getDoc(); > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -55,6 +55,10 @@ > if (!"1".equals(request.getParameter(CONFIRM_PARAM))) { > return true; > } > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > > String sindex = request.getParameter("id"); > if (sindex != null && xwiki.hasRecycleBin(context)) { > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteAttachmentAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteAttachmentAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteAttachmentAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -46,6 +46,11 @@ > @Override > public boolean action(XWikiContext context) throws XWikiException > { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > XWikiRequest request = context.getRequest(); > XWikiResponse response = context.getResponse(); > XWikiDocument doc = context.getDoc(); > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteVersionsAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteVersionsAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/DeleteVersionsAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -40,21 +40,24 @@ > @Override > public boolean action(XWikiContext context) throws XWikiException > { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > DeleteVersionsForm form = (DeleteVersionsForm) context.getForm(); > - > if (!form.isConfirmed()) { > return true; > } > > Version v1; > Version v2; > - Version rev = form.getRev(); > - if (rev == null) { > + if (form.getRev() == null) { > v1 = form.getRev1(); > v2 = form.getRev2(); > } else { > - v1 = rev; > - v2 = rev; > + v1 = form.getRev(); > + v2 = form.getRev(); > } > > if (v1 != null && v2 != null) { > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ObjectAddAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ObjectAddAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ObjectAddAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -39,6 +39,11 @@ > @Override > public boolean action(XWikiContext context) throws XWikiException > { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > XWiki xwiki = context.getWiki(); > XWikiResponse response = context.getResponse(); > String username = context.getUser(); > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ObjectRemoveAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ObjectRemoveAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ObjectRemoveAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -66,6 +66,11 @@ > @Override > public boolean action(XWikiContext context) throws XWikiException > { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > XWiki xwiki = context.getWiki(); > XWikiResponse response = context.getResponse(); > String username = context.getUser(); > @@ -74,6 +79,7 @@ > if (obj == null) { > return true; > } > + > doc.removeObject(obj); > doc.setAuthor(username); > xwiki.saveDocument(doc, context.getMessageTool().get("core.comment.deleteObject"), true, context); > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/PropAddAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/PropAddAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/PropAddAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -37,6 +37,11 @@ > @Override > public boolean action(XWikiContext context) throws XWikiException > { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > XWiki xwiki = context.getWiki(); > XWikiResponse response = context.getResponse(); > XWikiDocument doc = context.getDoc(); > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/PropUpdateAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/PropUpdateAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/PropUpdateAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -105,6 +105,11 @@ > @Override > public boolean action(XWikiContext context) throws XWikiException > { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > try { > if (propUpdate(context)) { > return true; > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/RegisterAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/RegisterAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/RegisterAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -50,6 +50,11 @@ > > String register = request.getParameter(REGISTER); > if (register != null && register.equals("1")) { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > int useemail = xwiki.getXWikiPreferenceAsInt("use_email_verification", 0, context); > int result; > if (useemail == 1) { > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ResetVersionsAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ResetVersionsAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/ResetVersionsAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -17,6 +17,11 @@ > > String confirm = request.getParameter("confirm"); > if ((confirm != null) && (confirm.equals("1"))) { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > XWikiDocument tdoc = getTranslatedDocument(doc, language, context); > // Do it > tdoc.resetArchive(context); > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/RollbackAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/RollbackAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/RollbackAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -30,6 +30,11 @@ > @Override > public boolean action(XWikiContext context) throws XWikiException > { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > XWiki xwiki = context.getWiki(); > XWikiResponse response = context.getResponse(); > XWikiDocument doc = context.getDoc(); > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/SaveAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/SaveAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/SaveAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -176,6 +176,11 @@ > @Override > public boolean action(XWikiContext context) throws XWikiException > { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > if (save(context)) { > return true; > } > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/SaveAndContinueAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/SaveAndContinueAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/SaveAndContinueAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -43,6 +43,11 @@ > */ > @Override > public boolean action(XWikiContext context) throws XWikiException { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > // Try to find the URL of the edit page which we came from > String back = findBackURL(context); > > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/UndeleteAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/UndeleteAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/UndeleteAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -42,6 +42,11 @@ > @Override > public boolean action(XWikiContext context) throws XWikiException > { > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > XWiki xwiki = context.getWiki(); > XWikiRequest request = context.getRequest(); > XWikiResponse response = context.getResponse(); > > Modified: platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/UploadAction.java > =================================================================== > --- platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/UploadAction.java 2010-09-22 21:00:42 UTC (rev 31270) > +++ platform/core/trunk/xwiki-core/src/main/java/com/xpn/xwiki/web/UploadAction.java 2010-09-22 21:00:46 UTC (rev 31271) > @@ -80,6 +80,11 @@ > } > } > > + // CSRF prevention > + if (!csrfTokenCheck(context)) { > + return false; > + } > + > XWikiDocument doc = (XWikiDocument) context.getDoc().clone(); > > // The document is saved for each attachment in the group.

