https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/<p>Job to construct a build version of the complete Silverpeas Collaborative platform.</p>
<p>This job makes a Silverpeas distribution of a given build version and then publishes into our file repository ready to be downloaded and installed.</p>
<p>The job is triggered every sunday and wednesday in the night.</p>Silverpeas_Master_AutoDeploySilverpeas_Master_AutoDeploySilverpeas_Master_AutoDeploySilverpeas_Master_AutoDeployhttps://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/trueLancé par une alarme périodiqueSKIP_TESTfalseSKIP_QUALITYfalse116456f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube11643f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/master3f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/master3f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1164eca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/mastereca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/mastereca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11643371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1164ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11640c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11647b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-AssemblyAaD0l2pebQNaPUmG7crvSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=masterAaD0uxyCkj6CGoBn7yygSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Components&branch=masterbuild.yamlbuild.yamltarget/build.yamlfalse6.5-build2609302406508710550775Silverpeas_Master_AutoDeploy 6.5-build2609301164false116463961SUCCESS1790789040596https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1164/- core-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javacore-restapi/src/site/resources/index.htmlcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javacore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javacore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentListResource.javacore-web/src/main/java/org/silverpeas/core/webapi/publication/SharedPublicationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/rating/RatingResource.javacore-web/src/main/java/org/silverpeas/core/webapi/sharing/TicketResource.javacore-restapi/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javacore-web/src/main/java/org/silverpeas/core/webapi/publication/PublicationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javacore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/UserProfileResource.javacore-web/src/main/java/org/silverpeas/core/webapi/mylinks/MyLinksResource.javacore-web/src/main/java/org/silverpeas/core/webapi/security/CipherKeyResource.javacore-web/src/main/java/org/silverpeas/core/webapi/variables/VariablesResource.javacore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/RelationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/search/SearchResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentsResource.javacore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javacore-web/src/main/java/org/silverpeas/core/webapi/util/logging/LogResource.javacore-web/src/main/java/org/silverpeas/core/webapi/node/AbstractNodeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/AuthenticationResource.javacore-rs/pom.xmlcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authenticated.javacore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/UserGroupProfileResource.javacore-library/src/main/java/org/silverpeas/core/i18n/AbstractI18NBean.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/invitation/InvitationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscribeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/preferences/MyPreferencesResource.javacore-web/src/main/java/org/silverpeas/core/webapi/cache/VolatileCacheResource.javacore-web/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/FilteredPdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/selection/SelectionBasketResource.javacore-web/src/main/java/org/silverpeas/core/webapi/util/logging/SilverLoggerConfigurationResource.javapom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SharedAttachmentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/thesaurus/ThesaurusResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaPlayerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/language/LanguageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/sharing/SharingResource.javacore-web/src/main/java/org/silverpeas/core/webapi/wysiwyg/WysiwygEditorConfigResource.javacore-web/src/main/java/org/silverpeas/core/webapi/session/SilverpeasUserSessionTokenResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResourceCreator.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/AttachmentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/bundle/BundleResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/UnsubscribeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/workflow/ReplacementResource.javacore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaec9caee6b1242b8d5893ed5ece0884304d811cb01790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGenerate the documentation of the REST API with Swagger instead of Smart-Doc
Smart-Doc parses the sources with QDox and chokes on constructs Silverpeas
relies on, silently reporting a success while producing an incomplete
documentation. Swagger scans the compiled classes by reflection and understands
the JAX-RS annotations, so the whole REST API is covered.
The new core-restapi module gathers the web resources of all the modules into a
single OpenAPI 3.1 document, rendered by Redoc and published on its own at
docs/restapi/core. It produces nothing but that documentation and builds only
with the restapi profile, from which the Smart-Doc plugin is dropped.
All the 217 operations, spread over 168 paths and 86 schemas, are now
documented: a summary, a success response with its schema, and the errors the
endpoint can answer. The responses common to several endpoints are declared once
for all:
* @Authenticated and @Authorized, besides the security schemes they already
described, bring the 401 and 403 responses of the protected resources;
* the 503 is brought by CommonResponsesFilter, applied once the specification
has been figured out. It cannot come from another meta-annotation of the web
resources: at class level Swagger returns the responses of the first
meta-annotation declaring some instead of merging them all, so a second one
would silently discard the responses of @Authenticated and @Authorized;
* the recurring 404, 400 and 409 are factored out into the @NotFound,
@BadRequest and @Conflict annotations of the new annotation.doc package.
Contrary to the class level one, the method level lookup of Swagger does
merge, but the description of such an annotation takes precedence over the
one an endpoint would declare for the same status code, hence an endpoint
needing another wording must not be annotated.
Documenting the endpoints brought several defects to light, which are fixed
here: the wrong descriptions of the personal space endpoints of SpaceResource, a
test endpoint left over in CipherKeyResource, and the conflicting setters of
AbstractI18NBean for the translations property, which made the scan fail.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200ec9caee6b1242b8d5893ed5ece0884304d811cb0Generate the documentation of the REST API with Swagger instead of Smart-Doceditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaPlayerResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/RelationResource.javaeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authenticated.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/cache/VolatileCacheResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResourceCreator.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javaaddcore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javaeditpom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/UserGroupProfileResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/invitation/InvitationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/search/SearchResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/security/CipherKeyResource.javaeditcore-library/src/main/java/org/silverpeas/core/i18n/AbstractI18NBean.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/FilteredPdcResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/workflow/ReplacementResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/wysiwyg/WysiwygEditorConfigResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/session/SilverpeasUserSessionTokenResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscribeResource.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/sharing/TicketResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/rating/RatingResource.javaeditcore-web/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/mylinks/MyLinksResource.javaaddcore-restapi/src/site/resources/index.htmleditcore-web/src/main/java/org/silverpeas/core/webapi/util/logging/LogResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/UnsubscribeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/AttachmentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/thesaurus/ThesaurusResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/UserProfileResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/publication/PublicationResource.javaaddcore-restapi/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/language/LanguageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/variables/VariablesResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/selection/SelectionBasketResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/sharing/SharingResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/publication/SharedPublicationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/bundle/BundleResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentsResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/AuthenticationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SharedAttachmentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/util/logging/SilverLoggerConfigurationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentListResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/node/AbstractNodeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/preferences/MyPreferencesResource.javaeditcore-rs/pom.xml
- core-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javacore-restapi/pom.xmlc097c5d943af83fb5ce284ad45b733a9d806b7611790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comMake the schema resolver of Swagger aware of the JAXB annotations
The resolver figures the properties of a web entity out with a plain Jackson
object mapper, whereas Silverpeas serializes them with the introspector of the
JAXB annotations. The generated schemas were therefore describing properties
that never reach the wire and missing others that do:
* an entity whose access is set to XmlAccessType.FIELD was described by its
getters instead of its fields. SpaceAppearanceEntity came out with two
properties where six are serialized;
* a member annotated with @XmlTransient was described all the same.
