Re: [jspwiki] page access restrictions for logical and vs or

2025-08-02 Thread Juan Pablo Santos Rodríguez
Hi Alex, Apologies on the delay answering back. IIRC, the ACL markup only allows logical or, a way to obtain the equivalent to the logical and would be defining a join group. Perhaps the ACL markup could be expanded to allow logical ands, although that only makes sense for groups. Also, IIRC, XML

CVE-2025-24854: Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Image plugin

2025-07-30 Thread Juan Pablo Santos Rodríguez
Severity: Medium Affected versions: - Apache JSPWiki before Apache JSPWiki up to 2.12.2 Description: A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get som

CVE-2025-24853: Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing

2025-07-30 Thread Juan Pablo Santos Rodríguez
Severity: Medium Affected versions: - Apache JSPWiki before Apache JSPWiki up to 2.12.2 Description: A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive inform

[ANNOUNCE] Apache JSPWiki 2.12.3 released

2025-07-30 Thread Juan Pablo Santos Rodríguez
The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.12.3. This is the fourth release on the 2.12 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here: https://jspwiki-wiki.apache.org/Wik

Moderation turned on for account creation at jspwiki-wiki.a.o

2025-06-10 Thread Juan Pablo Santos Rodríguez
Hi all, Recently we've had another spammer that has been trying to perform several XSS injections at jspwiki-wiki.a.o, without success, while also filling with rubbish the wiki. Instead of editing pages, this time the spammer opted for deleting and recreate them with dirt. Other than the time rem

Re: Time To Move To Jakarta EE

2025-06-05 Thread Juan Pablo Santos Rodríguez
99.9% of the good work goes to Jürgen, who did all the hard work. As for the release, first we should release 2.12.3 (I still got pending rolling It out), then switch the focus to the jakarta branch, we should aim to release it soon after 2.12.3. Cheers, juan pablo El lun, 2 jun 2025, 9:06,

Re: JSPWIKI Syntax to MarkDown Converter

2025-05-10 Thread Juan Pablo Santos Rodríguez
Hi, We use [#1] to generate the markdown wikipages from the source code ones. There's no author or other metadata brought from one place to another, but IIRC, it should preserve plugin invocations, wiki variables, etc., and also moves attachments. The code itself is not too big and easy to follow

Re: [jspwiki] relative links outside the wiki

2025-01-01 Thread Juan Pablo Santos Rodríguez
Hi Alex, and happy new year everyone! You might define/use a new interwiki link ([#1]). Changes on its URL will require a restart though. I don't have the code in front of me, but it might be perfectly possible to put your relative URL there. HTH, juan pablo [#1]: https://jspwiki-wiki.apache.org

Re: jspwiki issue loading a wiki page that exists on disk

2024-09-08 Thread Juan Pablo Santos Rodríguez
happens somewhere around > >> AbstractFileProvider#mangleName but there doesn't seem to be any check for > >> case insensitivity. In this case, the files were created on windows, but > >> served up on linux. > >> > >> I can PR a case for this to norm

Re: help with changing roles in the web.xml

2024-08-22 Thread Juan Pablo Santos Rodríguez
; "Admin" and i need a way to map them into what jspwiki is expecting. > > On Mon, Aug 19, 2024 at 5:32 PM Juan Pablo Santos Rodríguez < > juanpablo.san...@gmail.com> wrote: > > > Hi! > > > > Currently on holidays, mobile, no pc, apologies on brevity and t

Re: jspwiki issue loading a wiki page that exists on disk

2024-08-22 Thread Juan Pablo Santos Rodríguez
Hi! As for the 1st issue, most probably is due to caching being turned on. Deleting the ehcache files prior to starting tomcat up should fix the issue. As for the 2nd issue, sounds like a very probable cause, log should clarify that. Cheers, juan pablo El jue, 22 ago 2024, 1:43, Alex O'Ree esc

Re: Plugins in a mardown flowered wiki

2024-08-19 Thread Juan Pablo Santos Rodríguez
Hmm another in draft :-/ IIRC it's the opposite with jspwiki default syntax, would you mind filing a jira issue to see if it's possible to do st.? so it doesn't get lost. I'm suspecting flexmark is inferring blank line == new paragraph, and that's why it discards the rest of the body, but have to

Re: Streaming a file?