15 years

2
1
0 0

by Sergiu Dumitriu

On 09/23/2010 12:23 PM, tmortagne (SVN) wrote: > Author: tmortagne > Date: 2010-09-23 12:23:25 +0200 (Thu, 23 Sep 2010) > New Revision: 31277 You should have used a serverside move instead of a local copy, since the sandbox history is now lost. > Added: > platform/core/trunk/xwiki-extension/ > platform/core/trunk/xwiki-extension/pom.xml > platform/core/trunk/xwiki-extension/src/ > platform/core/trunk/xwiki-extension/src/main/ > platform/core/trunk/xwiki-extension/src/main/java/ > platform/core/trunk/xwiki-extension/src/main/java/org/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/CoreExtension.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/Extension.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/ExtensionDependency.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/ExtensionException.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/ExtensionId.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/ExtensionManager.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/ExtensionManagerConfiguration.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/InstallException.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/LocalExtension.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/ResolveException.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/UninstallException.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/ExtensionHandler.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/ExtensionHandlerManager.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/internal/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/internal/AbstractExtensionHandler.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/internal/DefaultExtensionHandlerManager.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/internal/jar/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/internal/jar/DefaultJarExtensionClassLoader.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/internal/jar/JarExtensionClassLoader.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/internal/jar/JarExtensionExecutionContextInitializer.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/internal/jar/JarExtensionHandler.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/install/internal/jar/JarHandlerApplicationStartedListener.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/internal/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/internal/DefaultExtensionManager.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/internal/DefaultExtensionManagerConfiguration.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/internal/DefaultVersionManager.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/internal/VersionManager.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/internal/script/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/internal/script/ExtensionManagerScriptService.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/CoreExtensionRepository.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/ExtensionRepository.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/ExtensionRepositoryException.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/ExtensionRepositoryFactory.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/ExtensionRepositoryId.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/ExtensionRepositoryManager.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/ExtensionRepositorySource.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/LocalExtensionRepository.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/ConfigurationExtensionRepositorySource.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/DefaultCoreExtension.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/DefaultCoreExtensionRepository.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/DefaultExtensionRepositoryManager.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/DefaultLocalExtension.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/DefaultLocalExtensionRepository.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/LocalExtensionDependency.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/aether/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/aether/AetherExtension.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/aether/AetherExtensionDependency.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/aether/AetherExtensionRepository.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/aether/AetherExtensionRepositoryFactory.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/aether/XWikiLogger.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/aether/XWikiLoggerManager.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/aether/configuration/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/aether/configuration/AetherConfiguration.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/aether/configuration/DefaultAetherConfiguration.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/plexus/ > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/plexus/DefaultPlexusComponentManager.java > platform/core/trunk/xwiki-extension/src/main/java/org/xwiki/extension/repository/internal/plexus/PlexusComponentManager.java > platform/core/trunk/xwiki-extension/src/main/resources/ > platform/core/trunk/xwiki-extension/src/main/resources/META-INF/ > platform/core/trunk/xwiki-extension/src/main/resources/META-INF/components.txt > platform/core/trunk/xwiki-extension/src/test/ > platform/core/trunk/xwiki-extension/src/test/java/ > platform/core/trunk/xwiki-extension/src/test/java/org/ > platform/core/trunk/xwiki-extension/src/test/java/org/xwiki/ > platform/core/trunk/xwiki-extension/src/test/java/org/xwiki/extension/ > platform/core/trunk/xwiki-extension/src/test/java/org/xwiki/extension/repository/ > platform/core/trunk/xwiki-extension/src/test/java/org/xwiki/extension/repository/AetherDefaultRepositoryManagerTest.java > platform/core/trunk/xwiki-extension/src/test/java/org/xwiki/extension/repository/DefaultCoreExtensionRepositoryTest.java > platform/core/trunk/xwiki-extension/src/test/java/org/xwiki/extension/repository/DefaultExtensionManagerTest.java > platform/core/trunk/xwiki-extension/src/test/java/org/xwiki/extension/repository/DefaultLocalExtensionRepositoryTest.java > platform/core/trunk/xwiki-extension/src/test/java/org/xwiki/extension/test/ > platform/core/trunk/xwiki-extension/src/test/java/org/xwiki/extension/test/ConfigurableDefaultCoreExtensionRepository.java > platform/core/trunk/xwiki-extension/src/test/resources/ > platform/core/trunk/xwiki-extension/src/test/resources/localextensions/ > platform/core/trunk/xwiki-extension/src/test/resources/localextensions/existingextension-version.type > platform/core/trunk/xwiki-extension/src/test/resources/localextensions/existingextension-version.xed > platform/core/trunk/xwiki-extension/src/test/resources/localextensions/existingextensiondependency-version.type > platform/core/trunk/xwiki-extension/src/test/resources/localextensions/existingextensiondependency-version.xed > platform/xwiki-applications/trunk/extension/ > platform/xwiki-applications/trunk/extension/pom.xml > platform/xwiki-applications/trunk/extension/src/ > platform/xwiki-applications/trunk/extension/src/main/ > platform/xwiki-applications/trunk/extension/src/main/resources/ > platform/xwiki-applications/trunk/extension/src/main/resources/ExtensionManager/ > platform/xwiki-applications/trunk/extension/src/main/resources/ExtensionManager/WebHome.xml > Modified: > enterprise/trunk/pom.xml > platform/core/trunk/pom.xml > platform/web/trunk/standard/pom.xml > platform/xwiki-applications/trunk/pom.xml > platform/xwiki-tools/trunk/xem-web-debug-eclipse/pom.xml > Log: > XWIKI-5518: Introduce Extension Manager -- Sergiu Dumitriu http://purl.org/net/sergiu/

