This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.

This release brings several Live Data improvements: new entries are saved automatically, entries keep their positions while being edited, and edit mode is now turned on and off with a dedicated button. The experimental BlockNote editor now lets you edit Code macros in place, as code blocks, and shows the same realtime edit actions as the WYSIWYG editor. In addition, following a link to an export, such as a bookmarked export URL, now asks you to confirm the export instead of starting it right away. For developers, there are new Velocity macros to pick one or more locations, a way for extensions to add or replace export formats, new Live Data APIs to fetch and delete single entries, and plain CSS skin customizations. This release contains security fixes, with the highest severity being 9.3/10.

New and Noteworthy (since XWiki 18.8.0)

Full list of issues fixed and Dashboard for 18.9.0.

For Users

Confirm an export opened from a link

Following a link to an export, such as a bookmarked /bin/export/ URL, now opens the "Confirm the Export" page instead of exporting right away. The page lists the requested export parameters, and a click on "Export" resubmits the export: see Confirm an Export Started From a Link. Exports started from the Export modal are not affected, and a script exports directly by sending the export URL as a POST request.

Live Data UX improvements

Edit mode is now turned on and off with an "Edit mode" button, showing a pencil icon next to the Live Data menu (instead of the previous checkbox inside that menu). The button stays pressed while edit mode is on.

Any Live Data can also be maximized from its menu, to cover the whole window and focus on its entries. "Minimize" in the same menu, or the "Escape" key, brings it back to its normal state.

Automatic save for Live Data entries

In edit mode, a new entry no longer needs to be manually validated: it is now created as soon as one of its cells gets a value. A new row with no value yet can still be dropped with its "Cancel" button.

Entries can also be deleted from edit mode, with the "Delete" button on their right.

Edit Code Macros in place with BlockNote

The BlockNote editor now displays the standalone Code Macro calls (as opposed to the inline ones) as code blocks, styled like in view mode. Edit the code in place, and pick its language from the selector shown when hovering the block, which highlights the code accordingly. The other parameters of the macro are kept on save.

Code blocks inserted from the slash menu are now saved as Code Macro calls instead of verbatim blocks. Inline Code Macro calls, or calls taking their code from the source parameter, are still edited through the Macro edit modal.

Realtime edit actions in the BlockNote editor

When editing with the BlockNote editor, the usual edit buttons are replaced by the same realtime edit actions as in the realtime WYSIWYG editor. They show who is editing the Page with you, warn you when the connection is lost, and display the save status ("Unsaved", "Saving", "Saved"), so you now know when the automatic save happens. You can also summarize your changes and browse the versions created during the session.

The "Leave Collaboration" action is not available with BlockNote yet, and clicking a collaborator opens their profile instead of scrolling to where they are typing.

Gallery macro adapted to the color theme

The Gallery macro now uses the panel colors of the current color theme instead of a fixed black background, and its maximize and minimize buttons use icons from the current icon theme.

No more "hide suggestions" button in the quick search

The quick search suggestions no longer display a "hide suggestions" button at the top of the panel: close them by pressing Escape or by moving the focus away from the search field. The "Go to search page…" link has also moved from the top to the bottom of the panel, after the results.

Miscellaneous

• Localized sizes and speeds in the attachment uploader:

  The attachment uploader now writes file sizes, upload progress and upload speeds with the units of the language XWiki is displayed in, for example 2.5MB/s in English and 2,5Mo/s in French. These units are decimal, a megabyte being 1,000,000 bytes, and files of a gigabyte or more are now shown in gigabytes. Learn how to attach a file to a page.

• Live Data entries keep their positions in edit mode:

  While edit mode is on, the entries of a Live Data keep their positions when a value changes. This ensures that edited entries no longer move around instead of being sorted or filtered out, or possibly moved to another page, as soon as the value is saved. The ignored rules apply again as soon as they are manually changed, or edit mode is turned off.

For Admins

• CSRF tokens shared by all cluster nodes:

  The CSRF token of a user is now derived from the authentication validation key instead of being kept in memory: it survives a restart, and all the nodes of a cluster accept the same token as long as they share the same xwiki.authentication.validationKey (see Clustering). Tokens now rotate every 24 hours by default (a token stays valid 24 to 48 hours), which can be changed with the new csrf.tokenLifetime property of xwiki.properties.

• Modified scheduler jobs take effect without re-scheduling:

  When you save a scheduler job that is already scheduled or paused, it is now reloaded automatically, so changes to its script, cron expression or execution context take effect right away while the job keeps its scheduled or paused state. Previously you had to unschedule and schedule the job again (or restart XWiki), otherwise it kept running its previous definition. See the Scheduler Application.

For Developers

Pickers for one or more locations

The new spacePicker Velocity macro displays a suggest input to pick one or more locations as you type. The new compactLocationPicker Velocity macro adds a button next to it, which opens a page tree in a drop down to browse for the locations as an alternative. A wiki macro parameter of type java.util.List<org.xwiki.model.reference.SpaceReference> is now edited with the compact location picker. Learn how to use them.

Export format handlers

An extension can now add an export format to the export action, or replace a native one, by providing an org.xwiki.export.ExportFormatHandler component whose hint is the value of the format request parameter: see Export Format Handler API. 