PdcAxisValueEntity came out with eleven properties where nine are
serialized.
The JAXBAnnotationsHelper of Swagger is of no help here: it reads @XmlElement,
@XmlElementWrapper and @XmlAttribute only, and only to feed the XML metadata of
a schema, never its visibility. As for the Jackson module bringing that
introspector, it does declare itself to the ServiceLoader, but Swagger never
asks for the modules available in the classpath.
The resolver declared here sets the introspector on a mapper of its own, the
very way the JSON codec of Silverpeas does, so that it applies to the resolution
of the schemas only. Ten business objects were documented that no endpoint ever
answers -- User, UserDetail, Domain, Quota, SettingBundle, PdcPosition and the
like -- and they are gone now.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200c097c5d943af83fb5ce284ad45b733a9d806b761Make the schema resolver of Swagger aware of the JAXB annotationsaddcore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javaeditcore-restapi/pom.xml
- core-restapi/src/main/openapi/openapi.yamlcore-restapi/pom.xmlcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthenticatedAnnotationProcessor.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthorizedAnnotationProcessor.java692a545a5347eefc22d5e8f1949b6ce94151f2741790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comPublish nothing but the documentation of the REST API
The generated specification declared no info section, which OpenAPI requires. A
renderer refuses to display such a document, whatever the quality of the rest of
it, and Redoc did. Contrary to the plugin of SmallRye, the one of Swagger has no
parameter to fill that section in, hence the document of its own declared here:
the scan completes it, and Maven fills its version in.
Besides the documentation of the REST API, the module was publishing the site
Maven builds for it: the reports about the dependencies, the SCM, the javadoc of
a module that has almost no source. Those reports aren't produced any more, and
what the site brings along -- its decoration and its sitemap, of no use to the
rendering page -- is dropped once the site has been built, before it gets
published. The published tree is now made of the rendering page, the
specification in both of its formats, and the rendering engine.
Skipping the site altogether looked simpler but isn't an option: the deploy goal
of the site plugin reads the very same maven.site.skip property as its site
goal, so the documentation would have silently stopped being published.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200692a545a5347eefc22d5e8f1949b6ce94151f274Publish nothing but the documentation of the REST APIeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthorizedAnnotationProcessor.javaeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javaaddcore-restapi/src/main/openapi/openapi.yamleditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthenticatedAnnotationProcessor.javaeditcore-restapi/pom.xml
- core-restapi/pom.xml078323a23b15cb23bbbcaa797991a709645d0f7d1790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from the parent POM what doesn't depend on the project
The version of Redoc, swagger-core, the base document carrying the info section,
the output of the generated specification and the binding of the resolve goal of
Swagger, along with the execution stripping the Maven site, are now managed by
the parent POM. The module keeps what is its own: the packages to scan, the
routes of the SCIM API not to publish, its filter and its schema resolver, the
WAR whose classes are unpacked, and the URL the documentation is published at.
It also keeps the setting silencing the reports of the site plugin: that plugin
is declared by the root POM of the project, so managing the setting in the
parent would make every Maven site of Silverpeas lose its reports.
This takes effect once the parent POM is released: the project still refers to
the last released one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200078323a23b15cb23bbbcaa797991a709645d0f7dTake from the parent POM what doesn't depend on the projecteditcore-restapi/pom.xml
- core-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javacore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javacore-web/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javacore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javacore-restapi/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/BadRequest.javacore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/CommonResponsesFilter.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/JaxbAwareModelResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javacore-rs/pom.xmlb738adf1743bdd89b3f676bf5dcc7acd6ccf2d9a1790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGather in core-rs what generates the documentation of the REST API
The filter completing the responses of every endpoint and the resolver reading
the JAXB annotations of the web entities were duplicated, one copy per project
documenting its REST API, the two being identical but for their package. They
are gathered here, beside the annotations documenting the common errors, in a
package of their own: org.silverpeas.core.rs.doc.
Their name being the same for every project now, the parent POM declares them
once for all, and nothing is left to keep the copies in step.
The counterpart is that core-rs, a module of production, depends on swagger-core
to compile them. The dependency is provided, so nothing of it is shipped, and
neither the filter nor the resolver plays any role at runtime: both are read
when generating the documentation only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200b738adf1743bdd89b3f676bf5dcc7acd6ccf2d9aGather in core-rs what generates the documentation of the REST APIaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/JaxbAwareModelResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/Conflict.javadeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javaeditcore-web/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javadeletecore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/CommonResponsesFilter.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javadeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javaeditcore-restapi/pom.xmldeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/NotFound.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/BadRequest.javadeletecore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javaeditcore-rs/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.java
- core-restapi/pom.xmld41b4c150a336e2cb3019a2b3687c5a403cba3d41790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comOpt in the stripping of the Maven site
The strip-maven-site execution of the parent POM is now skipped by default: it
used to apply to every project inheriting from that POM and wiped out the Maven
site such a project publishes. This module publishes the documentation of the
REST API and nothing else, so it asks for the execution by setting
strip.maven.site.skip to false.
