December 2015 - xwiki-users@xwiki.org

[xwiki-users] [ANN] File Manager 2.0.5 released
by Marius Dumitru Florea 18 Dec '15

18 Dec '15

A new version of the File Manager Application that works with the most recent versions of XWiki (7.2+) is now available. You can see here the list of bugs that have been fixed: http://extensions.xwiki.org/xwiki/bin/view/Extension/File+Manager+Applicati… Enjoy, Marius

1 0

[xwiki-users] AUTO : Denis Germain est absent (retour 28/12/2015)
by Denis.Germain＠isocel.info 18 Dec '15

18 Dec '15

Je suis absent(e) du bureau jusqu'au 28/12/2015 Je suis actuellement en congés. En cas d'urgence, merci de contacter le Support Technique Isocel support-technique(a)isocel.info ou Tel: 05 24 54 99 80 Remarque : ceci est une réponse automatique à votre message "Re: [xwiki-users] Documentation on Velocity binding for 'config' object?" envoyé le 18/12/2015 15:08:53. C'est la seule notification que vous recevrez pendant l'absence de cette personne.

1 0

Re: [xwiki-users] Documentation on Velocity binding for 'config' object?
by Eric Johanson 18 Dec '15

18 Dec '15

Thank you for the information. I was able to to go directly to the Invitation.InvitationConfig Document and see where I could edit the snippet of code that accesses the 'guestsActionsPage'. (The Velocity code resides in an object of type "Invitation.WebHome" and there is an item titled "Email message body HTML template"). But I don't see anywhere that I can actually change the value of guestsActionsPage itself. So I can't find where "$config.get("guestsActionPage") is actually defined. Is somewhere that I can modify its value? Or could it be hard-coded into the application? I also looked at the XWiki.XWikiServerXwiki document and found an object of type XWikiServerClass. This object has a property named "Server" that is set to "localhost". But that's not what the getExternalURL method seems to be using (it is getting a value that matches the short hostname). Is this the property that you were referring to in your answer? Thank you again for your help. -Eric -----Original Message----- From: users [mailto:users-bounces@xwiki.org] On Behalf Of Eduard Moraru Sent: Thursday, December 17, 2015 5:51 PM To: XWiki Users <users(a)xwiki.org> Subject: Re: [xwiki-users] Documentation on Velocity binding for 'config' object? Hi, I don`t know the code of the app in question, but specifically to your questions: * the document "Invitation.InvitationConfig" seems to be the one holding the configuration object with the "guestsActionsPage" property * getExternalURL uses the server configuration that you have set in your wiki's descriptor located in the main wiki at "XWiki.XWikiServerXwiki" (for the main wiki) or in "XWiki.XWikiServerWikiname" (for a subwiki). Hope this helps, Eduard On Thu, Dec 17, 2015 at 8:36 PM, deltamind106 <ericj(a)valmarc.com> wrote: > There is a snippet of Velocity code in the XWiki invitation email > template that looks like this: > > > > *$xwiki.getDocumentAsAuthor($config.get("guestsActionsPage")).getExter > nalURL())* > > Where is the 'config' binding for Velocity documented? If I want to > change the value for "guestsActionPage", where would make this change? > > How does the "getExternalURL" method work? Currently, it seems to be > using the short hostname in the URL it returns, which will not work > for us since that particular hostname is not published on our DNS > server. So I need to change the behavior of "getExternalURL" so that it uses an IP address. > Where would I do that? > > Thank you in advance for any help you can provide. > -Eric > > > > -- > View this message in context: > http://xwiki.475771.n2.nabble.com/Documentation-on-Velocity-binding-fo > r-config-object-tp7597271.html Sent from the XWiki- Users mailing list > archive at Nabble.com. > _______________________________________________ > users mailing list > users(a)xwiki.org > http://lists.xwiki.org/mailman/listinfo/users > _______________________________________________ users mailing list users(a)xwiki.org http://lists.xwiki.org/mailman/listinfo/users

1 0

[xwiki-users] Documentation on Velocity binding for 'config' object?
by deltamind106 17 Dec '15

17 Dec '15

There is a snippet of Velocity code in the XWiki invitation email template that looks like this: *$xwiki.getDocumentAsAuthor($config.get("guestsActionsPage")).getExternalURL())* Where is the 'config' binding for Velocity documented? If I want to change the value for "guestsActionPage", where would make this change? How does the "getExternalURL" method work? Currently, it seems to be using the short hostname in the URL it returns, which will not work for us since that particular hostname is not published on our DNS server. So I need to change the behavior of "getExternalURL" so that it uses an IP address. Where would I do that? Thank you in advance for any help you can provide. -Eric -- View this message in context: http://xwiki.475771.n2.nabble.com/Documentation-on-Velocity-binding-for-con… Sent from the XWiki- Users mailing list archive at Nabble.com.