2024-08-19 Thread Juan Pablo Santos Rodríguez
Hi, Seems this was sitting on drafts, apologies :-/ I'd suppose you've already solved this some way, but what would you have needed? Request is accesible from the wiki context, would it have helped to be able to grab the response too? br, jp El jue, 11 jul 2024, 17:26, Ulf Dittmer escribió: >

Re: help with changing roles in the web.xml

2024-08-19 Thread Juan Pablo Santos Rodríguez
Hi! Currently on holidays, mobile, no pc, apologies on brevity and typos. A way back I did connect JSPWiki with and LDAP backend, don't remember doing nothing fancy, perhaps roles did match exactly. I'd suggest to play with the jspwiki-it-cma module, which relies on tomcat-users.xml (defined inl

Re: Plugins in a mardown flowered wiki

2024-07-19 Thread Juan Pablo Santos Rodríguez
Hi Peter, as per [#1], it should work, and if it doesn't, then it's a bug, there are tests checking one line plugin invocations, but not for plugins with body. Does the log yield something regarding the plugin invocation? The other only thing that comes to mind is that the plugin must be a markdo

Re: SampleAjaxPlugin problem

2024-07-10 Thread Juan Pablo Santos Rodríguez
Hi Ulf, That's a bug :-/ Plugin has been unchanged mostly since developed, and the js should be available right away. Would you mind raising a jira for that? Or even better, a PR? O:-) Best regards, juan pablo El mar, 9 jul 2024, 9:43, Ulf Dittmer escribió: > I just stumbled upon > https://jsp

Re: wysiwyg editor replacement

2024-07-07 Thread Juan Pablo Santos Rodríguez
Hi, yup, I've just seen it has been discontinued on 2017 :-/ IIRC, it was chosen b/c it was written with mootools which is(was?) heavily used by JSPWiki then, but surely Dirk knows far better. As js is not my strong suit, I don't have any experience with any of the editors listed on the link you'v

Re: WikiFormsPlugin with file input?

2024-07-07 Thread Juan Pablo Santos Rodríguez
Hi! first message did get sent, in my case wasn't unable to answer back until now. CsrfProtectionFilter[#1] is a filter that is put in place to avoid CSRF attacks. It basically expects to find a hidden input field carrying the user's session id, so all of our forms carry a custom tag[#2] (eg. [#3

Re: problematic CalendarTag <-> WeblogPlugin interaction

2024-07-07 Thread Juan Pablo Santos Rodríguez
and merged just now for 2.12.3-git-01 :-) thanks! On Mon, Jun 24, 2024 at 10:27 AM Ulf Dittmer wrote: > > Rull request created: https://github.com/apache/jspwiki/pull/350 > > On Sun, Jun 23, 2024 at 12:43 PM Ulf Dittmer > wrote: > > > Thanks Dirk, I wasn't aware of the findFreeEntry method. It

Re: Bad signature for jspwiki-wikipages-de-2.12.2.zip

2024-06-28 Thread Juan Pablo Santos Rodríguez
Hi Florian, seems that the old files weren't deleted, the re-uploaded artifact with the corrected signature would be https://archive.apache.org/dist/jspwiki/2.12.2/wikipages/jspwiki-wikipages-de-2.12.2-jspwiki.zip with https://archive.apache.org/dist/jspwiki/2.12.2/wikipages/jspwiki-wikipages-de-2

Re: Bad signature for jspwiki-wikipages-de-2.12.2.zip

2024-06-26 Thread Juan Pablo Santos Rodríguez
27;m okay with not doing a new release and instead replacing the files > that > > have signature issues. > > > > > > Arturo > > > > > > On Mon, Jun 24, 2024 at 9:57 PM Juan Pablo Santos Rodríguez < > > juanpablo.san...@gmail.com> wrote

Re: Bad signature for jspwiki-wikipages-de-2.12.2.zip

2024-06-24 Thread Juan Pablo Santos Rodríguez
Hi! my bad: gpg --keyserver hkps://pgp.mit.edu/ --recv-keys 2D51AAC6 did not return the key, but gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 2D51AAC6 did. Done that, I've checked the sigs and basically the ones on the wikipages folder are the ones giving trouble. In this release, the

Re: Bad signature for jspwiki-wikipages-de-2.12.2.zip

2024-06-24 Thread Juan Pablo Santos Rodríguez
Hi, I did try yesterday and got "Can't check signature: public key not found" (the artifacts are signed with RSA ID 2D51AAC6). Did you send your GPG key to the default gpg server? Perhaps doing gpg --send-key 2D51AAC6 is enough to solve the issue? Same thing happens when checking 2.12.1 artifact

CVE-2024-27136: Apache JSPWiki: Cross-site scripting vulnerability on upload page

2024-06-23 Thread Juan Pablo Santos Rodríguez
Severity: moderate Affected versions: - Apache JSPWiki through 2.12.1 Description: XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade t

Re: Time To Move To Jakarta EE

2024-05-30 Thread Juan Pablo Santos Rodríguez
Hi! IIRC, there's one default method on the public API (Engine?) that relies on javax.servlet. Not that it would break any existing plugin or filter, but it's part of the public API anyway. And maybe from the Session you could grab the http session as well, I'd have to look to be sure. Regarding t