15 years

1
0
0 0

[xwiki-devs] [proposal] Make form generation/validation code a top level application.

by Caleb James DeLisle

Hi, I have started creating the classes for representing forms, form fields and form field validation constraints. I now have: FormTextAreaFieldClass FormSelectFieldClass FormTextFieldClass FormFieldConstraintClass and I plan to add: FormClass and FormGenerator Since there seem to be a lot of documents associated with this project, I am proposing to make it a top level application and put the documents in a new space called Forms. WDYT?

15 years

1
0
0 0

Re: [xwiki-devs] [xwiki-notifications] r31216 - in platform/xwiki-applications/trunk: administration/src/main/resources/XWiki blog/src/main/resources/Blog invitation/src/main/resources/Invitation officeimporter/src/main/resources/XWiki panels/src/main/resources/P

by Thomas Mortagne

You just broke pretty much all applications for stable branch... On Wed, Sep 22, 2010 at 03:44, abusenius <platform-notifications(a)xwiki.org> wrote: > Author: abusenius > Date: 2010-09-22 03:44:29 +0200 (Wed, 22 Sep 2010) > New Revision: 31216 > > Modified: > platform/xwiki-applications/trunk/administration/src/main/resources/XWiki/Registration.xml > platform/xwiki-applications/trunk/blog/src/main/resources/Blog/CategoriesCode.xml > platform/xwiki-applications/trunk/blog/src/main/resources/Blog/Migration.xml > platform/xwiki-applications/trunk/blog/src/main/resources/Blog/Publisher.xml > platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/InvitationGuestActions.xml > platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/InvitationMemberActions.xml > platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/WebHome.xml > platform/xwiki-applications/trunk/officeimporter/src/main/resources/XWiki/OfficeImporterAdmin.xml > platform/xwiki-applications/trunk/panels/src/main/resources/Panels/DocumentInformation.xml > platform/xwiki-applications/trunk/panels/src/main/resources/Panels/PanelLayoutUpdate.xml > platform/xwiki-applications/trunk/wiki-manager/src/main/resources/XWiki/XWikiServerClassSheet.xml > Log: > XWIKI-5463: Checking for CSRF tokens in applications > > Modified: platform/xwiki-applications/trunk/administration/src/main/resources/XWiki/Registration.xml > =================================================================== > --- platform/xwiki-applications/trunk/administration/src/main/resources/XWiki/Registration.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/administration/src/main/resources/XWiki/Registration.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -686,11 +686,16 @@ > * @param $doAfterRegistration code block to run after registration completes successfully. > *### > #macro(createUser, $fields, $request, $response, $doAfterRegistration) > - ## See if email verification is required and register the user. > - #if($xwiki.getXWikiPreferenceAsInt('use_email_verification', 0) == 1) > - #set($reg = $xwiki.createUser(true)) > + ## CSRF check > + #if(${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > + ## See if email verification is required and register the user. > + #if($xwiki.getXWikiPreferenceAsInt('use_email_verification', 0) == 1) > + #set($reg = $xwiki.createUser(true)) > + #else > + #set($reg = $xwiki.createUser(false)) > + #end > #else > - #set($reg = $xwiki.createUser(false)) > + $response.sendRedirect("$!{services.csrf.getResubmissionURL()}") > #end > ## > ## Handle output from the registration. > > Modified: platform/xwiki-applications/trunk/blog/src/main/resources/Blog/CategoriesCode.xml > =================================================================== > --- platform/xwiki-applications/trunk/blog/src/main/resources/Blog/CategoriesCode.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/blog/src/main/resources/Blog/CategoriesCode.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -397,7 +397,7 @@ > #end > #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogCategoryClassname}' and doc.fullName <> 'Blog.CategoryTemplate' and doc.parent = ? order by doc.name") > #foreach($item in $xwiki.searchDocuments($query, $parameterValues)) > - #if($xwiki.hasAccessLevel('edit', $xcontext.user, $item)) > + #if($xwiki.hasAccessLevel('edit', $xcontext.user, $item) && $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #set($subcategoryDoc = $xwiki.getDocument($item)) > $subcategoryDoc.setParent($categoryParent) > $subcategoryDoc.save($msg.get('xe.blog.manageCategories.comment.updatedParent'), true) > @@ -409,7 +409,7 @@ > #end > #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogPostClassname}' and doc.fullName <> 'Blog.BlogPostTemplate' and categories.id.id = obj.id and categories.id.name = 'category' and category = ? order by doc.name") > #foreach($item in $xwiki.searchDocuments($query, $parameterValues)) > - #if($xwiki.hasAccessLevel('edit', $xcontext.user, $item)) > + #if($xwiki.hasAccessLevel('edit', $xcontext.user, $item) && $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #set($blogEntryDoc = $xwiki.getDocument($item)) > #set($discard = $blogEntryDoc.getObject(${blogPostClassname}).getProperty('category').value.remove($category)) > $blogEntryDoc.save($msg.get('xe.blog.manageCategories.comment.removedDeletedCategory'), true) > @@ -433,7 +433,7 @@ > #set($query = ', BaseObject obj where ') > #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogCategoryClassname}' and doc.fullName <> 'Blog.CategoryTemplate' and doc.parent = ? order by doc.name") > #foreach($item in $xwiki.searchDocuments($query, $parameterValues)) > - #if($xwiki.hasAccessLevel('edit', $xcontext.user, $item)) > + #if($xwiki.hasAccessLevel('edit', $xcontext.user, $item) && $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #set($subcategoryDoc = $xwiki.getDocument($item)) > $subcategoryDoc.setParent($newCategoryDoc.fullName) > $subcategoryDoc.save($msg.get('xe.blog.manageCategories.comment.updatedParent'), true) > @@ -442,16 +442,18 @@ > #set($query = ', BaseObject obj, DBStringListProperty categories join categories.list as category where ') > #set($query = "${query}obj.name = doc.fullName and obj.className = '${blogPostClassname}' and doc.fullName <> 'Blog.BlogPostTemplate' and categories.id.id = obj.id and categories.id.name = 'category' and category = ? order by doc.name") > #foreach($item in $xwiki.searchDocuments($query, $parameterValues)) > - #if($xwiki.hasAccessLevel('edit', $xcontext.user, $item)) > + #if($xwiki.hasAccessLevel('edit', $xcontext.user, $item) && $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #set($blogEntryDoc = $xwiki.getDocument($item)) > #set($discard = $blogEntryDoc.getObject(${blogPostClassname}).getProperty('category').value.remove($category)) > #set($discard = $blogEntryDoc.getObject(${blogPostClassname}).getProperty('category').value.add($newCategoryDoc.fullName)) > $blogEntryDoc.save($msg.get('xe.blog.manageCategories.comment.updatedRenamedCategory'), true) > #end > #end > - $categoryDoc.getObject('Blog.CategoryClass').set('name', $newCategoryName) > - $categoryDoc.save($msg.get('xe.blog.manageCategories.comment.updatedCategory'), true) > - $categoryDoc.rename($newCategoryName) > + #if ($!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > + $categoryDoc.getObject('Blog.CategoryClass').set('name', $newCategoryName) > + $categoryDoc.save($msg.get('xe.blog.manageCategories.comment.updatedCategory'), true) > + $categoryDoc.rename($newCategoryName) > + #end > #end > {{/velocity}}</content> > </xwikidoc> > > Modified: platform/xwiki-applications/trunk/blog/src/main/resources/Blog/Migration.xml > =================================================================== > --- platform/xwiki-applications/trunk/blog/src/main/resources/Blog/Migration.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/blog/src/main/resources/Blog/Migration.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -24,7 +24,7 @@ > <syntaxId>xwiki/2.0</syntaxId> > <hidden>true</hidden> > <content>{{velocity filter="none"}} > -#if($request.migrate) > +#if($request.migrate && $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #set($newContent = '#includeForm("Blog.BlogPostSheet")') > #set($query = ", BaseObject obj where obj.name = doc.fullName and obj.className = 'XWiki.ArticleClass'") > #foreach($article in $xwiki.searchDocuments($query)) > > Modified: platform/xwiki-applications/trunk/blog/src/main/resources/Blog/Publisher.xml > =================================================================== > --- platform/xwiki-applications/trunk/blog/src/main/resources/Blog/Publisher.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/blog/src/main/resources/Blog/Publisher.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -32,7 +32,7 @@ > #end > #set($entryName = "$!{request.entryName}") > #if($entryName != '') > - #if($xwiki.hasAccessLevel('edit', $xcontext.user, $entryName)) > + #if($xwiki.hasAccessLevel('edit', $xcontext.user, $entryName) && $!{services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #set($entryDoc = $xwiki.getDocument($entryName)) > #if ($entryDoc) > #getEntryObject($entryDoc $entryObj) > > Modified: platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/InvitationGuestActions.xml > =================================================================== > --- platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/InvitationGuestActions.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/InvitationGuestActions.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -223,7 +223,7 @@ > {{error}}(%id="invitation-action-message"%)$msg.get('xe.invitation.doAction.accept.alreadyReportedAsSpam'){{/error}} > #elseif($status != 'pending') > {{error}}(%id="invitation-action-message"%)$msg.get('xe.invitation.doAction.invalidStatus', ["#messageStatusForCode($status)"]){{/error}} > - #else > + #elseif($confirm && ${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #if("#canGuestAcceptInvitation($doc)" != 'true') > ## > {{error}}(%id="invitation-action-message"%)$msg.get('xe.invitation.doAction.accept.improperConfiguration'){{/error}} > @@ -235,6 +235,9 @@ > #set($invited = true) > {{include document="XWiki.Registration"/}} > #end > + #else > + ## CSRF protection > + $response.sendRedirect("$!{services.csrf.getResubmissionURL()}") > #end > #elseif($action == 'decline') > ## Decline Invitation <------------------------------------------------------------------------ > @@ -261,7 +264,7 @@ > {{error}}(%id="invitation-action-message"%)$msg.get('xe.invitation.doAction.decline.alreadyReportedAsSpam'){{/error}} > #elseif($status != 'pending') > {{error}}(%id="invitation-action-message"%)$msg.get('xe.invitation.doAction.invalidStatus', ["#messageStatusForCode($status)"]){{/error}} > - #elseif($confirm) > + #elseif($confirm && ${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #setMessageStatus($message, 'declined', $memo)## > $emailContainer.saveAsAuthor($msg.get('xe.invitation.doAction.decline.saveComment')) > {{info}}(%id="invitation-action-message"%)$msg.get('xe.invitation.doAction.decline.success'){{/info}} > @@ -280,7 +283,7 @@ > #if("$!message" == '') > ## No message found by that id. > {{error}}(%id="invitation-action-message"%)$msg.get('xe.invitation.doAction.reportSpam.noMessageFound'){{/error}} > - #elseif($confirm) > + #elseif($confirm && ${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #setMessageStatus($message, 'reported', $memo)## > $emailContainer.saveAsAuthor($msg.get('xe.invitation.doAction.reportSpam.reportSaveComment')) > ## Your report has been logged, sorry for the inconvienence. > > Modified: platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/InvitationMemberActions.xml > =================================================================== > --- platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/InvitationMemberActions.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/InvitationMemberActions.