2026-09-28 14:12:17 +0200d41b4c150a336e2cb3019a2b3687c5a403cba3d4Opt in the stripping of the Maven siteeditcore-restapi/pom.xml
- core-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web-test/src/main/java/org/silverpeas/web/test/stub/TestHttpRequest.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.java5f5891af886c501d82d72d54f15552e3775e0ce71790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comHarden the detection of the event callbacks against the vulnerabilities #1458, #1459 and #1460
(GitHub issues, reported against 6.4.6)
The three reported stored XSS rely on an event callback attribute carried by an
element the browser fails to load on purpose. Such a declaration was detected by
the \s+on\w+\s*= pattern, which expects a whitespace before the attribute name.
According to the HTML tokenizer, an attribute name is also expected right after
the closing quote of the previous attribute value (a
missing-whitespace-between-attributes parse error, whose recovery is mandated by
the specification) and right after a solidus. So the following did declare an
onerror callback the browsers do run, while going through the filter:
<img src="x"onerror=alert(1)>
The pattern now accepts these separators as well.
Note this filter is an input guard, not an output encoding: it narrows the
reachability of the three flaws but it doesn't fix the rendering code itself.
MassiveWebSecurityFilterOnReportedXssIT covers the payloads of the three reports
on their actual endpoints and parameters, including when they are submitted as
multipart/form-data streams as the genuine forms do. It also delimits the
multipart exemption, which applies to the webPages component only.
TestHttpRequest.getContentType() returned null whatever the headers set on the
stub, which made the multipart branch untestable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 81589f6134e8e337c16a6c390b2d804e78006f8f)
2026-09-28 14:42:28 +02005f5891af886c501d82d72d54f15552e3775e0ce7Harden the detection of the event callbacks against the vulnerabilities #1458, #1459 and #1460editcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javaaddcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.javaeditcore-web-test/src/main/java/org/silverpeas/web/test/stub/TestHttpRequest.java
- core-war/src/main/webapp/defaultLoginQuestion.jsp018ed026afbb76a9ad52281cd62b8e284b9a914a1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1458
(GitHub issue, reported against 6.4.6)
The login question, which any authenticated user sets from their profile, was
printed raw by a JSP scriptlet on the password reminder page, an anonymous one.
Any script stored there was then run in the browser of every visitor of that
page, without any login required from them. The answer to that question, itself
a credential, is asked on the very same page.
The value is now HTML encoded on output, through a c:out tag. Doing so on the
rendering side rather than on the writing one closes both the ways the field is
fed: MyProfilRequestRouter, which the report points at, but also
ValidationQuestionHandler, which stores the question of the ValidateQuestion
function with no more filtering. It also neutralizes the values already stored.
The login of the hidden field below is encoded as well. It comes from a lookup
in the database and not from the request parameter, so exploiting it would
require a login holding a quote, but the encoding costs nothing here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 457be5fa780ce2656d7104f31515ea7064e2fbf6)
2026-09-28 14:42:28 +0200018ed026afbb76a9ad52281cd62b8e284b9a914aFix vulnerability #1458editcore-war/src/main/webapp/defaultLoginQuestion.jsp
- core-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javacore-services/importExport/src/main/java/org/silverpeas/core/importexport/report/HtmlExportPublicationGenerator.javacore-configuration/src/main/config/properties/org/silverpeas/util/security.propertiescore-library/src/main/java/org/silverpeas/core/contribution/content/form/displayers/WysiwygFCKFieldDisplayer.javacore-library/src/integration-test/resources/org/silverpeas/util/security.propertiescore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentRenderer.javacore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javacore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javacore-library/src/integration-test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygControllerIT.javacore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.javacore-services/importExport/src/main/java/org/silverpeas/core/importexport/control/PublicationsTypeManager.javacore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformer.javacore-library/src/integration-test/java/org/silverpeas/core/test/LibCoreWarBuilder.java37283d39cead2166ad9483d373658c2b8e414c951790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1459
(GitHub issue, reported against 6.4.6)
The WYSIWYG content of a form field was written into the response as raw HTML by
WysiwygFCKFieldDisplayer, so any script stored by the writer of a whitePages
card was run in the browser of every user viewing it. The same held for the
content of a publication, rendered by WysiwygContentRenderer, and for the two
export paths, none of which was reported.
Such a content is sanitized now, by the new SanitizeForRenderingDirective.
Unlike SanitizeDirective, which keeps only a restricted set of safe elements and
is left untouched for the contents extracted out of Silverpeas, this one keeps
the content as it is and drops only what can act on the visitor's browser:
- the elements able to run code or to take over the document, with their
content;
- the event callback attributes, whatever the element carrying them;
- the attributes referring a URL with a scripting scheme;
- the iframes and the media whose source isn't allowed.
This is deliberate: the WYSIWYG editor is set up to accept any content
(config.allowedContent = true in silverconfig.js), so an allow list applied at
rendering time would be narrower than what the users are entitled to write. It
would in particular have dropped the media produced by the video and html5audio
plugins and the rel attribute the userzoom and identitycard ones rely upon.
The parsing is delegated to the HTML tokenizer of the OWASP sanitizer, so the
content is read the way a browser reads it and the dropping can't be dodged by
playing with the HTML syntax.
The rule deciding whether the source of an iframe is allowed moves to the new
EmbeddedSourceValidator class, so that the filtering of the incoming requests
and this sanitization agree on it. It now serves the media as well, through the
new security.external.media.hosts.allowed property. That property is shipped
with the * value, which allows any host and hence preserves the behaviour of the
previous versions; setting it empty restricts the media to the ones Silverpeas
hosts itself. The inlined images are kept whatever it is, being carried by the
content itself.