Re: Time To Move To Jakarta EE

2024-05-28 Thread Juan Pablo Santos Rodríguez
Hi Jürgen! I wholeheartedly agree :-) As this would be a major release (JSPWiki 3.0.0), perhaps we should follow the path of other oss projects and lift the JDK requirement to 17 as well? best regards, juan pablo On Mon, May 27, 2024 at 10:00 AM Jürgen Weber wrote: > > Hi jspwiki users, > > ti

User account creation temporarily locked at jspwiki-wiki.a.o due to recent spamming

2024-04-06 Thread Juan Pablo Santos Rodríguez
Hi, as can be seen by the recent changes page, this eastern we've had some heavy, most probably automated spam at jspwiki-wiki.a.o. Basically all of the dirt consisted on automated ways of seeking vulnerabilities (xss, database tampering, session hijacking, etc.). Luckily all of these vectors of a

Re: is there administrative features?

2024-03-30 Thread Juan Pablo Santos Rodríguez
; conf, webapps, bin, etc > > I don't particularly want to put a full path in the config file > > On Wed, Mar 20, 2024 at 7:33 PM Alex O'Ree wrote: > > > Thanks for the info > > > > On Wed, Mar 20, 2024, 6:49 PM Juan Pablo Santos Rodríguez < > > j

Re: is there administrative features?

2024-03-20 Thread Juan Pablo Santos Rodríguez
the latest version. Ref > https://jspwiki-wiki.apache.org/Wiki.jsp?page=CustomUserPreferences > > On Sun, Mar 17, 2024 at 7:06 PM Juan Pablo Santos Rodríguez < > juanpablo.san...@gmail.com> wrote: > > > Hi! > > > > Regarding using the database, yup, It doe

Re: is there administrative features?

2024-03-17 Thread Juan Pablo Santos Rodríguez
ve a kafka setup in the environment and...in theory...if i can detect > the change, i can send a kafka topic message trigger the invalidation for > all of the instances > > > On Sun, Mar 17, 2024 at 5:43 PM Juan Pablo Santos Rodríguez < > juanpablo.san...@gmail.com> wrot

Re: is there administrative features?

2024-03-17 Thread Juan Pablo Santos Rodríguez
es or load balancing, is there > > a way to notify other instances of changed content and/or index needs to be > > updated? > > > > On Tue, Mar 12, 2024 at 3:38 PM Juan Pablo Santos Rodríguez < > > juanpablo.san...@gmail.com> wrote: > > > >> Hi Alex!

Re: is there administrative features?

2024-03-12 Thread Juan Pablo Santos Rodríguez
Hi Alex! thanks for your interest in JSPWiki! :-) As for your questions: Are there any administrative capabilities? like pages to see how much stuff exists in the wiki? for the latter, that can be accomplished via plugin [#1]. IIRC, The default set of wiki pages contains pages for page index, rec

Re: Strange problem with Apache in front of JSPWiki on Tomcat

2024-02-25 Thread Juan Pablo Santos Rodríguez
Hi Ulf, Would you mind sharing how your Apache instance is set up? Does it show to which URL is trying to access the second time? Thx in advance, juan pablo El sáb, 24 feb 2024, 18:23, Ulf Dittmer escribió: > Hi all- > > I'm experiencing a strange problem, and was hoping someone might have ru

Re: Registering a WikiEventListener

2023-12-02 Thread Juan Pablo Santos Rodríguez
https://jspwiki-wiki.apache.org/Wiki.jsp?page=HowToWriteACustomWikiEventListener Anyone interested, please give it a try and share your impressions! O:-) cheers, juan pablo On Sat, Nov 25, 2023 at 3:33 PM Juan Pablo Santos Rodríguez wrote: > > Hi Ulf, > > I've just merged the P

Re: Registering a WikiEventListener

2023-11-25 Thread Juan Pablo Santos Rodríguez
pull/322 > > It's strange that the URL decoding is commented out, because that is > actually needed. > > Ulf > > On Fri, Nov 24, 2023 at 2:49 PM Juan Pablo Santos Rodríguez < > juanpablo.san...@gmail.com> wrote: > > > Hi Ulf! > > > > Hmmm seems to m

Re: Registering a WikiEventListener

2023-11-24 Thread Juan Pablo Santos Rodríguez
istener(myListener) now works fine. > > > > BUT: for both PAGE_REQUESTED and PAGE_DELIVERED, the event's > getPageName() > > method returns null > > The javadocs state "Returns the Wiki page name associated with this > > event. This may be null if unavailable.