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -382,7 +382,7 @@ > $msg.get('xe.invitation.doUserActionOnMultipleMessages.cancel.someMessagesNotFound', > [$mathtool.sub($messageIDs.size(), $messages.size()), $messageIDs.size()]){{error}}))) > #end > - #elseif($confirm) > + #elseif($confirm && ${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > ## If the user accidently selected messages to which this action cannot be done, just skip over them. > #set($changed = false) > #foreach($message in $messages) > @@ -435,7 +435,7 @@ > $msg.get('xe.invitation.doUserActionOnMultipleMessages.noMessagesFound') > #end > {{/error}}))) > - #elseif($confirm) > + #elseif($confirm && ${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > ## If the user accidently selected messages to which this action cannot be done, just skip over them. > #set($changed = false) > #foreach($message in $messages) > > Modified: platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/WebHome.xml > =================================================================== > --- platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/WebHome.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/invitation/src/main/resources/Invitation/WebHome.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -737,7 +737,9 @@ > #set($messageBody = '') > #end > ## > - #if("$!request.get('sendMail')" != '' && $request.getMethod().toLowerCase() == 'post') > + #if("$!request.get('sendMail')" != '' > + && $request.getMethod().toLowerCase() == 'post' > + && ${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #generateAndSendMail($config, > $recipients, > $subjectLine, > > Modified: platform/xwiki-applications/trunk/officeimporter/src/main/resources/XWiki/OfficeImporterAdmin.xml > =================================================================== > --- platform/xwiki-applications/trunk/officeimporter/src/main/resources/XWiki/OfficeImporterAdmin.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/officeimporter/src/main/resources/XWiki/OfficeImporterAdmin.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -281,7 +281,7 @@ > #set($msgRestart=$msg.get("xe.officeimporter.openoffice.actions.restart")) > #set($msgUpdate=$msg.get("xe.officeimporter.openoffice.update")) > #set($msgLimitedControl=$msg.get("xe.officeimporter.openoffice.limitedcontrol")) > -#if($hasAdmin) > +#if($hasAdmin && ${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #set($currentAction = "$!{request.action}") > #if($currentAction == "stop") > #if(!$oomanager.stopServer()) > > Modified: platform/xwiki-applications/trunk/panels/src/main/resources/Panels/DocumentInformation.xml > =================================================================== > --- platform/xwiki-applications/trunk/panels/src/main/resources/Panels/DocumentInformation.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/panels/src/main/resources/Panels/DocumentInformation.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -547,7 +547,7 @@ > #end > ## Use the syntax and content received from the client, as the user might have made some changes that are not on saved yet. > #set($void = $translatedDoc.setSyntaxId($oldSyntax)) > - #if (!$translatedDoc.convertSyntax($newSyntaxId)) > + #if (!$translatedDoc.convertSyntax($newSyntaxId) || !${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #set($error = true) > #else > #set($void = $translatedDoc.save("Document converted from syntax $oldSyntax to syntax $newSyntaxId")) > > Modified: platform/xwiki-applications/trunk/panels/src/main/resources/Panels/PanelLayoutUpdate.xml > =================================================================== > --- platform/xwiki-applications/trunk/panels/src/main/resources/Panels/PanelLayoutUpdate.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/panels/src/main/resources/Panels/PanelLayoutUpdate.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -34,7 +34,7 @@ > ## > ## Check to see if the current user has admin rights on the current preferences document. > ## > -#if(!$xwiki.hasAccessLevel("admin", $xcontext.user, $prefsdocument)) > +#if(!$xwiki.hasAccessLevel("admin", $xcontext.user, $prefsdocument) || !${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > #xwikimessageboxstart("$msg.get('panelwizard.placemanager')" "") > $msg.get("panelwizard.notadmininplace", $place) > #xwikimessageboxend() > > Modified: platform/xwiki-applications/trunk/wiki-manager/src/main/resources/XWiki/XWikiServerClassSheet.xml > =================================================================== > --- platform/xwiki-applications/trunk/wiki-manager/src/main/resources/XWiki/XWikiServerClassSheet.xml 2010-09-22 01:44:21 UTC (rev 31215) > +++ platform/xwiki-applications/trunk/wiki-manager/src/main/resources/XWiki/XWikiServerClassSheet.xml 2010-09-22 01:44:29 UTC (rev 31216) > @@ -36,7 +36,9 @@ > #set ($wiki = $WikiManager.getWikiFromDocumentName($doc.fullName)) > ## > #if ($action && ($action == "create") && $domain && ($domain.trim().length() > 0)) > - #if (!$wiki.containsWikiAlias($domain)) > + #if (!${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > + #error($msg.get("notallowed")) > + #elseif (!$wiki.containsWikiAlias($domain)) > #set ($alias = $wiki.newObject("XWiki.XWikiServerClass")) > $alias.set("server", $domain) > $alias.set("homepage", "Main.WebHome") > @@ -47,7 +49,9 @@ > #end > ## > #if ($action && ($action == "delete") && $domain && ($domain.trim().length() > 0)) > - #if ($wiki.containsWikiAlias($domain)) > + #if (!${services.csrf.isTokenValid("$!{request.getParameter('form_token')}")}) > + #error($msg.get("notallowed")) > + #elseif ($wiki.containsWikiAlias($domain)) > #set ($alias = $wiki.getWikiAlias($domain)) > #set ($removed = $wiki.removeObject($alias.objectApi)) > $wiki.save() > > _______________________________________________ > notifications mailing list > notifications(a)xwiki.org > http://lists.xwiki.org/mailman/listinfo/notifications > -- Thomas Mortagne