The mail path is deliberately left out: its images are referred by cid URLs,
which such a sanitization drops, and its content isn't rendered in the
Silverpeas origin anyway.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 2961a40c81708375b2136cfa18f7c5f5e1d97321)
2026-09-28 14:42:28 +020037283d39cead2166ad9483d373658c2b8e414c95Fix vulnerability #1459addcore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javaeditcore-library/src/integration-test/java/org/silverpeas/core/test/LibCoreWarBuilder.javaaddcore-library/src/integration-test/resources/org/silverpeas/util/security.propertieseditcore-configuration/src/main/config/properties/org/silverpeas/util/security.propertieseditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentRenderer.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/form/displayers/WysiwygFCKFieldDisplayer.javaeditcore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javaaddcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javaeditcore-services/importExport/src/main/java/org/silverpeas/core/importexport/control/PublicationsTypeManager.javaeditcore-services/importExport/src/main/java/org/silverpeas/core/importexport/report/HtmlExportPublicationGenerator.javaeditcore-library/src/integration-test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygControllerIT.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformer.javaeditcore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.java
- core-library/src/main/java/org/silverpeas/core/util/HttpUtil.javab2900e3c4738e94ab34622ee8a48197f7921a09f1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1461
(GitHub issue, reported against 6.4.6)
Let the callers of HttpUtil complete the HTTP client.
Fixing that vulnerability requires the gallery component to request the image of
a watermark with a connection timeout and without following the redirections,
the latter being able to escape the verification of the address being requested.
httpClientBuilder() gives the builder of the HTTP client, already configured
with the proxy of Silverpeas, so that such a caller can complete the
configuration without having to duplicate that of the proxy. httpClient() now
delegates to it and is unchanged for its own callers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 16cff5ecd5e217798d51ebe7f5a97103f4d901b0)
2026-09-28 14:42:28 +0200b2900e3c4738e94ab34622ee8a48197f7921a09fFix vulnerability #1461editcore-library/src/main/java/org/silverpeas/core/util/HttpUtil.java
- core-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jscore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.java23acd94a451f35afaf18324777b344292593341b1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix the vulnerabilities CVE-2026-78738 and CVE-2026-78741
Both report a stored XSS through the name of an uploaded file, one from the
document management and the other from the image upload of the WYSIWYG editor.
They share their cause: the name is written as an HTML content by the upload
widget, whereas it is carried by the request and escaped on the sending side
only, which protects from nothing as a request can be forged.
The name is now set as a text. Note the formatted size which followed it was
already not displayed, html() taking a single argument, so the display is left
unchanged.
A scripting scheme given as the value of an attribute is detected as well by
MassiveWebSecurityFilter. Such a declaration holds no on prefix and was
therefore going through, and the colon introducing it is accepted written as
the character itself or as any of the HTML entities standing for it, as the
reported payload uses "javascript:". The data scheme is deliberately left
out: the contents do embed their inlined images with it.
(cherry picked from commit 4f92097f60d0d6e8072815cf5a77093d3f19f9e3)
2026-09-28 14:42:28 +020023acd94a451f35afaf18324777b344292593341bFix the vulnerabilities CVE-2026-78738 and CVE-2026-78741editcore-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jseditcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.java
- core-library/src/main/java/org/silverpeas/core/node/dao/NodeDAO.javacore-library/src/integration-test/resources/org/silverpeas/core/node/dao/nodes-sorting-dataset.sqlcore-library/src/integration-test/java/org/silverpeas/core/node/dao/NodeSortingIT.javacore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.java52843258f403c47fb8a0b51a75295f883fb98eda1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comSort only the nodes of the component instance being administrated
The sorting of the nodes was granted against the component instance referred by
the URL of the REST service, whereas the nodes to sort were taken from the
request body, each of them carrying the component instance it belongs to. An
administrator of any instance could hence ask to sort the nodes of another one.
The nodes are now identified within the instance of the URL, the one the
authorization has been checked against. Taking that instance from the body
brought nothing: the sorting applies by nature to the instance administrated.
That wasn't enough though. NodeDAO was updating the order of a node by its
identifier only, whereas such an identifier isn't unique by itself: the root
node of every component instance is numbered 0, and the ones below it can bear
the same numbers from an instance to another. So the instance of the node is
now part of the criteria. Beyond the authorization, this was a defect on its
own: sorting the nodes of an instance was renumbering the nodes of the other
ones bearing the same identifiers, whoever asked for that sorting.
NodeSortingIT covers the sorting of the nodes of an instance and the isolation
of the other instances from it, in both directions.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e7028e01e7261c16803ee20f841763ef5b84ab7b)
2026-09-28 14:42:28 +020052843258f403c47fb8a0b51a75295f883fb98edaSort only the nodes of the component instance being administratededitcore-library/src/main/java/org/silverpeas/core/node/dao/NodeDAO.javaaddcore-library/src/integration-test/resources/org/silverpeas/core/node/dao/nodes-sorting-dataset.sqleditcore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaaddcore-library/src/integration-test/java/org/silverpeas/core/node/dao/NodeSortingIT.java
- core-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-war/src/main/webapp/defaultLoginQuestion.jspdf92a06600aedb5b24bad01559165e839421c2b51790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake into account sonarcloud feedback
2026-09-28 14:42:28 +0200df92a06600aedb5b24bad01559165e839421c2b5Take into account sonarcloud feedbackeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-war/src/main/webapp/defaultLoginQuestion.jsp
- core-configuration/src/main/config/properties/org/silverpeas/util/security.propertiesdb15a2e30508fb101a2addaf4780cc6479eb92701790599436000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comNow the parameter security.external.media.hosts.allowed is empty.
This means all hosts out of Silverpeas will be refused in HTML media
tags (video, iframe, img, ...)