Re: Registering a WikiEventListener

2023-11-22 Thread Juan Pablo Santos Rodríguez
ted a lot, and can't > figure out what it is. > > Thanks, > Ulf > > On Wed, Nov 22, 2023 at 3:33 PM Juan Pablo Santos Rodríguez < > juanpablo.san...@gmail.com> wrote: > > > Hi Ulf, > > > > I haven't had time to look into this in detail, but

Re: Registering a WikiEventListener

2023-11-22 Thread Juan Pablo Santos Rodríguez
Hi Ulf, I haven't had time to look into this in detail, but I'd try to register the listener through an Engine lifecycle extension (#1), from there you should be able to register your listener as soon as the Engine is instantiated. WikiJSPFilter fires some Page events, but fires them to the runni

Re: Changing the colors of a site

2023-09-30 Thread Juan Pablo Santos Rodríguez
Hi, if you don't feel comfortable mangling with the less files, as another approach, you can define a template (a folder inside ./jspwiki-war/src/main/webapp/templates) with only a localheader.jsp (see [#1]) file and set there your CSS. If a file is missing from a template, JSPWiki will read if fr

Re: Preventing seeing the page source

2023-08-21 Thread Juan Pablo Santos Rodríguez
Hi Ulf, I don't have a PC in front of me right now, so don't know if it's feasible, but perhaps you could play with [#1] inside the Nav.jsp page? HTH, juan pablo [#1]: https://github.com/apache/jspwiki/blob/master/jspwiki-main/src/main/java/org/apache/wiki/tags/UserCheckTag.java El lun, 21 a

Re: Section Editing broken

2023-08-17 Thread Juan Pablo Santos Rodríguez
Jim Wise (he/him) > jw...@draga.com > > > > > > > On Aug 17, 2023, at 14:33, Juan Pablo Santos Rodríguez < > juanpablo.san...@gmail.com> wrote: > > > > Hi Jim, > > > > Would you mind trying acce

Re: Section Editing broken

2023-08-17 Thread Juan Pablo Santos Rodríguez
;> "Appearance": false, > >>> "Language": "en", > >>> "Layout": "fluid", > >>> "Orientation": "fav-left", > >>> "DateFormat": "dd-MMM- HH:mm", > >&g

Re: Section Editing broken

2023-08-17 Thread Juan Pablo Santos Rodríguez
i 16.5.2 and FireFox 116.0.2. > > > > > > What JVM and App Server are jspwiki-wiki running? Wondering if this is > > the difference. > > > > > > Happy to share any more info here that helps debug as well! > > > > > > -- > > >

Re: Section Editing broken

2023-08-15 Thread Juan Pablo Santos Rodríguez
Hi Jim, I've just tried section editing at jspwiki-wiki.a.o (currently running 2.12.1) and it seem to work well :-? Would you mind trying to refresh the browser's cache and see if that does the trick? I don't recall any change for section editing (or js changes, generally speaking) between 2.11.

[ANNOUNCE] Arturo Bernal as new JSPWiki PMC and committer!

2023-06-21 Thread Juan Pablo Santos Rodríguez
Hi all, We're glad to announce that the JSPWiki PMC has a new member and committer, Arturo Bernal. Welcome! juan pablo, on behalf of the JSPWiki PMC

Re: Re: Re: "Workflow-Problems"

2023-06-16 Thread Juan Pablo Santos Rodríguez
s ok? > > greetings > frank > > > -"Juan Pablo Santos Rodríguez" schrieb: ----- > An: frank.fau...@stuttgarter.de > Von: "Juan Pablo Santos Rodríguez" > Datum: 16.06.2023 01:11 > Kopie: martina.jae...@stuttgarter.de, user@jspwiki.apache.org &g

Re: Re: "Workflow-Problems"

2023-06-15 Thread Juan Pablo Santos Rodríguez
Resending as plaint text, as user@jspwiki.a.o doesn't seem to like inlined attechments, apologies for the noise On Fri, Jun 16, 2023 at 1:00 AM Juan Pablo Santos Rodríguez wrote: > > Hi Frank, Martina, > > would you mind testing 2.12.1-git-01? It should fix this issue, all wo

Re: "Workflow-Problems"

2023-06-14 Thread Juan Pablo Santos Rodríguez
Hi Frank, Seems a refactor [#1] I made three years ago was incomplete and has rendered the workflow page useless since then :-/ This line [#2] should be instead ${decision.workflowId} I trusted the JSPs precompilation build process to catch these kind of errors, but it seems that it doesn't look

CVE-2022-46907: Apache JSPWiki Cross-site scripting on several plugins

2023-05-24 Thread Juan Pablo Santos Rodríguez
Severity: moderate Description: A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Mitigation: Apache JSPWiki

[ANNOUNCE] Apache JSPWiki 2.12.0 released

2023-05-24 Thread Juan Pablo Santos Rodríguez
The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.12.0. This is the first release on the 2.12 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here: https://jspwiki-wiki.apache.org/Wiki