15 years

1
1
0 0

[xwiki-devs] [VOTE] Move extension manager as experimental application/component of the platform

by Thomas Mortagne

As planned by the XE 2.5 roadmap (http://enterprise.xwiki.org/xwiki/bin/view/Main/Roadmap) i would like to move extension manager to the platform. It's one application for the UI and one jar for the framework (plus several MB of maven/classloading dependencies). The rationale is that it makes it easier to try and play with it to have as much comments as possible. It would be "taged" as experimental which means anything in it can be changed anytime and nobody can expect a code that use this component's API to not be broken. The current state of Extension Manager is summarized in http://dev.xwiki.org/xwiki/bin/view/Design/ExtensionManagerProposal#HPlanni… and detailed in the rest of the document. I'm pretty confident it's not dangerous for the rest of XE when you don't use it and it can't slow down it or something. So WDYT ? Here is my +1. Thanks, -- Thomas Mortagne

15 years

5
5
0 0

[xwiki-devs] duplicated id generation

by Ricardo Espírito Santo

Hello there, I have been asked to develop something on top of the pdf export facilities on the xwiki. But I run into a small problem: When *generating a pdf with multiple pages*, say all the pages from one space, the ids of elements within the pages get duplicated and the *pdf exportation fails*. i.e.: *Page A* with a title *TheQuickBrownFox...* some text under it and then *page B* with the same title: *TheQuickBrownFox...* with some other text under this. Both will get an auto ID of *TheQuickBrownFox... *Now this doesn't happen for items on the same page since the ID generation mechanism counts all items of the same name and increments it if necessary. But this mechanism does not contemplate cross page duplicated items. To avoid the following error: Property ID "lipsum" (found on "fo:block") previously used; ID values must be unique within a document! (See position 12:39) We thought some changes to the ID generation mechanism could be made: We could* prefix the ID* with the space and page name and this would be a simple elegant solution. Now: Is this the best solution? Will someone point out the best place to do this? If I post a patch with this fix will it be included on the trunk? Thank you in advance, » Ricardo Espírito Santo » Linkare TI - Tecnologias de Informação, Lda

15 years

4
3
0 0

[xwiki-devs] [vote] Commit the section, column and dashboard macro in the platform macros

by Anca Luca

Hi devs, wdyt about committing the section & macro columns from the contrib (https://svn.xwiki.org/svnroot/xwiki/contrib/projects/xwiki-macro-column/) in the platform macros, along with a first, very simple implementation of the dashboard macro (which for the moment only delegates to the section macro)? This would be the first step towards the implementation of the dashboard, and the plan is to be done before 2.5M2. Here's my +1. WDYT? Anca

15 years

10
21
0 0

[xwiki-devs] [Discussion] Preview link next to Office attachments

by Marius Dumitru Florea

Hi devs, I'd like to add a preview link next to office attachments in the attachments tab (See http://jira.xwiki.org/jira/browse/XAOFFICE-11 ). I was thinking to create a new velocity template, officepreview.vm, and use it like this: $doc.getURL("view", "xpage=officepreview&attachment=$escapetool.url($attachment.filename)") Another option is to add a new action (i.e. /xwiki/bin/officepreview/Space/Page/presentation.ppt ) or reuse an existing one (i.e. /xwiki/bin/preview/Space/Page/presentation.ppt ). WDYT? Thanks, Marius

