Skip to Content

Release Notes for $doc.getValue('product') $doc.getValue('version')

Version 9.1 by Thomas Mortagne on 2023/01/30
Warning: For security reasons, the document is displayed in restricted mode as it is not the current version. There may be differences and errors due to this.

Failed to execute the [velocity] macro. Cause: [The execution of the [velocity] script macro is not allowed in [xwiki:ReleaseNotes.Data.XWiki.15\.0.WebHome]. Check the rights of its last author or the parameters if it's rendered from another script.]. Click on this message for details.

Contents

This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.

This is the first release of the 15.x cycle. This release consists mostly of dependency upgrades and bug fixes including security fixes with some small new features for admins and developers. Some fixes also required changes that could cause breakages, please read the respective sections before upgrading.

New and Noteworthy (since Failed to execute the [velocity] macro. Cause: [The execution of the [velocity] script macro is not allowed in [xwiki:ReleaseNotes.Data.XWiki.15\.0.WebHome]. Check the rights of its last author or the parameters if it's rendered from another script.]. Click on this message for details.
14.10.2)

Full list of issues fixed and Dashboard for 15.0.

For Users

No changes!

For Admins

  • New tags right check strategy configuration: It is now possible to configure the algorithm used when checking view rights on tags (returned by the Tags API) by editing xwiki.properties.

    #-# [Since 14.4.8, 14.10.4, 15.0RC1]
#-# Configure the tag selection algorithm to use.
#-# The default algorithm is "exhaustive", which check all elements (documents and tags) for view right before returning
#-# them. This exhaustive check can lead to tag clouds and tag lists being slow to compute on instances with very large 
#-# amounts of tags or tagged documents (more than 5000 of elements).   
#-# Note that it is advised to keep using the default implementation as much as possible, and to switch to the "unsafe"
#-# option only when all performance improvements options have been exhausted 
#-# (see https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Performances/)
#-# The "unsafe" algorithm does not perform any right checks. It is approximately 10 times faster than "exhaustive"
#-# but does not provide any guarantee that the current user won't be able to view a tag he/she is not allowed to. 
#-# Therefore, we cannot recommend to use it unless tags performance is critical AND tags and document references are 
#-# not considered as critical information.
# tag.rightCheckStrategy.hint=exhaustive
# tag.rightCheckStrategy.hint=unsafe

For Developers

New script service for URL security operations

 
A new script service has been introduced to allow performing security checks on URL. The script service currently provides a single method which can be used like that:

{{velocity}}
#set ($myURL = "http://xwiki.org")
#set ($safeURI = $services.security.url.parseToSafeURI($myURL))
## The URI is null if not safe.
#if ($safeURI)
  ## use it as an URI object. 
#end
{{/velocity}}

Miscellaneous

  • Restricted context macro: A new restricted parameter has been introduced in the context macro to allow executing content in a restricted content. See Context Macro for more details.

  • New script service for HTML operations: A new HTML script service has been introduced allowing to use the recently introduced HTMLElementSanitizer in scripts. It can be used in velocity with $services.html.xxx.

  • Extension plan in isolation: It's now much easier to run extension jobs isolated from the current instance. The following two new properties has been added to ExtensionRequest:

    • coreExtensionRepository: a custom repository to use to find available core extension
    • installedIgnored: true if already-installed extensions should not be taken into account while resolving the install plan

Upgrades

The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):

Translations

The following translations have been updated: 

Known issues

Backward Compatibility and Migration Notes

General Notes

  • When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
    • xwiki.cfg
    • xwiki.properties
    • web.xml
    • hibernate.cfg.xml
  • Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.

Issues specific to Failed to execute the [velocity] macro. Cause: [The execution of the [velocity] script macro is not allowed in [xwiki:ReleaseNotes.Data.XWiki.15\.0.WebHome]. Check the rights of its last author or the parameters if it's rendered from another script.]. Click on this message for details.

Change of macro priorities

The priority of the following macros has been changed from very high (10) to normal (1000):

  • include
  • display
  • context
  • template
  • uiextension
  • uiextensions

It means they have the same priority that most other macros so they will be executed in the order you see them in the wiki content instead of before previous macros, it's especially important when combined with script macros.

This hopefully fixes more confusion than causing problems but it could impact cases like:

  • if you include a document which contains macro which a very high priority, those macros used to be executed very early and they are now limited by the priority of the include macro

  • if you were including things to use in a script macro after that script macro, it won't work anymore:

    {{velocity}}
  #macroFromTheTemplate('value')
{{/velocity}}

{{template name="template/with/macros.vm"/}}

    doesn't behave as expected anymore and should instead be written as

    {{template name="template/with/macros.vm"/}}

{{velocity}}
  #macroFromTheTemplate('value')
{{/velocity}}

    because in the first version the velocity macro is going to be executed before the template macro (because it appear first in the content).

Change of default author when executing the include macro

For security reasons, it was decided to modify the default behavior of the include macro regarding the execution of the included content: if the content author of the target document does not have programming rights, the include macro will execute it right away with the right of the target document content author instead of just parsing it and returning the blocks.

Change of behavior for ComponentManager#getInstanceList

org.xwiki.component.manager.ComponentManager#getInstanceList and org.xwiki.component.manager.ComponentManager#getInstanceMap don't fail anymore by default, if one of the components fail to initialize. However, it's possible to still thrown an exception if needed, by using the @ComponentMandatory annotation, either on the component class, or at a higher level in the inheritance hierarchy (e.g. inside the role class), to impact all components who are a subclass of it.

Reinitialization of Solr search index during migration

A bug with the Solr search index has been fixed as part of this release, but it needs a reindex of the documents to be properly taking into account. The migration will empty the index so that a full reindex is performed: as a consequence the search feature might take a few time to be entirely working after the first restart. 

API Breakages

The following APIs were modified since Failed to execute the [velocity] macro. Cause: [The execution of the [velocity] script macro is not allowed in [xwiki:ReleaseNotes.Data.XWiki.15\.0.WebHome]. Check the rights of its last author or the parameters if it's rendered from another script.]. Click on this message for details.
14.10.2:

Failed to execute the [velocity] macro. Cause: [The execution of the [velocity] script macro is not allowed in [xwiki:ReleaseNotes.Data.XWiki.15\.0.WebHome]. Check the rights of its last author or the parameters if it's rendered from another script.]. Click on this message for details.

Credits

The following people have contributed code and translations to this release (sorted alphabetically):

  • Alex Cotiugă 
  • Andreea Chirica 
  • Antoine Mottier 
  • Clément Aubin 
  • DenisF 
  • Gankov Andrey 
  • Jens Mittelbach 
  • Manuel Leduc 
  • Marius Dumitru Florea 
  • Michael Hamann 
  • Nikita Petrenko 
  • Oana-Lavinia Florean 
  • Raphaël Jakse 
  • Simon Urli 
  • Simpel 
  • Suguru Hirahara 
  • Thomas Mortagne 
  • Vincent Massol 
  • tambovtsev 
  • trrenty 

About

About

Support

Platform

User Guide

Admin Guide

Developer Guide

Projects

XWiki

Extensions

Other

Contribute

Status

Practices

Under the Hood

Get Involved

Get Connected