Changes Report

Environment path traversal protections

The Servlet implementation of the Environment API now include path traversal protection for all application servers. That means you don't need to take care of that anymore before calling it.

Tomcat 11 based Debian packages

Debian packages relying on Tomcat 11 (which started to be introduced in Debian 13) are now available.

Change to DocumentService's API

A new method has been added to DocumentService's API: removeDocumentChangeListener. This should be called whenever a component is unmounted after having registered a document change listener through registerDocumentChangeListener.

Page REST endpoint supports content rendering as fallback

A new supportedSyntax query parameter has been added to the REST API endpoint for pages.

A client can use it to list all the syntaxes it supports. If the page is using a syntax that was not part of the list in the request, the response will now include a renderedContent property that the client will be able to use as a fallback instead of the raw content it can't handle.
If this parameter is omitted, no rendered content will be added to the response.

New user REST endpoints

Two new REST endpoints have been added to fetch user information, and optionally user preferences. One of them takes a parameter and will attempt to resolve it to an actual wiki user, while the other provides information on the currently logged-in user.

Live Data modularization

As a first step to allow the Live Data UI to be reusable outside XWiki, its implementation has been split into several npm packages: Live Data API (@xwiki/platform-livedata-api), Live Data UI (@xwiki/platform-livedata-ui), Live Data Component Store (@xwiki/platform-livedata-componentstore), and Live Data XWiki (@xwiki/platform-livedata-xwiki)

Introduction of a Dropdown element in the Abstract Design System

The Abstract Design System now contains a Dropdown element. A Dropdown displays a button that toggles another UI element (e.g., a Menu).

Example:

<x-dropdown>
  <template #activator>Toggle Button</template>
  <x-menu>
    <x-menu-label>menu label</x-menu-label>
    <x-menu-item>menu content</x-menu-item>
  </x-menu>
</x-dropdown>

Flamingo Design System

An implementation of the Abstract Design System is now available for Flamingo. This allows to implement portable applications in XWiki Standard while preserving the possibility to reuse them later on other contexts.

Use Icon Theme From JavaScript

We simplified the usage of icons from the current Icon Theme from JavaScript code:

// 1. Declare the icons you want to load:
define('my-module-icons', {
  icons: ['cross', ...]
});

// 2. Load the icons.
define('my-module', [
  'xwiki-icon!my-module-icons',
], function(icons) {
  // 3. Display the icon.
  document.querySelector('.my-icon-wrapper').append(icons.cross.render());
});

See the Icon Theme Application documentation for more information.

Extension Rights at Page Level

It's now possible to set Extension Rights at the Page level only (it used to be possible to set Extension Rights only for "Page and Children"). In addition, the Administration Menu items and the content pages related to Extension Rights have been improved to show clearly the differences between the two options.

Link Target Picker Improvements

The link target picker from the WYSIWYG (CKEditor) link dialog has received a few improvements:

• the link target type dropdown is now using icons from the current icon theme
• the page and attachment suggest input is now using the same widget (Tom Select) as the rest of the wiki, bringing consistency
• the selected link target (page, attachment) is now displayed inline, inside the suggest input, making the picker more compact

See the CKEditor Integration documentation for more information.

Macro Output Protected in BlockNote

Rendering macros are now executed, and their output is protected (read-only) when editing a wiki page with the experimental BlockNote WYSIWYG editor integration. The macro output may be different from view mode for some macros due to some limitations (no support for nested macros yet, and some rendering block types are currently not supported), but at least you should be able to edit the content outside macros without breaking the macros on save. See the BlockNote integration documentation for more information.

Cluster member identifier

The identifier of the cluster member is now printing in the footer as soon as clustering is enabled.

Edit Image in BlockNote

The experimental BlockNote WYSIWYG editor integration now supports editing the image properties and changing the image source (including uploading a new image attachment). This is done by reusing the image wizard we developed for the CKEditor integration. There are still a lot of rough edges:

• images are not yet rendered in edit mode
• you can't easily insert a new internal (attached) image
• not all the image properties available on the image wizard are currently supported by BlockNote

We plan to improve this in the coming months.

Edit Macro in BlockNote

The experimental BlockNote WYSIWYG editor integration now supports editing the macro parameters and changing the macro. This is done by reusing the macro wizard we developed for the CKEditor integration (and which is used by the Dashboard as well). There are still a lot of rough edges though:

• some macros are not properly rendered in edit mode
• inline macros are not highlighted visually
• the edited content is not reloaded after a macro is updated
• you can't insert a new macro call (you can only edit existing macros calls)

We plan to improve this in the coming months.

Eager and anonymous importmap entries

The importmap now allow defining two new kinds of imports:

1. eager: the dependency is loaded when the page is loaded (tutorial)
2. anonymous: the dependency is excluded from the importmap (tutorial)

Script variable support in translation macro

It's now possible to pass to the {{translation/}} macro the name of the script variable containing the translation parameters. See Translation Macro for more details.

Added support for Object[] conversion

There was no support for conversion from to Object[] in the properties (macro parameters, filter properties, etc.), this is now fixed. Note that there was already support for various types of arrays (as part of Apache BeanUtils).

Notification Messages HTML support

The notifications now only support HTML in their text message when it is explicitly allowed. To do so, an optional textHtml boolean parameters (default value: false) is available.

Example:

new XWiki.widgets.Notification('This is <strong>bold</strong>','done', { textHtml: true});

Change to ModelReferenceHandler's API

Two new methods have been added to ModelReferenceHandler's API: getParentDocumentReference and getParentSpaceReference. These provide backend-specific utilities to obtain parent references from an existing Cristal reference.