2 1

[xwiki-users] [Security] Found important vulnerability in deprecated XML-RPC feature
by vincent＠massol.net 17 Dec '15

17 Dec '15

Hi XWiki users and devs, An important security issue in the XML-RPC module of XWiki (http://extensions.xwiki.org/xwiki/bin/view/Extension/XML-RPC+Integration) was brought to our attention by a community member (thanks Ruben Herold). Specifically if your wiki is available on the internet, it’s possible that an intruder may have had access to local files that can be read by the user under which you’ve started the Servlet Container used for XWiki. Note 1: The issue actually comes from the version of the Apache XMLRPC module we were using (https://ws.apache.org/xmlrpc/) It’s been fixed in the latest version (3.1.3). We were using version 3.1. Note 2: ThE XWiki XMLRPC module has been deprecated for a long time now (was replaced by REST) but it was still enabled till XWiki 7.3M1: * In XWiki 7.3M1 we’ve turned off that feature * In XWiki 7.4M2 we’ve removed it altogether by default We recommend that you either upgrade to XWiki 6.4.7, 7.1.4 or 7.3+ or that you turn-off the XML-RPC feature on your wiki **especially if your wiki is open on the internet**. Turning it off is easy: edit XWiki’s META-INF/web.xml file and comment out or remove the following sections: ... <!--filter-mapping> <filter-name>XWikiXmlRpcContextInitializationFilter</filter-name> <servlet-name>xmlrpc</servlet-name> <dispatcher>REQUEST</dispatcher> <dispatcher>INCLUDE</dispatcher> <dispatcher>FORWARD</dispatcher> </filter-mapping—> ... <!--servlet> <servlet-name>xmlrpc</servlet-name> <servlet-class>com.xpn.xwiki.xmlrpc.XWikiXmlRpcServlet</servlet-class> <init-param> <description>Sets, whether the servlet supports vendor extensions for XML-RPC.</description> <param-name>enabledForExtensions</param-name> <param-value>false</param-value> </init-param> </servlet—> ... <!--servlet-mapping> <servlet-name>xmlrpc</servlet-name> <url-pattern>/xmlrpc/*</url-pattern> </servlet-mapping—> … Sorry for the inconvenience. Thanks -Vincent Massol on behalf of the XWiki Core dev team PS: If you need to discuss more about this security issue we recommend that you use XWiki’s security list, see http://dev.xwiki.org/xwiki/bin/view/Community/MailingLists

1 1

[xwiki-users] [ANN] XWiki 7.1.4 released
by Ecaterina Moraru (Valica) 17 Dec '15

17 Dec '15

The XWiki development team is proud to announce the availability of XWiki 7.1.4. This is a bugfix release that fixes important bugs discovered in the 7.1.3 version. We also retired the XML-RPC Integration since it led to security vulnerabilities. You can download it using these links: JAR: http://download.forge.ow2.org/xwiki/xwiki-enterprise-installer-generic-7.1.… EXE: http://download.forge.ow2.org/xwiki/xwiki-enterprise-installer-windows-7.1.… ZIP: http://download.forge.ow2.org/xwiki/xwiki-enterprise-jetty-hsqldb-7.1.4.zip WAR: http://download.forge.ow2.org/xwiki/xwiki-enterprise-web-7.1.4.war XAR: http://download.forge.ow2.org/xwiki/xwiki-enterprise-ui-mainwiki-all-7.1.4.… Make sure to review the release notes: http://www.xwiki.org/xwiki/bin/view/ReleaseNotes/ReleaseNotesXWiki714 The following people have contributed code to this release (sorted alphabetically): Ecaterina Moraru (Valica) Eduard Moraru Marius Dumitru Florea Thomas Mortagne Vincent Massol Thanks for your support -The XWiki dev team