15 years

3
2
0 0

[xwiki-devs] [VOTE] XWiki Syntax 2.1: Specifying QueryString and Anchor

by Vincent Massol

Hi devs, Since this is an important public change, we need to vote on it. This is the vote for the mail thread: http://markmail.org/message/drm6jq4mosjbryew First some terminology: [[label>>target||params]] The vote is on moving query string and anchor information from the link target to link parameters. Rules: * This is for XWiki Syntax 2.1 only * The target part is there to specify what the link is targeting. QueryString and Anchors do not serve to specify the target. They're just used at render time to control the display. Hence the rationale why they are specified as link params and not as part of the target. Note that for an interwiki link, the interwiki alias is part of the target since it serves to specify the target. * We name the param "queryString" so that it's clear what it is. We can always change it later on with no backward compat issues if we want something more isolated from URLs but we don't see the need now. The user has to write a valid query string including any URL-encoding required. * Example: [[label>>doc:docReference||queryString="a=b&c=d" anchor="anchor"]] Here's my +1 Thanks -Vincent

15 years

4
3
0 0

[xwiki-devs] exporting document as pdf in landscape mode

by Ibrahim hammani

Hello all, Is there any way to export a document as a pdf and in landscape mode. Thanx. Ibrahim Hammani.

15 years

1
0
0 0

[xwiki-devs] [VOTE] Release XE 2.4.1

by Thomas Mortagne

Hi devs, I would like to release XE/XEM 2.4.1 because it contains some important bugfixes. See http://jira.xwiki.org/jira/secure/IssueNavigator.jspa?reset=true&jqlQuery=p… Here is my +1, Thanks, -- Thomas Mortagne

15 years

10
11
0 0

[xwiki-devs] [Discussion] Failed to locate Script Service

by Marius Dumitru Florea

Hi devs, I was playing with the office preview script service when I discovered that $services throws ScriptServiceNotFoundException when there's no script service registered for the specified hint, e.g. $services.foo . I was expecting $services to return null when it fails to locate a service. I even wrote: #if($services.officepreview) {{html}} $services.officepreview.preview(...) {{/html}} #else {{error}}The office preview component has not been installed.{{/error}} #end What do you think it's best: to throw ScriptServiceNotFoundException or to return null? Anyway, I think there should be a method to check if a script service is available ( http://svn.xwiki.org/svnroot/xwiki/platform/core/trunk/xwiki-script/src/mai… ). WDYT? Thanks, Marius

15 years

4
3
0 0

[xwiki-devs] Current entity reference

by Marius Dumitru Florea

Hi devs, If I write: {{groovy}} print com.xpn.xwiki.web.Utils.getComponent(org.xwiki.model.ModelContext.class).getCurrentEntityReference(); {{/groovy}} in a wiki page I get: name = [xwiki], type = [WIKI], parent = [null] I was expecting to get a reference to the current page (i.e. the page that executes the groovy script). The javadoc of ModelContext interface says: "Allows accessing Model Objects for current objects (current document, current wiki, current space, etc) placed in the Execution Context." Looks like DefaultModelContext ( http://svn.xwiki.org/svnroot/xwiki/platform/core/trunk/xwiki-model/src/main… ) always returns a WikiReference. What was the rationale behind this? Thanks, Marius

15 years

2
2
0 0

[xwiki-devs] Integrating officepreview module into the main source tree

by Marius Dumitru Florea

Hi devs, I'm going to continue Asiri's work on integrating officepreview module ( http://svn.xwiki.org/svnroot/xwiki/contrib/sandbox/xwiki-officepreview/ ) into the main source tree. Following the discussion at http://xwiki.475771.n2.nabble.com/Discussion-Integrating-officepreview-modu… here are the steps that need to be taken: * Extend DocumentAccessBridge with a method to get the current version of an attachment in order to drop the dependency on xwiki-core: String getAttachmentVersion(AttachmentReference attachmentReference) * Convert OfficePreviewVelocityBridge to a ScriptService: $services.officepreview.preview($attachmentReference, $filterStyles) * Move /contrib/sandbox/xwiki-officepreview/ to /platform/core/xwiki-officepreview * Publish the office preview wiki macro on code.xwiki.org * Integrate office preview in the UI (e.g. button/link to preview, next to download links in the attachments tab) Let me know if you don't agree with some of these steps. The goal is to have the office preview module in platform ready to use before the 2.5M2 release. Thanks, Marius

15 years

6
9
0 0

[xwiki-devs] [Proposal] Sepcifying query string and anchor in link references to documents for XWiki Syntax 2.1

by Vincent Massol

Hi, The discussion started in http://xwiki.markmail.org/thread/hqvmy34jfknb2waa but since it's an important decision I'm making it a full thread here. The idea is to know how we want to represent query string and anchors in links to documents in XWiki Syntax 2.1. In 2.0 we were using: [[label>>whatever?queryString#anchor]] The proposal is to move query string and anchor to a link parameter. It be done like this: [[label>>doc:mypage||parameters="a=b&c=d" anchor="..."]] We could decide to use another syntax for parameters (ie query string) such as: [[label>>doc:mypage||parameters="a=b,c=d" anchor="..."]] This would make it a little bit less URL-specific. The pros of this approach are: - no need for the user to escape the ? and # characters in document names - makes the syntax a little bit less "magic" and more formal The cons: - Takes a bit longer to write - A new syntax to learn WDYT? Thanks -Vincent