RE: Restrict access for Anonymous

2023-02-13 Thread Juan Pablo Santos Rodríguez
Hi Harald, you may wish to take a look at the department policy file [#1] of jspwiki's portable build; IIRC, anonymous users aren't granted any permission, whereas authenticated ones can view, edit, etc. Please let me know if that policy works out for you or if further help is needed. cheers, ju

Re: Alternative to SpreadSheetFilter (specifically sum)

2022-10-21 Thread Juan Pablo Santos Rodríguez
Hi Lars, There are have been some code changes between 2.8.4 and now (package rename, some internal changes on the wiki engine) that prevents pre-apache filters and plugins to continue working on newer installations. Migrating them is straightforward, however in the case of the spreadsheet filter

Re: Excerpts with ReferringPagesPlugin

2022-09-23 Thread Juan Pablo Santos Rodríguez
Hi Gary, that's a good idea! I don't know what Confluence understands as excerpt. I know it has some macro to mark some section of the page, so you can include excerpts of pages on other pages, but surely that's not what it's shown on the Content by Label macro. ReferringPagesPlugin currently only

Re: CSRF protection causing errors in previews

2022-08-04 Thread Juan Pablo Santos Rodríguez
Jim Wise (he/him) > jw...@draga.com > > > > > > > On Aug 4, 2022, at 10:58, Juan Pablo Santos Rodríguez < > juanpablo.san...@gmail.com> wrote: > > > > Hi Jim, > > > > Most probably is a caching issue, please try to

Re: CVE-2022-28730: Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp

2022-08-03 Thread Juan Pablo Santos Rodríguez
On Wed, Aug 3, 2022 at 10:45 PM Juan Pablo Santos Rodríguez wrote: > > Severity: moderate > > Description: > > A carefully crafted request on AJAXPreview.jsp could trigger an XSS > vulnerability on Apache JSPWiki, which could allow the attacker to execute > javascript

Re: CVE-2022-34158: Apache JSPWiki: User Group Privilege Escalation

2022-08-03 Thread Juan Pablo Santos Rodríguez
On Wed, Aug 3, 2022 at 10:46 PM Juan Pablo Santos Rodríguez wrote: > > Severity: critical > > Description: > > A carefully crafted invocation on the Image plugin could trigger an CSRF > vulnerability on Apache JSPWiki, which could allow a group privilege > escalation o

Re: CVE-2022-28732: Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin

2022-08-03 Thread Juan Pablo Santos Rodríguez
On Wed, Aug 3, 2022 at 10:46 PM Juan Pablo Santos Rodríguez wrote: > > Severity: moderate > > Description: > > A carefully crafted request on WeblogPlugin could trigger an XSS > vulnerability on Apache JSPWiki, which could allow the attacker to execute > javascript in

Re: CVE-2022-28731: Apache JSPWiki CSRF in UserPreferences.jsp

2022-08-03 Thread Juan Pablo Santos Rodríguez
On Wed, Aug 3, 2022 at 10:46 PM Juan Pablo Santos Rodríguez wrote: > > Severity: critical > > Description: > > A carefully crafted request on UserPreferences.jsp could trigger an CSRF > vulnerability on Apache JSPWiki, which could allow the attacker to modify the > e

Re: CVE-2022-27166: Apache JSPWiki: XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2

2022-08-03 Thread Juan Pablo Santos Rodríguez
On Wed, Aug 3, 2022 at 10:45 PM Juan Pablo Santos Rodríguez wrote: > > Severity: moderate > > Description: > > A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS > vulnerability on Apache JSPWiki, which could allow the attacker to execute > javascript

[ANNOUNCE] Apache JSPWiki 2.11.3 released

2022-08-03 Thread Juan Pablo Santos Rodríguez
The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.3. This is the fourth release on the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here: https://jspwiki-wiki.apache.org/Wik

Re: [External] Re: Search not working on unmodified files

2022-05-01 Thread Juan Pablo Santos Rodríguez
s understandable. > > Thank you for this! > > Andy > > From: Juan Pablo Santos Rodríguez [mailto:juanpablo.san...@gmail.com] > Sent: 21 April 2022 22:21 > To: user@jspwiki.apache.org > Subject: Re: [External] Re: Search not working on unmodified files > > Alert! Th

Re: [External] Re: Search not working on unmodified files

2022-04-21 Thread Juan Pablo Santos Rodríguez
your cache sizes on ehcache.xml to avoid this behaviour > > > > Which led to the finding the entry in > > > > https://github.com/apache/jspwiki/blob/master/jspwiki-main/src/main/resources/ini/jspwiki.properties > > < > > https://github.com/apache/jspwiki/blob/m

Re: [External] Re: Search not working on unmodified files

2022-04-18 Thread Juan Pablo Santos Rodríguez
So could it be starting to index, thinking it’s already indexed (despite > the whole WorkingDir being cleared out) and then stopping near-instantly? > > Thanks again, > > Andy > > > From: Juan Pablo Santos Rodríguez [mailto:juanpablo.san...@gmail.com] > Sent: 14 April 2022 16:25 &g

Re: Search not working on unmodified files

2022-04-14 Thread Juan Pablo Santos Rodríguez
Hi Andrew, haven't had the time to look in depth at JSPWIKI-1171, so just some questions / random thoughts: JSPWiki has changed a lot since 2.8, but the wiki pages itself shouldn't require any change, and should be readable by any version of JSPWiki. The Lucene version has been upgraded several t

Re: Security Manager Removal

2022-04-01 Thread Juan Pablo Santos Rodríguez
Hi Jürgen IIRC, the freshcookies dependency uses the security manager under the covers, and there's also some code inside JSPWiki using the security manager. We even have https://issues.apache.org/jira/browse/JSPWIKI-129 (JSPWiki cannot run under a security manager), which was meant to fully supp

Re: Two Servers Sharing Common Wiki

2022-03-05 Thread Juan Pablo Santos Rodríguez
Hi Jerry, Most probably, each JSPWiki instance is running with the cache enabled, with its default values, and that's why they don't "see" the changes made by the other instance. One option is to provide a custom ehcache file which shared the cache with the other instance. IIRC, that kind of setu

[CVE-2022-24948] Apache JSPWiki Cross-site scripting vulnerability on User Preferences screen

2022-02-24 Thread Juan Pablo Santos Rodríguez
Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.1 Description A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to exec

[CVE-2022-24947] Apache JSPWiki CSRF Account Takeover

2022-02-24 Thread Juan Pablo Santos Rodríguez
Severity Critical Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.1 Description Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Mitigation Apache JSPWiki users should upgrade to 2.11.2 or later. Installati

[ANNOUNCE] Apache JSPWiki 2.11.2 released

2022-02-24 Thread Juan Pablo Santos Rodríguez
The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.2. This is the third release on the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here: https://jspwiki-wiki.apache.org/Wiki

Re: logger changes for 2.11.0

2021-12-31 Thread Juan Pablo Santos Rodríguez
t] [%c] [%M] [%l] - %msg%n > appender.rolling.policies.type = Policies > > rootLogger.level = info > rootLogger.additivity = false > rootLogger.appenderRef.rolling.ref = fileLogger > > Am Sa., 18. Dez. 2021 um 09:04 Uhr schrieb Juan Pablo Santos Rodríguez > : > > >

Re: suggestions for a long loading page

2021-12-23 Thread Juan Pablo Santos Rodríguez
every time and again, affecting page load time. regards, juan pablo On Thu, Dec 23, 2021 at 12:09 AM Juan Pablo Santos Rodríguez wrote: > > Hi Gary, > > Don't have the source in front of me right now, so mostly a hunch: looking at > your systeminfo page, cache hits vs misses i

Re: suggestions for a long loading page

2021-12-22 Thread Juan Pablo Santos Rodríguez
Hi Gary, Don't have the source in front of me right now, so mostly a hunch: looking at your systeminfo page, cache hits vs misses is 5.4M vs 3.6M. That seems to me like too many misses... Default cache configuration is for a thousand elements for each cache, so given the amount of pages may be tw

[ANNOUNCE] Apache JSPWiki 2.11.1 released

2021-12-19 Thread Juan Pablo Santos Rodríguez
The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.1. This is the second release on the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here: https://jspwiki-wiki.apache.org/Wik

Re: logger changes for 2.11.0

2021-12-18 Thread Juan Pablo Santos Rodríguez
Jim Wise > jw...@draga.com > > > > > > > On Dec 17, 2021, at 16:31, Juan Pablo Santos Rodríguez < > juanpablo.san...@gmail.com> wrote: > > > > Hi Jürgen, > > > > there's a commented sec

Re: logger changes for 2.11.0

2021-12-17 Thread Juan Pablo Santos Rodríguez
Hi Jürgen, there's a commented section on the jspwiki.properties file setting up a rolling appender for the security log. The default configuration should be the same as before, translated from the equivalent log4j1 configuration that was in place. With that example, the following works for me: s

[SECURITY] Apache JSPWiki affected by Apache Log4J CVE-2021-44228

2021-12-13 Thread Juan Pablo Santos Rodríguez
Hi all, apologies for the cross-posting, please see below notice on how to mitigate recent Log4J's RCE on existing JSPWiki 2.11.0 installations. * 2021-12-13, Apache JSPWiki affected by Apache Log4J CVE-2021-44228