2026-09-28 14:43:56 +0200db15a2e30508fb101a2addaf4780cc6479eb9270Now the parameter security.external.media.hosts.allowed is empty.editcore-configuration/src/main/config/properties/org/silverpeas/util/security.properties
- core-library/src/main/java/org/silverpeas/core/index/indexing/parser/tika/TikaParser.javacore-library/src/main/java/org/silverpeas/core/index/indexing/model/IndexManager.javacore-library/src/main/java/org/silverpeas/core/index/indexing/parser/Parser.java3f5875d5832af01276050f9ad75a08f7ddb4dd301790608429000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comFix bug-15488
2026-09-28 17:13:49 +02003f5875d5832af01276050f9ad75a08f7ddb4dd30Fix bug-15488editcore-library/src/main/java/org/silverpeas/core/index/indexing/parser/tika/TikaParser.javaeditcore-library/src/main/java/org/silverpeas/core/index/indexing/model/IndexManager.javaeditcore-library/src/main/java/org/silverpeas/core/index/indexing/parser/Parser.java
git- suggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/TickerResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javagallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javaquickinfo/quickinfo-library/src/main/java/org/silverpeas/components/quickinfo/NewsSort.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javagallery/gallery-library/src/main/java/org/silverpeas/components/gallery/constant/MediaResolution.javapom.xmldelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javarssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javacomponents-restapi/src/site/resources/index.htmlkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/AbstractNewsResource.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/FolderResource.javaquickinfo/quickinfo-library/src/integration-test/java/org/silverpeas/components/quickinfo/repository/NewsRepositoryIT.javacomponents-restapi/pom.xmlf2fe8d93d99b4eb77e672c047d22ce154ba946731790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGenerate the documentation of the REST API with Swagger instead of Smart-Doc
The new components-restapi module gathers the web resources of the fourteen
applications into a single OpenAPI 3.1 document, rendered by Redoc and published
on its own at docs/restapi/components. It produces nothing but that
documentation and builds only with the restapi profile, from which the Smart-Doc
plugin is dropped.
All the 81 operations, spread over 70 paths and 81 schemas, are now documented.
The twenty-two operations of the almanach are inherited from the calendar
resources of Core and needed nothing: Swagger reads the annotations of the
overridden methods. The others got a summary, a success response with its
schema, and the errors they can answer, the recurring ones coming from the
@NotFound and @Conflict annotations of Core. The 503 common to every endpoint is
brought by CommonResponsesFilter, of which this project has its own copy.
Documenting the endpoints brought several defects to light, which are fixed
here:
* three of the four folder endpoints of Kmelia were invisible in the
documentation. Swagger strips the regular expression of a path template, so
{path: \d+(/\d+)*/children} was reduced to {path} and collided with the
three other ones. The literal suffix now sits outside the template, which
matches the very same URIs;
* NewsResource caught back the WebApplicationException it had just thrown and
turned it into a 503, so neither the 404 of an unknown news nor the refusal
to delete one ever reached the requester. That refusal answers a 403 now,
instead of a 401 without any challenge;
* MediaResolution read the settings of the application from its enum
constants, making the scan fail with an ExceptionInInitializerError. The
watermark size is read lazily now;
* five classes of Quickinfo were missing the licence header.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200f2fe8d93d99b4eb77e672c047d22ce154ba94673Generate the documentation of the REST API with Swagger instead of Smart-Docaddcomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javaeditrssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaeditgallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javaeditresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javaeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javaeditsuggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditpom.xmleditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javaeditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javaeditquickinfo/quickinfo-library/src/main/java/org/silverpeas/components/quickinfo/NewsSort.javaaddcomponents-restapi/pom.xmleditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/AbstractNewsResource.javaaddcomponents-restapi/src/site/resources/index.htmleditquickinfo/quickinfo-library/src/integration-test/java/org/silverpeas/components/quickinfo/repository/NewsRepositoryIT.javaeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/constant/MediaResolution.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/TickerResource.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/FolderResource.java
- components-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javacomponents-restapi/pom.xml59908ef73f929070700744af9c79e30cf0066fff1790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comMake the schema resolver of Swagger aware of the JAXB annotations
The resolver figures the properties of a web entity out with a plain Jackson
object mapper, whereas Silverpeas serializes them with the introspector of the
JAXB annotations. The generated schemas were therefore describing properties
that never reach the wire, those excluded by @XmlTransient or by an access set
to XmlAccessType.FIELD, and missing the fields that do reach it.
Same resolver as the one of Core, of which this project has its own copy, for
the very reason its filter completing the responses has one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +020059908ef73f929070700744af9c79e30cf0066fffMake the schema resolver of Swagger aware of the JAXB annotationseditcomponents-restapi/pom.xmladdcomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.java
- components-restapi/src/main/openapi/openapi.yamlcomponents-restapi/pom.xmlae522b0fb3a88fbb36407023c62f0c096c2a3ab31790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comPublish nothing but the documentation of the REST API
The generated specification declared no info section, which OpenAPI requires. A
renderer refuses to display such a document, whatever the quality of the rest of
it. Contrary to the plugin of SmallRye, the one of Swagger has no parameter to
fill that section in, hence the document of its own declared here: the scan
completes it, and Maven fills its version in.
Besides the documentation of the REST API, the module was publishing the site
Maven builds for it: the reports about the dependencies, the SCM, the javadoc of
a module that has almost no source. Those reports aren't produced any more, and
what the site brings along -- its decoration and its sitemap, of no use to the
rendering page -- is dropped once the site has been built, before it gets
published.
Same setting as the one of Core, of which this project has its own copy, for the
very reason its filter completing the responses has one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200ae522b0fb3a88fbb36407023c62f0c096c2a3ab3Publish nothing but the documentation of the REST APIaddcomponents-restapi/src/main/openapi/openapi.yamleditcomponents-restapi/pom.xml
- components-restapi/pom.xml01111927bc2afba8b8a88f23247f97c2e70eab181790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from the parent POM what doesn't depend on the project
The version of Redoc, swagger-core, the base document carrying the info section,
the output of the generated specification and the binding of the resolve goal of
Swagger, along with the execution stripping the Maven site, are now managed by
the parent POM. The module keeps what is its own: the packages to scan, its
filter and its schema resolver, the fourteen WAR whose classes are unpacked, and
the URL the documentation is published at.
It also keeps the setting silencing the reports of the site plugin: that plugin
is declared by the root POM of the project, so managing the setting in the
parent would make every Maven site of Silverpeas lose its reports.
This takes effect once the parent POM is released: the project still refers to
the last released one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +020001111927bc2afba8b8a88f23247f97c2e70eab18Take from the parent POM what doesn't depend on the projecteditcomponents-restapi/pom.xml
- suggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javagallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javapom.xmldelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javarssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javacomponents-restapi/pom.xml021fe614496d0adf069aaade785f13438a7998ca1790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from core-rs what generates the documentation of the REST API
The filter completing the responses of every endpoint and the resolver reading
the JAXB annotations of the web entities were copied here from Silverpeas Core,
where they now sit in a package of their own, org.silverpeas.core.rs.doc,
alongside the annotations documenting the common errors. The copies are dropped
and the parent POM declares the classes of core-rs instead.
The annotations documenting the common errors follow them: the endpoints of the
applications refer them at their new place.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200021fe614496d0adf069aaade785f13438a7998caTake from core-rs what generates the documentation of the REST APIeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaeditresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javaeditrssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javaeditpom.xmleditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javaeditcomponents-restapi/pom.xmldeletecomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javaeditsuggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javadeletecomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javaeditgallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.java
- components-restapi/pom.xml9d3490bf7cd64723cdac38d15472d03679bb89501790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comOpt in the stripping of the Maven site
The strip-maven-site execution of the parent POM is now skipped by default: it
used to apply to every project inheriting from that POM and wiped out the Maven
site such a project publishes. This module publishes the documentation of the
REST API and nothing else, so it asks for the execution by setting
strip.maven.site.skip to false.
2026-09-28 14:12:34 +02009d3490bf7cd64723cdac38d15472d03679bb8950Opt in the stripping of the Maven siteeditcomponents-restapi/pom.xml
- forums/forums-war/src/main/webapp/forums/jsp/modifyMessage.jspforums/forums-war/src/main/webapp/forums/jsp/viewMessage.jspforums/forums-war/src/main/webapp/forums/jsp/editMessageKeywords.jsp3b4d732f0a1b27af91286d6a8bf01e77d8d3bde21790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1460
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The title and the body of a forum message were printed raw by JSP scriptlets on
the thread page, so any script posted by a user of the forum was run in the
browser of every user reading it.
The title is now HTML encoded on output, as the other JSPs of the component
already do through WebEncodeHelper. Two other raw outputs of the title, which
the report doesn't mention, are encoded as well: the one of modifyMessage.jsp,
where the title lands in the value attribute of an input and is hence
exploitable by escaping that attribute, and the one of editMessageKeywords.jsp.
The body is sanitized by the applySanitizeForRenderingDirective directive
introduced in Silverpeas-Core for the vulnerability #1459, which drops what can
act on the visitor's browser while keeping the content as it is.
Note the report also states the title pollutes the title element of the page.
It does appear there, but viewMessage.jsp already prints it through a c:out tag,
so it is encoded and isn't a vector.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit ea479b045468c5015e93e8b6c0924b919f8e4f32)
2026-09-28 14:43:22 +02003b4d732f0a1b27af91286d6a8bf01e77d8d3bde2Fix vulnerability #1460editforums/forums-war/src/main/webapp/forums/jsp/viewMessage.jspeditforums/forums-war/src/main/webapp/forums/jsp/editMessageKeywords.jspeditforums/forums-war/src/main/webapp/forums/jsp/modifyMessage.jsp
- gallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javagallery/gallery-library/src/test/java/org/silverpeas/components/gallery/WatermarkTest.javab0d04438a605a666ee748f7c6ca310fef0ff6a4a1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1461
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The image of a watermark is an instance parameter any manager of the space
holding the gallery can set, and the server requests it as it is, at each media
creation. It could hence be pointed at a service the server keeps for itself.
Such an URL is now verified before being requested: only the HTTP and HTTPS
schemes are handled, and the host must resolve to neither a loopback nor a
link-local address, so that neither the services bound to the server itself nor
the metadata endpoint of a cloud provider can be reached. Every address the host
resolves to is verified, otherwise a host resolving to a forbidden address
beside an allowed one would go through.
The addresses of the private networks of an organization remain reachable on
purpose: they are where the internal resources of an intranet legitimately live,
and no address range can tell them from the internal services one would rather
protect. Only an explicit list of allowed hosts could, which is left to a
further decision.
The request is besides given a timeout and its response is no longer copied
without any bound, both being able to exhaust the resources of the server, and
the redirections are no longer followed as they would escape the verification
above.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 83864c0f72b6c5f62a1afdf2cb420f8b62840f20)
2026-09-28 14:43:22 +0200b0d04438a605a666ee748f7c6ca310fef0ff6a4aFix vulnerability #1461addgallery/gallery-library/src/test/java/org/silverpeas/components/gallery/WatermarkTest.javaeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.java
- infoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/previewLetter.jspinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/headerLetter.jspinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java03b14dd2f030f634a99944c3272b31500811242f1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1462 and secure the other writings of the newsletter
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
Publishing an issue of a newsletter changes its state, stamps its publication
date, notifies the subscribers and mails the external ones. It was requested by
a GET, and the synchronizer token is required on a GET only when its URL holds
one of a few keywords, which ValidateParution holds none of. Any logged user
lured into a cross-site visit was hence publishing the issue as themselves.
The publication is now submitted by POST, on which the token is required
whatever the URL, through the formRequest facility which stamps it.
Moreover the endpoint had no role check at all, so any reader of the newsletter
was able to publish an issue and to trigger the mailing, with no luring needed.
Only its publishers and its managers can do so now.
Three other writings, which the report doesn't mention, were exposed the same
way and are secured likewise:
- resetting the content of an issue with its template, which overwrites the
content being written;
- mailing an issue to oneself and to the managers, which sends the content of an
issue not published yet and was hence a way for any reader to get a draft.
As EditContent also serves the edition itself, a mere navigation which remains a
GET, the reset is explicitly refused when it isn't requested by POST: submitting
it by POST would otherwise protect nothing, the previous URL remaining
requestable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 4bd5e04d16207d889d2b271eed87fa1962fa8ab5)
2026-09-28 14:43:22 +020003b14dd2f030f634a99944c3272b31500811242fFix vulnerability #1462 and secure the other writings of the newslettereditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/headerLetter.jspeditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/previewLetter.jspeditinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java
- infoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterUser.jspinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterAdmin.jspinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java0b6076009ffb133c105e4861267e1cda62176d781790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerabilities #1463
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The operations on the issues themselves were exposed the same way and are
secured likewise: creating and modifying an issue, and modifying the headers of
the newsletter, were requestable by a GET although their forms are submitted by
POST, the router not caring about the method.
None of the operations of this router had any role check, so any reader was able
to write the content of an issue, to modify the headers of the newsletter, to
delete issues and to read the ones being written. They are now reserved to the
publishers and to the managers, but for the ones on the template and the
deletion of several issues at once, reserved to the managers.
Reading the inlined CSS rendering of an issue is how the readers get it from the
list, so the criterion there isn't the role but the issue itself: it is refused
to them as long as it isn't published.
(cherry picked from commit e455edb9286b8b429cbb7fc1c54de6f75ead8dfd)
2026-09-28 14:43:22 +02000b6076009ffb133c105e4861267e1cda62176d78Fix vulnerabilities #1463editinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterUser.jspeditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterAdmin.jspeditinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java
- kmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationLinksManager.jspkmelia/kmelia-war/src/main/webapp/kmelia/jsp/basket.jspkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/ajax/AjaxOperation.javakmelia/kmelia-war/src/main/webapp/kmelia/jsp/orderTopics.jspkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javadbb4f8e6ae7b2f71c500e2457c9a7cb299fa12dc1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1464
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
Loading publications into the clipboard and pasting them under another topic
were requestable by a GET, so any logged user lured into a cross-site visit was
moving publications as themselves.
The AJAX servlet of kmelia answers the GET as the POST, and none of its URLs
holds any of the keywords making the synchronizer token required on a GET. So
none of its operations was protected, including the deletion of publications
which the report takes as protected: its URL does hold the delete keyword, but
the rule applied to this servlet requires in addition the path to hold /jsp/,
which the path of a servlet doesn't.
The operations only reading something are now listed apart, every other one
being taken as writing something so that adding an operation doesn't expose it
by mistake, and a writing operation requested by a GET is refused. That refusal
is performed before the processing, whose catch-all would swallow it.
The user interface already submitted by POST the operations the report points
at, as well as the deletion, the copy and the move of publications: what made
the attack possible is the servlet accepting the GET. Three operations were
still requested by a GET and are now submitted by POST: sorting the topics,
emptying the trash from the basket, and binding a publication to another one.
(cherry picked from commit 9d1faf9ba0366440299b0907b00a0ab5397f5bdd)
2026-09-28 14:43:22 +0200dbb4f8e6ae7b2f71c500e2457c9a7cb299fa12dcFix vulnerability #1464editkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javaeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/orderTopics.jspeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/basket.jspeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationLinksManager.jspeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/ajax/AjaxOperation.java
- kmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javakmelia/kmelia-war/pom.xmlkmelia/kmelia-war/src/test/java/org/silverpeas/components/kmelia/web/KmeliaResourceTest.javaf371b6452d9360af47926ebccceba45e05d252ca1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #939
(GitHub issue of Silverpeas-Components, reported against 6.4.6)
Updating a publication was granted against the component instance referred by
the URL, whereas the publication to update was entirely defined by the request
body, which carries both its identifier and its component instance. Any user
could hence rewrite the metadata of any publication of the platform by referring
it in the body, the identifiers being enumerable.
The publication is now refused when it doesn't belong to the instance the
authorization has been checked against. Note the report states a WRITER role is
required: it is not, the authorization of the REST framework only validating the
access to the instance whatever the role played in it, so the exposure was wider
than reported. Writing a publication, be it created or updated, now requires
that role indeed.
KmeliaResourceTest covers the checks. The war had no test at all, hence the
test dependency added to its POM.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 1d8ec7ee0a903b041ffac54b022319ff099b12ce)
2026-09-28 14:43:22 +0200f371b6452d9360af47926ebccceba45e05d252caFix vulnerability #939editkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditkmelia/kmelia-war/pom.xmladdkmelia/kmelia-war/src/test/java/org/silverpeas/components/kmelia/web/KmeliaResourceTest.java
- delegatednews/delegatednews-war/src/test/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResourceTest.javadelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javabb7f36a57f96d33b8bd92d826056770e3c14e04c1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comReserve the management of the delegated news to the managers
Modifying and deleting the delegated news is reserved to the managers of the
application, as its user interface applies on its side. The REST service was
granted against a mere access to the component instance, whatever the role
played in it, so any of its users was able to reorder and to delete them by
requesting it directly.
Found while auditing the other REST resources against the flaw reported by the
issue #939 of this repository.