15 years

3
4
0 0

[xwiki-devs] Possible bug in the style field when exporting a PDF

by Paulo Zenida

Hello all. First of all, I'd like to say that I'm kind new in the XWiki project and in this mailing list so, I apologize if this is an already reported issue I'm not aware of (I looked for open issues related to the customization of the PDF pages when exporting from XWiki but I found nothing related to what I'm about to share with you): I'm using XWiki 2.4 and I cannot make the example in http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Configuration#HCustomiz… related to the configuration of the field style work. After some debugging, I found out why: basically, the example states that we should use a field of type TextArea for the style property of the PDFClass class. However, when doing so, at runtime, when getting the value of my "style" field, I don't get what I actually wrote there, because a new paragraph is inserted around my content, resulting in something like: <p> h2 { margin-left: 2cm; margin-bottom: 1cm; color: red; } h3 { margin: 3cm; color: yellow; } </p> I thought the problem might be with the editor that was used for editing the field or something, so I forced using the Text editor but still had no results. This example only worked when I used a String property instead of a TextArea (which is a real "pita" right?). I'd like to know: 1 - Am I doing something wrong? 2 - Is this a known bug and I couldn't find information about it? 3 - If this is really a bug, can I help fixing it or something similar? Regards, Paulo Zenida

15 years

3
6
0 0

[xwiki-devs] Rules for Escaping in Links in XWiki Syntax 2.0 and 2.1

by Vincent Massol

Hi, I thought it would be good to summarize the rules I'm implementing/fixing relative to escaping in link references for both XWiki Syntax 2.0 and the new XWiki Syntax 2.1 I have started. This will later go in the XWiki Syntax page on xwiki.org. There are 2 set of rules: - For entity references - For link references Entity References ============== The rules are (independent of the XWiki Syntax): - if you need a \ in any part of the reference then you need to double it with \\ - For a : in a space name it's \: - For a . in a page name it's \. - For a @ in an attachment name it's \@ - For a ^ in an object name it's \^ - For a . in an object property name it's \. Link References ============= For XWiki Syntax 2.0 ---------------------------- The rules are: - if the link reference points to a document and you want a ?, #, @ or \ in any part of the reference you need to escape them with \?, \#, \@ or \\. Note that when resolving a link reference to a document the link reference escapes are first unescaped and then the entity reference is unescaped. For ex for: [[label>>my\.page]] will result in a link to a page named "my.page" and [[label>>my\?page]] to "my?page". - if link reference points to a mailto then no escaping is performed at all. Thus [[label>>mailto:john\@whatever.org]] will generate in HTML <a href="mailto:john\@whatever.org">john\(a)whatever.org</a> - same for link refs to URLs - For link to attachments, only the entity reference escape is performed, no additional escape is done for the link reference. - For link to interwiki, if the interwiki path needs a @ then it must be escaped with \@. Same for the interwiki alias. Example: [[label>>what\@ever@wiki\@pedia]] For XWiki Syntax 2.1 ---------------------------- The rules are: - if the link reference points to a document and you want a ?, # or \ in any part of the reference you need to escape them with \?, \#, or \\. - if link reference points to a mailto then no escaping is performed at all. - same for link refs to URLs - For link to attachments, only the entity reference escape is performed, no additional escape is done for the link reference. - For link to interwiki, no escaping is performed at all (and ":" is not allowed in the interwiki alias). Example: [[label>>interwiki:wikipedia:what\\ever]] will generate an interwiki path of what\\ever Open Questions ============= Do we want to allow \\ in any link references (mailto, attach, interwiki, url, etc) and unescape it to \ or should we keep the rules defined above? Thanks -Vincent

15 years

4
7
0 0

[xwiki-devs] [proposal] Dashboard macro implementation

by Anca Luca

Hi devs, knowing that gadgets will be xwiki macros instances (in any of the approaches) we need a way to add all these in a dashboard. Proposed options are at http://dev.xwiki.org/xwiki/bin/view/Design/GadgetIntegration#HDashboardMacr… . Currently implemented solution is 1/ which has a few drawbacks: it defines a meta syntax for its content and this syntax doesn't allow more complex layouts than a number of columns. The new proposal is 4) http://dev.xwiki.org/xwiki/bin/view/Design/GadgetIntegration#HOption429Colu… , which basically proposes to use nested column macros ( http://svn.xwiki.org/svnroot/xwiki/contrib/projects/xwiki-macro-column/ ) to do layouting and extend the section macro with a dashboard macro which would be used on the first level to mark that the columned content is a dashboard and not just regular wiki content. For more details about the approach see the description in the design page, as well as for the advantages of this proposal. my +1, I like this approach, I will try to prove the concept in the next days. WDYT? Thanks, Anca

15 years

5
9
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

xwiki-devs