Live Data APIs to fetch and delete single entries

LiveDataEntryStore has a new get(Object entryId, List<String> properties) method, fetching one entry with at least the given properties, and the REST resource of one entry now accepts the matching properties query parameter. The Live Table source now implements remove, so its entries can be deleted. LiveTableNewRowNamingStrategy has a new getNewEntryLocation method telling where new entries are created: a custom strategy should implement it, so that edit rights can be properly checked for cells of a new row (i.e., before its creation). See Live Data Extension Points.

On the JavaScript side, LiveDataSource has the new getEntry and removeEntry methods, and addEntry now returns the values of the created entry. Logic has the new deleteEntry, getEntryKey, getEntryKeys, isMaximized and toggleMaximized methods, as described in the Live Data API.

Miscellaneous

• Shorter HTML displayer template names for parameterized types:

  An HTML displayer template for a parameterized type can now use a short name built from simple class names, such as list(spacereference).vm for java.util.List<org.xwiki.model.reference.SpaceReference>. The fully qualified name is still looked up first, so a template can always target one precise type. See the picker documentation.

• Static function to display a notification:

  The new XWiki.widgets.Notification.show(text, type, options) JavaScript function displays a notification and returns it. It takes the same parameters as the XWiki.widgets.Notification constructor and is now the preferred way to display a notification. Learn more about it.

• Plain CSS skin customizations with custom.css:

  Custom skins can now add their own styling in plain CSS by overriding the new custom.css file of the Flamingo skin. It is appended at the end of the skin's main stylesheet, after all its LESS styles, and can use the CSS properties of the skin, such as var(--brand-primary). The less/custom.less file is deprecated in its favor, but is still imported so existing customizations keep working. Learn more about it.

• Shared TypeScript declaration of the XWiki global object:

  TypeScript packages can now declare the global XWiki object by referencing the types-only @xwiki/platform-xwiki-utils/global entry, rather than each declaring their own copy of it. The shared XWikiGlobal type now also covers the XWiki.widgets.Notification and XWiki.widgets.ConfirmationBox widgets. Learn how to declare it.

• Script APIs for the maximum page title and reference lengths:

  $xwiki.documentTitleMaxLength and $xwiki.documentLocalReferenceMaxLength return the maximum length of a page title and of a page's local reference, as allowed by the database. The standard editor, the in-place editor and the AppWithinMinutes title fields now use the first one, so a title that is too long can no longer be entered and then fail to save. $doc.getLocalReferenceMaxLength() and XWikiDocument#getLocalReferenceMaxLength() are deprecated in favour of the new APIs.

Upgrades

The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):

Translations

The following translations have been updated: 

• German
• French

Tested Browsers & Databases

Automated Testing

XWiki executes a lot of automated tests during its build, testing all supported configurations.

Security Issues

Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the XWiki Security Policy for more details.

Known issues

• Bugs we know about

Backward Compatibility and Migration Notes

General Notes

• When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
  • xwiki.cfg
  • xwiki.properties
  • web.xml
  • hibernate.cfg.xml
• Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.

Issues specific to XWiki 18.9.0

Prototype.js String#stripTags() and String#unescapeHTML() removed

For security reasons, XWiki no longer lets Prototype.js add the stripTags() and unescapeHTML() methods to JavaScript strings: Prototype.js' stripTags(), which unescapeHTML() calls, is vulnerable to a regular expression denial of service (CVE-2020-27511), and there is no fixed Prototype.js version. XWiki itself doesn't use these methods, but JavaScript code (e.g. from extensions) that still calls them now fails with TypeError: ... is not a function. This also affects the Autocompleter and InPlaceEditor of Script.aculo.us' controls.js, which XWiki doesn't load itself.

To fix such code, stop calling these methods. To get the text of an HTML string without its tags, parse it with DOMParser and read the textContent of the result. The other string methods added by Prototype.js, such as escapeHTML(), are still available.

CSRF tokens can no longer be cleared

The CSRF token of a user is now derived from the authentication validation key, the user and the current time period instead of being stored, so it cannot be cleared anymore: CSRFToken#clearToken() and $services.csrf.clearToken() are deprecated and do nothing. Code calling them to invalidate the token of the current user should stop relying on it: the token now only changes when its lifetime (csrf.tokenLifetime in xwiki.properties) expires or when the validation key changes.

Export URLs require a POST request

The export action now performs an export only for a POST request. Opening an export URL in a browser shows a "Confirm the Export" page from which the export is resubmitted, and a script calling the export action (a curl or wget backup, for instance) has to send a POST request instead of a GET one. An export format added through the org.xwiki.platform.template.exportFormats UI extension point whose URL targets the export action has to declare method=post.

API Breakages

The following APIs were modified since XWiki 18.8.0:

No breakage!

Credits

• Andi Chandler
• Clément Christiaens
• Ishu Patel
• Lucas Charpentier
• Manuel Leduc
• Marius Dumitru Florea
• Michael Hamann
• Nicoleta Ciaușu
• Pierre Jeanjean
• Raphael
• Simon Urli
• Simpel
• Thiago Krieck
• Thomas Mortagne
• Vincent Massol
• xrichard