Release Notes for XWiki 18.9.0-rc-1
This is the release notes for XWiki Commons, XWiki Rendering and XWiki Platform. They share the same release notes as they are released together and have the same version.
<insert description of release here>
New and Noteworthy (since XWiki <version - 1>)
Full list of issues fixed and Dashboard for <final version here even for RC, e.g. 10.5>.
For Users
Confirm an export opened from a link
Following a link to an export, such as a bookmarked /bin/export/ URL, now opens the "Confirm the Export" page instead of exporting right away. The page lists the requested export parameters, and a click on "Export" resubmits the export: see Confirm an Export Started From a Link. Exports started from the Export modal are not affected, and a script exports directly by sending the export URL as a POST request.
Gallery macro adapted to the color theme
The Gallery macro now uses the panel colors of the current color theme instead of a fixed black background, and its maximize and minimize buttons use icons from the current icon theme.
No more "hide suggestions" button in the quick search
The quick search suggestions no longer display a "hide suggestions" button at the top of the panel: close them by pressing Escape or by moving the focus away from the search field. The "Go to search page…" link has also moved from the top to the bottom of the panel, after the results.
Miscellaneous
Localized sizes and speeds in the attachment uploader:
The attachment uploader now writes file sizes, upload progress and upload speeds with the units of the language XWiki is displayed in, for example 2.5MB/s in English and 2,5Mo/s in French. These units are decimal, a megabyte being 1,000,000 bytes, and files of a gigabyte or more are now shown in gigabytes. Learn how to attach a file to a page.
For Admins
CSRF tokens shared by all cluster nodes:
The CSRF token of a user is now derived from the authentication validation key instead of being kept in memory: it survives a restart, and all the nodes of a cluster accept the same token as long as they share the same xwiki.authentication.validationKey (see Clustering). Tokens now rotate every 24 hours by default (a token stays valid 24 to 48 hours), which can be changed with the new csrf.tokenLifetime property of xwiki.properties.
Modified scheduler jobs take effect without re-scheduling:
When you save a scheduler job that is already scheduled or paused, it is now reloaded automatically, so changes to its script, cron expression or execution context take effect right away while the job keeps its scheduled or paused state. Previously you had to unschedule and schedule the job again (or restart XWiki), otherwise it kept running its previous definition. See the Scheduler Application.
For Developers
Pickers for one or more locations
The new spacePicker Velocity macro displays a suggest input to pick one or more locations as you type. The new compactLocationPicker Velocity macro adds a button next to it, which opens a page tree in a drop down to browse for the locations as an alternative. A wiki macro parameter of type java.util.List<org.xwiki.model.reference.SpaceReference> is now edited with the compact location picker. Learn how to use them.
Export format handlers
An extension can now add an export format to the export action, or replace a native one, by providing an org.xwiki.export.ExportFormatHandler component whose hint is the value of the format request parameter: see Export Format Handler API.
Miscellaneous
Shorter HTML displayer template names for parameterized types:
An HTML displayer template for a parameterized type can now use a short name built from simple class names, such as list(spacereference).vm for java.util.List<org.xwiki.model.reference.SpaceReference>. The fully qualified name is still looked up first, so a template can always target one precise type. See the picker documentation.
Static function to display a notification:
The new XWiki.widgets.Notification.show(text, type, options) JavaScript function displays a notification and returns it. It takes the same parameters as the XWiki.widgets.Notification constructor and is now the preferred way to display a notification. Learn more about it.
Plain CSS skin customizations with custom.css:
Custom skins can now add their own styling in plain CSS by overriding the new custom.css file of the Flamingo skin. It is appended at the end of the skin's main stylesheet, after all its LESS styles, and can use the CSS properties of the skin, such as var(--brand-primary). The less/custom.less file is deprecated in its favor, but is still imported so existing customizations keep working. Learn more about it.
Shared TypeScript declaration of the XWiki global object:
TypeScript packages can now declare the global XWiki object by referencing the types-only @xwiki/platform-xwiki-utils/global entry, rather than each declaring their own copy of it. The shared XWikiGlobal type now also covers the XWiki.widgets.Notification and XWiki.widgets.ConfirmationBox widgets. Learn how to declare it.
Script APIs for the maximum page title and reference lengths:
$xwiki.documentTitleMaxLength and $xwiki.documentLocalReferenceMaxLength return the maximum length of a page title and of a page's local reference, as allowed by the database. The standard editor, the in-place editor and the AppWithinMinutes title fields now use the first one, so a title that is too long can no longer be entered and then fail to save. $doc.getLocalReferenceMaxLength() and XWikiDocument#getLocalReferenceMaxLength() are deprecated in favour of the new APIs.
Upgrades
The following runtime dependencies have been upgraded (they have a different release cycle than XWiki Commons, XWiki Rendering and XWiki Platform):
Moved Modules
<description deprecated, retired and moved projects>
Translations
The following translations have been updated:
Tested Browsers & Databases
Automated Testing
XWiki executes a lot of automated tests during its build, testing all supported configurations.
Security Issues
Security issues are not listed in issue lists or dashboards to avoid disclosing ways to use them, but they will appear automatically in them once they're disclosed. See the XWiki Security Policy for more details.
Known issues
Backward Compatibility and Migration Notes
General Notes
- When upgrading make sure you compare and merge the following XWiki configuration files since some parameters may have been modified, removed or added:
- xwiki.cfg
- xwiki.properties
- web.xml
- hibernate.cfg.xml
- Add xwiki.store.migration=1 in xwiki.cfg so that XWiki will attempt to automatically migrate your current database to any new schema. Make sure you backup your Database before doing anything.
Issues specific to XWiki 18.9.0-rc-1
Prototype.js String#stripTags() and String#unescapeHTML() removed
For security reasons, XWiki no longer lets Prototype.js add the stripTags() and unescapeHTML() methods to JavaScript strings: Prototype.js' stripTags(), which unescapeHTML() calls, is vulnerable to a regular expression denial of service (CVE-2020-27511), and there is no fixed Prototype.js version. XWiki itself doesn't use these methods, but JavaScript code (e.g. from extensions) that still calls them now fails with TypeError: ... is not a function. This also affects the Autocompleter and InPlaceEditor of Script.aculo.us' controls.js, which XWiki doesn't load itself.
To fix such code, stop calling these methods. To get the text of an HTML string without its tags, parse it with DOMParser and read the textContent of the result. The other string methods added by Prototype.js, such as escapeHTML(), are still available.
CSRF tokens can no longer be cleared
The CSRF token of a user is now derived from the authentication validation key, the user and the current time period instead of being stored, so it cannot be cleared anymore: CSRFToken#clearToken() and $services.csrf.clearToken() are deprecated and do nothing. Code calling them to invalidate the token of the current user should stop relying on it: the token now only changes when its lifetime (csrf.tokenLifetime in xwiki.properties) expires or when the validation key changes.
Export URLs require a POST request
The export action now performs an export only for a POST request. Opening an export URL in a browser shows a "Confirm the Export" page from which the export is resubmitted, and a script calling the export action (a curl or wget backup, for instance) has to send a POST request instead of a GET one. An export format added through the org.xwiki.platform.template.exportFormats UI extension point whose URL targets the export action has to declare method=post.
API Breakages
The following APIs were modified since XWiki <version - 1>:
