Zum Inhalt springen

Änderungen von Dokument Anhänge

Zuletzt geändert von Philipp Golemis am 2026/10/23 16:27
Von Version 1.1
bearbeitet von Philipp Golemis
am 2024/11/17 17:18
Änderungskommentar: Install extension [org.xwiki.platform:xwiki-platform-attachment-ui/16.9.0]
Auf Version 4.1
bearbeitet von Philipp Golemis
am 2026/10/23 16:27
Änderungskommentar: Install extension [org.xwiki.platform:xwiki-platform-attachment-ui/16.10.19]

Zusammenfassung

Details

Seiteneigenschaften
Inhalt
... ... @@ -174,7 +174,9 @@
174 174   (% class="gallery_actions" %)(((
175 175   #foreach ($action in $actions)
176 176   #set( $actionname = $services.localization.render("${translationPrefix}.actions.${action.name}") )
177 - [[${actionname}>>path:${action.url}||class="tool ${action.name}" title="${actionname}" #if($action.rel) rel="${action.rel}"#end]]##
177 + ## Escape the URL so that it cannot break out of the link syntax, whatever its origin.
178 + #set ($actionURL = $services.rendering.escape($action.url, 'xwiki/2.1'))
179 + [[${actionname}>>path:${actionURL}||class="tool ${action.name}" title="${actionname}" #if($action.rel) rel="${action.rel}"#end]]##
178 178   #end
179 179   $!additionalContent
180 180   )))## actions
... ... @@ -265,7 +265,10 @@
265 265   #attachmentPicker_displayStartFrame({'cssClass' : "gallery_emptyChoice $!{dcssClass}", 'text' : $services.localization.render("${translationPrefix}.default"), 'value' : "${options.defaultValue}"} $currentValue)
266 266   #attachmentPicker_displayAttachmentDetails($defaultAttachment $options)
267 267   #set ($returnURL = $escapetool.url($doc.getURL('view', $request.queryString)))
268 - #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, "${options.get('classname')}_${options.get('object')}_${options.get('property')}=&form_token=$!{services.csrf.getToken()}"))
270 + #set ($selectURL = $targetDocument.getURL(${options.get('docAction')}, $escapetool.url({
271 + "${options.get('classname')}_${options.get('object')}_${options.get('property')}": '',
272 + 'form_token': $!{services.csrf.getToken()}
273 + })))
269 269   #attachmentPicker_displayEndFrame ([{'name' : 'select', 'url' : $selectURL}])
270 270  #end
271 271  {{/velocity}}
XWiki.WikiMacroClass[0]
Makro-Code
... ... @@ -121,9 +121,9 @@
121 121   #set ($attachmentResource = '')
122 122   #end
123 123   #if ($displayImage)
124 - (% class="$!{cssClass}#if (!$attachment) hidden#end" %)(((#if ("$!{attachmentResource}" != '' || $forceElement)#if($withLink)[[#end[[image:$services.rendering.escape(${attachmentResource}, 'xwiki/2.1')$!{imageParams}]]#if($withLink)>>attach:$services.rendering.escape(${attachmentResource},'xwiki/2.1')||rel=lightbox]]#{end}#end)))##
124 + (% class="${services.rendering.escape($!cssClass, 'xwiki/2.1')}#if (!$attachment) hidden#end" %)(((#if ("$!{attachmentResource}" != '' || $forceElement)#if($withLink)[[#end[[image:$services.rendering.escape(${attachmentResource}, 'xwiki/2.1')$!{imageParams}]]#if($withLink)>>attach:$services.rendering.escape(${attachmentResource},'xwiki/2.1')||rel=lightbox]]#{end}#end)))##
125 125   #else
126 - (% class="$!{cssClass}" %)#if ("$!{attachmentResource}" != '' || $forceElement)#if ($withLink)[[attach:${attachmentResource}||rel=__blank]]#{else}(% class="displayed" %)#if($targetPermView)$!{services.rendering.escape($!{attachmentName}, 'xwiki/2.1')}#{else}Access Denied#{end}(% %)#{end}#end(%%)##
126 + (% class="${services.rendering.escape($!cssClass, 'xwiki/2.1')}" %)#if ("$!{attachmentResource}" != '' || $forceElement)#if ($withLink)[[attach:${attachmentResource}||rel=__blank]]#{else}(% class="displayed" %)#if($targetPermView)$!{services.rendering.escape($!{attachmentName}, 'xwiki/2.1')}#{else}Access Denied#{end}(% %)#{end}#end(%%)##
127 127   #end
128 128  #end
129 129