Branch: refs/heads/stable-16.10.x Home: https://github.com/xwiki/xwiki-platform Commit: 9804300890ea9b9a24c42d4ac7f28ac9bed5b0d1 https://github.com/xwiki/xwiki-platform/commit/9804300890ea9b9a24c42d4ac7f28... Author: Manuel Leduc <manuel.leduc@xwiki.com> Date: 2026-08-31 (Mon, 31 Aug 2026) Changed paths: M xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-ui/src/main/resources/XWiki/AttachmentSelector.xml M xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-ui/src/test/java/org/xwiki/attachment/AttachmentSelectorPageTest.java Log Message: ----------- XWIKI-24734: Encode the request parameters used to build the attachment selector action URLs * Build the "select" URL of the empty value box with $escapetool.url so that the classname, object and property request parameters are URL-encoded instead of being concatenated raw into the query string. * Escape the action URLs for the page syntax before injecting them in the link syntax of the attachment box actions. * Add page tests pinning the encoding of every value that makes up an action URL: the property and classname request parameters, the document name in the URL path, and the attachment name in both the select query string and the delete URL path. (cherry picked from commit 97d53b21bf3a6f2550216d92b12aca13f90c9f57) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-platform/settings/notifications