Changes Report
Prevent redirections to untrusted domains
Redirections are now only performed to trusted domains in XWiki. The list of trusted domains is obtained from two sources:
- any URLs used to access the wiki is considered as trusted, as well as all the aliases used for subwikis,
- it's possible to specify in xwiki.properties the list of trusted domain by setting the property url.trustedDomains.
If a redirection is attempted to an URL whose domain does not belong to any of this source, a warning log will be output and the redirect is prevented. Note that it's possible to switch off this security mechanism by setting the property url.trustedDomainsEnabled to false.
Live Data Inline Editing
The Live Data Macro has been improved to support inline editing. When the edit mode is allowed on a live data macro, a user with the edit right on the content of a cell can double click on a cell to edit it. The content of the cell is then converted into a form. Pressing escape will cancel the modifications, whereas clicking outside the edited cell will save its content and the Live Data will be reloaded to reflect the update.
Improved Live Data Macro L&F
The UI of the Live Data Macro has suffered a couple of changes:
- the hamburger menu has been moved to the right side, after the pagination
- the reload button has been moved inside the menu
- the menu groups are better separated
- added loading animation
- added support for resizing the columns in the table layout
- improved labels
See the Live Data Macro documentation for more information.
WebSocket Integration
Starting with this version you can write WebSocket end-points as XWiki Components using the standard Java API for WebSocket (JSR 356). For deploying the end-points we rely on the servlet container, which means the servlet container needs to support WebSockets (i.e. it needs to provide an implementation of the JSR 356 specs). At the moment, this includes all the servlet containers we support. See the documentation for more information.
Experimental Realtime Wiki Editor
We cleaned up the Realtime Collaborative Plain WikiText Editor contributed extension and integrated it in the XWiki platform. It's not bundled yet in XWiki Standard but you can still try it out by installing it and following the documentation page.
Experimental Realtime WYSIWYG Editor
We cleaned up the Visual Realtime Collaborative Editor contributed extension and integrated it in the XWiki platform. It's not bundled yet in XWiki Standard but you can still try it out by installing it and following the documentation page.
Script right is not allowed by default anymore
The XWiki default right scheme has been edited to not allow by default the Script right to all users anymore. We decided to perform this change as the Script right gives a lot of powers to users and we found many possible security vulnerabilities related to using this right. This change will not impact existing instance of XWiki that would perform an upgrade: it only concerns new instances. However we strongly suggest administrators to review the rights they give to users to not give Script right by default to all users, and to give it only to a subset of trusted users.
Browser-based PDF Export Used by Default
Starting with this version the new browser-based (client-side) PDF Export is used by default, replacing the old PDF export based on Apache FOP (Formatting Objects Processor). Some of the benefits are:
- dynamic content generated with JavaScript code is now included in the PDF export
- the CSS styles used in the PDF export are the same as those used when viewing the wiki page
- multi-page export supported by default
- writing custom PDF templates is easier
The new PDF Export implementation is still young so you are encouraged to report any issues you may encounter, or propose improvements. If you want to get back the old PDF export implementation, it's easy: there's a configuration option on the PDF Export wiki administration section. If you want to disable the new PDF export implementation completely, that's also possible, either by leaving the list of PDF templates empty in the dedicated administration section, or simply by uninstalling the PDF Export Application.
New Export Modal
The Export Modal has been redesigned:
- first you need to select the export format from the list of available formats, which are grouped by category and show an icon and a label; you can also type to filter the list of formats
- if the selected export format doesn't support multi-page export or the current page is terminal then the export is triggered directly
- if the selected export format supports multi-page export and the current page is nested then the Export Tree Modal is shown, allowing you to select the pages to export
- depending on the selected format:
- the export tree may show hidden pages (e.g. for XAR export) or not (e.g. for PDF export)
- the initial selection in the export tree may consist only in the current page (e.g. for PDF export) or the current page and all its child pages (e.g. for HTML export)
Each export format may customize further the export tree or add additional steps (e.g. PDF Export Options modal).
Display images in a lightbox
Users can now open images from the page content in a lightbox. While hovering an image, a toolbar will appear with options for opening the image in lightbox mode or to download it. The lightbox will display the image along with some information about it, depending if it's attached to a wiki page or it's an external one, and with some actions like download, toggle the browser full screen mode or start a carousel play of all images found in the page content. You can toggle the visibility of the image caption and action buttons by clicking on the image.
The lightbox feature is disabled by default and can be enabled from the Administration, Look & Feel -> Lightbox section. Checkout the documentation for more information.
Attachments usage refactoring
When moving an attachment, the pages using the moved attachment are now automatically refactored to point to the new location of the attachment. Advanced users can deactivate this refactoring in the move attachment form.
Client-side PDF Export
This release introduces a new extension that allows users to export wiki pages to PDF using the browser's print to PDF feature. It's not bundled in XWiki Standard yet but you can install it with the Extension Manager. The advantage of the client-side PDF export over the current server-side FOP-based export is that the result is closer to the way the wiki page looks in view mode (most of the skin styles are preserved). See the PDF Export Application for more information.
Image Style Administration
An Image Style Administration is now available. This interface allows to define standardized image styles that will later be used by the New Experimental Image Dialog to quickly define the appearance of images.
New Experimental Image Dialog
The WYSIWYG editor has a new (experimental) image dialog that simplifies the insertion and edition of images. The new dialog is currently disabled by default but you can enable it from the WYSIWYG Editor section in the Wiki Administration: look for 'xwiki-image' in the drop down of disabled CKEditor plugins and uncheck it then save.
The new image dialog is integrated with the Image Style Administration section so users can apply image styles defined by an administrator. Checkout the CKEditor Integration documentation for more information.
Attachment Gallery Picker Macro
An Attachment Gallery Picker Macro is now available.
This macro allows to search and select attachments. The results of the search are presented in a grid.
Docker-based Multi-page PDF Export
The PDF Export Application (not bundled by default) added support for Docker-based multi-page PDF export. When installed, this application enhances the export modal to allow for multi-page selection when performing PDF export. Moreover, the PDF is now generated by default asynchronously on the server-side (in a background thread) using a headless Chrome web browser running inside a Docker container. At the end, the user is redirected to the generated PDF (as a temporary resource).
Docker-based Multi-page PDF Export
The PDF Export Application (not bundled by default) added support for Docker-based multi-page PDF export. When installed, this application enhances the export modal to allow for multi-page selection when performing PDF export. Moreover, the PDF is now generated by default asynchronously on the server-side (in a background thread) using a headless Chrome web browser running inside a Docker container. At the end, the user is redirected to the generated PDF (as a temporary resource).
Listing of Extensions Vulnerabilities
A security vulnerabilities section is now available in the administration. This section present the state of the known vulnerabilities of extensions installed on the wiki.
This list is filled based on a periodic scan (running every 24h by default), and uses https://osv.dev/ as its vulnerability database.
Quick Editing Actions
You can now access most of the WYSIWYG editing features using the keyboard, just by typing / (slash). This opens the Quick Actions drop down that lists quick action suggestions based on the context. Rendering macros are exposed as quick actions. Checkout the CKEditor Integration documentation for more information.
Quick Icon Insertion
You can now search for and insert icons using the keyboard, by typing / (slash) and selecting the icon Quick Action. This opens a drop down that lists all the available icons.