2 1

[xwiki-users] [ANN] XWiki 6.4.7 released
by vincent＠massol.net 17 Dec '15

17 Dec '15

The XWiki Core Development team is proud to announce the availability of XWiki 6.4.7. This is a bugfix release that fixes important bugs discovered in the 6.4.6 version. We also retired the XML-RPC Integration> (http://extensions.xwiki.org/xwiki/bin/view/Extension/XML-RPC+Integration) since it led to security vulnerabilities. We highly recommend upgrading (or turn off the XML-RPC feature, see http://extensions.xwiki.org/xwiki/bin/view/Extension/XML-RPC+Integration) especially if your wiki is open on the Internet. You can download it here: http://www.xwiki.org/xwiki/bin/view/Main/Download Make sure to review the release notes: http://www.xwiki.org/xwiki/bin/view/ReleaseNotes/ReleaseNotesXWiki647 The following people have contributed code to this release (sorted alphabetically): Marius Dumitru Florea Denis Gervalle Vincent Massol Eduard Moraru Thomas Mortagne Thanks for your support -The XWiki Core dev team

1 0

[xwiki-users] myxwiki, invitation app does not work because wiki is closed?
by Gerritjan Koekkoek 16 Dec '15

16 Dec '15

When going to page go invitation app: Invitations can not be accepted because this wiki is closed. To allow invitees to join, save InvitationGuestActions<http://waihonapedia.myxwiki.org/xwiki/bin/view/Invitation/InvitationGuestAc…> as a user with Programming Rights. When clicking on invitationGuestActions and saving it it does not change the page status? Gerritjan Koekkoek Vader van Rai Koekkoek (cdls) en voorzitter vereniging CdLS Visit our website<http://www.cdlsworld.org> Facebook<https://www.facebook.com/gerritjan.koekkoek> email<gerritjan(a)cdlsworld.org>

2 2

[xwiki-users] [ANN] XWiki 7.4 Milestone 2 released
by Guillaume "Louis-Marie" Delhumeau 16 Dec '15

16 Dec '15

The XWiki development team is proud to announce the availability of XWiki 7.4 Milestone 2. This is our last stabilization branch for the XWiki 7.x Cycle. It brings polishing and stabilization for the Nested Pages feature and the changes in UI that resulted from it. It is now possible to have template hierarchies, and to add an automatic redirect when a page is renamed. You can download it here: http://www.xwiki.org/xwiki/bin/view/Main/Download Make sure to review the release notes: http://www.xwiki.org/xwiki/bin/view/ReleaseNotes/ReleaseNotesXWiki74M2 The following people have contributed code to this release (sorted alphabetically): Guillaume Delhumeau Sergiu Dumitriu Marius Dumitru Florea Vincent Massol Eduard Moraru Thomas Mortagne Manuel Smeria Thanks for your support -The XWiki dev team

1 0

[xwiki-users] some help needed: short URLs
by [IDIS Technical Secretariat] Ricardo Rodríguez 16 Dec '15

16 Dec '15

Hi! I'm moving an old XWiki installation (XWiki Enterprise 2.4.30451) to a new box. It currently runs as root in a CentOS/Tomcat/MySQL box serving pages at port 80. The destination is a Ubuntu/Apache Web Server/Tomcat MySQL where an Apache virtual host will serve all controller and virtual wikis. A different application is already running as root in the destination. I do need to remove the application part of the URL from the pages served by the new location. This is mainly due to lots of hardcoded URLs I''m not able to get rid of them now. This simple virtual host configuration works fine, but I'm not able to understand how could I remove the "atriumkm", the application, part of the URL... <VirtualHost *:80> ServerAdmin ricardo.rodriguez(a)idisantiago.es ServerName isabel.idisantiago.es RedirectMatch permanent ^/$ http://isabel.idisantiago.es/atriumkm/ ProxyPass /atriumkm http://localhost:8080/atriumkm ProxyPassReverse /atriumkm http://localhost:8080/atriumkm DocumentRoot /var/www/html # Logging ErrorLog /var/log/apache2/isabel.idisantiago.es-error_log CustomLog /var/log/apache2/isabel.idisantiago.es-access_log common </VirtualHost> I've found this thread that it seems to me deals with a similar issue... http://markmail.org/thread/u5hu7kw6rr2fcacx ... but I'm not able to understand how to get it working. Please, must I be able to do that by modifying the VirtualHost configuration? Must I modify web.xml? Something related with xwiki.cfg parameters? There are a lot of information playing around and concepts I don't understand well. Any help will be extremely welcome! Cheers! Ricardo

2 8