[CVE-2021-44140] Apache JSPWiki Arbitrary file deletion on logout

2021-11-23 Thread Juan Pablo Santos Rodríguez
Severity Critical Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M8 Description Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance by using a carefuly crafted http request on logout, given that those files are reachable to the

[CVE-2021-40369] Apache JSPWiki Cross-site scripting vulnerability on Denounce plugin

2021-11-23 Thread Juan Pablo Santos Rodríguez
Severity Medium Vendor The Apache Software Foundation Versions Affected Apache JSPWiki up to 2.11.0.M8 Description A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript

[ANNOUNCE] Apache JSPWiki 2.11.0 released

2021-11-23 Thread Juan Pablo Santos Rodríguez
The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.0. This is the first release after eight milestones on the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. The release is available here: https://jspwi

Re: ReferringPagesPlugin with columns

2021-11-15 Thread Juan Pablo Santos Rodríguez
On Fri, Nov 5, 2021 at 9:38 PM Gary Kephart wrote: > On 11/5/2021 3:58 AM, Juan Pablo Santos Rodríguez wrote: > > Hi Gary, > > > > the plugin itself doesn't have any parameters to have that kind of > output. > > However, you could add a custom CSS style [#1] so t

Re: ReferringPagesPlugin with columns

2021-11-05 Thread Juan Pablo Santos Rodríguez
Hi Gary, the plugin itself doesn't have any parameters to have that kind of output. However, you could add a custom CSS style [#1] so the list gets as many columns as you need. This CSS could be built into all the referral plugins, it would be a nice feature to have, so there's no need to have th

Re: Converting JSPWiki to HTML

2021-10-06 Thread Juan Pablo Santos Rodríguez
Hi, you can also use a RenderingManager + MarkupParser, you can see an example at [#1]. Note that wiki markup may contain plugins, acls, variables, etc., tldr: you'll need a running WikiEngine to do the wiki -> html conversion. If you need to run this conversion on a standalone basis, the TestEngi

Re: ImageMapPlus

2021-09-08 Thread Juan Pablo Santos Rodríguez
Hi, yep, plugin should be recompiled using the classes under jspwiki-api-LATEST.jar. Another option would be using the %%maps style present on the Haddock template [#1] best regards, juan pablo [#1]: https://jspwiki-wiki.apache.org/Wiki.jsp?page=Maps On Wed, Sep 8, 2021 at 8:34 AM Ulf Dittmer

Re: Ordered lists broken into columns restart numbering

2021-09-07 Thread Juan Pablo Santos Rodríguez
Hi Gary, there's a multi-column style [#1] that can be combined with some in-place css magic to achieve that: %%add-css .columns { counter-reset: mycounter } .columns ol { list-style: none; } .columns ol li:before { counter-increment: mycounter; content: counter(mycounter) ". "; } /% #qw

Re: Detect data directory changes

2021-08-17 Thread Juan Pablo Santos Rodríguez
ond without reload corresponding tomcat > context. > > I will try implement first variant from your suggestions. Any additional > information or ideas greatly appreciated. > > > On 2021/07/27 13:31:13, Juan Pablo Santos Rodríguez > wrote: > > Hi Alex,> > >

Re: Detect data directory changes

2021-07-27 Thread Juan Pablo Santos Rodríguez
Hi Alex, apologies for the delayed response. JSPWiki by default uses ehcache to request pages faster. If a page is changed externally to JSPWiki, it won't be able to detect that a change has been made on that page, and won't see it until the cache expires. Also, modifying a page externally to JS

Re: DEBUG org.apache.wiki.WatchDog - http-nio-8080-exec-39: Exiting state Filtering for URL /JSPWiki/Edit.jsp

2021-04-25 Thread Juan Pablo Santos Rodríguez
Hi, could hoy provide more details about your setup? I.e. any custom configuration, log stacktraces (if any), etc. Is this related to the previous access issue you had? regards, juan pablo El sáb., 24 abr. 2021 14:05, Олександр Ридзевський escribió: > Kind times! > > I have problem with jspw

Re: Any way for 2.11x to insert arbitrary page by URL

2021-04-25 Thread Juan Pablo Santos Rodríguez
Hi, No need of custom plugins, you can use the viewer style, see [#1] :-) Be aware rendering external sites might not be a great idea, due to it's security implications. Regards, juan pablo [#1]: https://jspwiki-wiki.apache.org/Wiki.jsp?page=Viewer#section-Viewer-Usage El dom., 25 abr. 2021 1

Re: JSPWiki: Unable to load and setup properties from jspwiki.properties

2021-04-22 Thread Juan Pablo Santos Rodríguez
Hi Alex, (apologies for brevity & typos, on mobile) Inside the 2nd stacktrace you can see the root cause: java.io.IOException: Page directory is not writable: /var/lib/jspwiki/pages First stacktrace contains a similar error, but for a different folder, please check permissions on those files for

Re: Left Menu width (Haddock)

2021-04-19 Thread Juan Pablo Santos Rodríguez
Hi, as a side note, and because I remember noticing / asking time ago, why the 21.654752221994123% and not anything else, rounder, like f.ex 20%? Well it is so the Sidebar and the page content mantain a golden ratio based proportion; even more, phi is declared as a less variable on source! [#1] T

Re: JSPWiki: Unable to load and setup properties from jspwiki.properties

2021-01-11 Thread Juan Pablo Santos Rodríguez
ini/jspwiki.properties > > Any ideas why Tomcat9 did not find the jspwiki.properties file? > -- > -jim > Jim Willeke > > > On Sun, Dec 27, 2020 at 3:34 PM Juan Pablo Santos Rodríguez < > juanpablo.san...@gmail.com> wrote: > > > Hi, > > > > it&#

Re: wro4j upgrade

2021-01-03 Thread Juan Pablo Santos Rodríguez
Hi Dirk, ugh :-( I'll revert it later today, didn't see on the release notes provided by dependabot any reference to newer JDKs needed, but in fact it is noted there; I'm seeing now that beginning with wro4j 1.9.0, it requires JDK >= 9. At home I use JDK 15, so didn't catch it here either.. Will

Re: JSPWiki: Unable to load and setup properties from jspwiki.properties

2020-12-27 Thread Juan Pablo Santos Rodríguez
suosl.org/jspwiki/2.11.0.M8/binaries/webapp/JSPWiki.war > > -- > -jim > Jim Willeke > > > On Mon, Dec 21, 2020 at 3:22 PM Jim Willeke wrote: > > > And that is what I have attempted. > > And even that does not work. > > -- > > -jim > > Jim Willeke &

Re: JSPWiki: Unable to load and setup properties from jspwiki.properties

2020-12-21 Thread Juan Pablo Santos Rodríguez
- sudo apt upgrade > > and the Operating system, let's Encrypt, nginx, Tomcat, and Java would all > be upgraded as needed. > > any thoughts? > > -- > -jim > Jim Willeke > > > On Thu, Dec 17, 2020 at 2:19 PM Juan Pablo Santos Rodríguez < > juanpa

Re: JSPWiki: Unable to load and setup properties from jspwiki.properties

2020-12-17 Thread Juan Pablo Santos Rodríguez
mcat. > Is that correct? > > -- > -jim > Jim Willeke > > > On Tue, Dec 15, 2020 at 3:44 PM Juan Pablo Santos Rodríguez < > juanpablo.san...@gmail.com> wrote: > > > Hi Jim, > > > > apologies, the e-mail got stuck in drafts and I didn't noti

Re: JSPWiki: Unable to load and setup properties from jspwiki.properties

2020-12-15 Thread Juan Pablo Santos Rodríguez
t: 4620) > Memory: 255.9M > CGroup: /system.slice/tomcat9.service > └─574 /usr/lib/jvm/default-java/bin/java > -Djava.util.logging.config.file=/var/lib/tomcat9/conf/logging.properties > -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager > -Djava.awt.he

[ANNOUNCE] Apache JSPWiki 2.11.0.M8 released

2020-12-14 Thread Juan Pablo Santos Rodríguez
The Apache JSPWiki team is pleased to announce the release of JSPWiki 2.11.0.M8. This is the eighth release towards the 2.11 series of Apache JSPWiki, a feature-rich and extensible WikiWiki engine built around the standard JEE components. M# releases are as production-ready as any other JSPWiki re

Re: attachment security policy

2020-12-08 Thread Juan Pablo Santos Rodríguez
ers" can create, edit and rename > pages. > // They can also view all the groups. > grant principal org.apache.wiki.auth.GroupPrincipal "RegisteredUsers" { > permission org.apache.wiki.auth.permissions.PagePermission "*:*", > "modify,rename"; > permission org.apache.

Re: JSPWiki: Unable to load and setup properties from jspwiki.properties

2020-12-07 Thread Juan Pablo Santos Rodríguez
Hi Jim, you mention initially that the war is deployed as folder.war instead of ldapwiki.war, is that correct? What files are placed inside $TOMCAT_HOME/work? Also, would you mind starting tomcat providing it a "-Dlog4j.rootCategory=DEBUG,ConsoleLog" argument? That should provide more information

Re: attachment security policy

2020-12-07 Thread Juan Pablo Santos Rodríguez
Hi Gary, inside JSPWiki, Attachments are considered a special type of Pages, so the same policy rules & syntax should apply. In this case, the following permission inside the anonymous role block should be enough: permission org.apache.wiki.auth.permissions.PagePermission "*:LeftMenu/mylogo.png",

  1   2   3   >