ListDelegatedNewsResourceTest covers the check.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e4271c328772c51f400cbeab7eeb6f7fb2876721)
2026-09-28 14:43:22 +0200bb7f36a57f96d33b8bd92d826056770e3c14e04cReserve the management of the delegated news to the managersadddelegatednews/delegatednews-war/src/test/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResourceTest.javaeditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.java
- gallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javaeca5145d6d01f77adce83ef714742073585675ca1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake into account sonarcloud feedback
2026-09-28 14:43:22 +0200eca5145d6d01f77adce83ef714742073585675caTake into account sonarcloud feedbackeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.java
githttps://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse1163https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1163/SKIP_TESTfalseSKIP_QUALITYfalseDémarré par l'utilisateur Miguel MoquillonmmoquillonMiguel Moquillon116356f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube1163969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/master969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/master969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1163d68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11633371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1163ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11630c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11637b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-AssemblyAaDn1HDHG2nnBI00r1HLSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=masterhttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=masterbuild.yamlbuild.yamltarget/build.yamlfalse6.5-build260928756954610550775Silverpeas_Master_AutoDeploy 6.5-build2609281163false116363338SUCCESS1790589603324https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1163/https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse1164https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1164/1162https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1162/SKIP_TESTfalseSKIP_QUALITYfalseDémarré par l'utilisateur Miguel MoquillonmmoquillonMiguel Moquillon116256f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube1162969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/master969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/master969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1162d68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11623371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1162ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11620c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11627b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Assemblyfalse#1162313550010550775Silverpeas_Master_AutoDeploy #11621162false116263310FAILURE1790584035065https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1162/https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse1163https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1163/1161https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1161/Lancé par une alarme périodiqueSKIP_TESTfalseSKIP_QUALITYfalse116156f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube1161969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/master969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/master969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1161d68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11613371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1161ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11610c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11617b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-AssemblyAaDkQZI5tD7Bd_4xbMm1Silverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=masterhttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=masterfalse#1161615003210550775Silverpeas_Master_AutoDeploy #11611161false116163261FAILURE1790529840597https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1161/- core-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-editorSignature.svgcore-war/src/main/webapp/media/jsp/pdf/locale/tr/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ml/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ff/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/zh-TW/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ro/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/fi/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ur/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/nl/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/son/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/cak/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/brx/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/wo/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/messageBar_closingButton.svgcore-war/src/main/webapp/media/jsp/pdf/locale/sr/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/tl/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/el/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/en-GB/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/si/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/mr/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ltg/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/lo/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_PDFJS_QCMScore-war/src/main/webapp/media/jsp/pdf/locale/lij/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/gl/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-viewsManagerToggle.svgcore-war/src/main/webapp/media/jsp/pdf/wasm/jbig2_nowasm_fallback.jscore-war/src/main/webapp/media/jsp/pdf/locale/ko/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ru/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/af/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/editor-toolbar-edit.svgcore-war/src/main/webapp/media/jsp/pdf/locale/scn/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/fr/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/cy/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ckb/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-sidebarToggle.svgcore-war/src/main/webapp/media/jsp/pdf/images/altText_disclaimer.svgcore-war/src/main/webapp/media/jsp/pdf/locale/br/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/pages_selected.svgcore-war/src/main/webapp/media/jsp/pdf/images/cursor-editorFreeHighlight.svgcore-war/src/main/webapp/media/jsp/pdf/locale/my/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/bs/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/sco/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/messageBar_info.svgcore-war/src/main/webapp/media/jsp/pdf/images/comment-closeButton.svgcore-war/src/main/webapp/media/jsp/pdf/images/comment-popup-editButton.svgcore-war/src/main/webapp/media/jsp/pdf/locale/zh-CN/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/trs/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/hr/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/wasm/openjpeg.wasmcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_JBIG2core-war/src/main/webapp/media/jsp/pdf/images/comment-actionsButton.svgcore-war/src/main/webapp/media/jsp/pdf/locale/cs/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/altText_spinner.svgcore-war/src/main/webapp/media/jsp/pdf/locale/uk/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/sv-SE/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/sp-viewer.csscore-war/src/main/webapp/media/jsp/pdf/wasm/openjpeg_nowasm_fallback.jscore-war/src/main/webapp/media/jsp/pdf/locale/es-AR/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/sat/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/th/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/core/pdf.sandbox.min.jscore-war/src/main/webapp/media/jsp/pdf/locale/mk/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/viewer.jspcore-war/src/main/webapp/media/jsp/pdf/locale/fy-NL/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ar/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/skr/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/kk/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/xh/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/core/pdf.worker.min.jscore-war/src/main/webapp/media/jsp/pdf/locale/nb-NO/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_QCMScore-war/src/main/webapp/media/jsp/pdf/locale/kn/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/fur/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ga-IE/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ca/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/vi/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/rm/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/iccs/CGATS001Compat-v2-micro.icccore-war/src/main/webapp/media/jsp/pdf/locale/bo/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/da/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/szl/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/wasm/qcms_bg.wasmcore-war/src/main/webapp/media/jsp/pdf/images/comment-editButton.svgcore-war/src/main/webapp/media/jsp/pdf/locale/km/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/sl/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/es-ES/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/core/pdf.min.jscore-war/src/main/webapp/media/jsp/pdf/images/altText_warning.svgcore-war/src/main/webapp/media/jsp/pdf/locale/eo/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/kab/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/gn/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/sk/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-editorStamp.svgcore-war/src/main/webapp/media/jsp/pdf/locale/uz/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/hi-IN/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/pl/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/pt-BR/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ta/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/et/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ast/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ne-NP/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ach/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/meh/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/bn/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/an/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/hsb/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/az/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/it/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_PDFJS_OPENJPEGcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-editorFreeText.svgcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-signaturePropertiesError.svgcore-war/src/main/webapp/media/jsp/pdf/standard_fonts/LICENSE_LIBERATIONcore-war/src/main/webapp/media/jsp/pdf/locale/gu-IN/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/id/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/viewer.min.jscore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-menuArrowNova.svgcore-war/src/main/webapp/media/jsp/pdf/locale/dsb/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/hye/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/fa/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/gd/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/nn-NO/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/be/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/gv-toolbarButton-openinapp.svgcore-war/src/main/webapp/media/jsp/pdf/locale/ia/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ja/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/ka/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/wasm/quickjs-eval.jscore-war/src/main/webapp/media/jsp/pdf/locale/tg/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/messageBar_warning.svgcore-war/src/main/webapp/media/jsp/pdf/viewer.min.csscore-war/src/main/webapp/media/jsp/pdf/locale/pt-PT/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/en-US/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_PDFJS_JBIG2core-war/src/main/webapp/media/jsp/pdf/images/pages_viewArrow.svgcore-war/src/main/webapp/media/jsp/pdf/images/pages_closeButton.svgcore-war/src/main/webapp/media/jsp/pdf/locale/ms/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/is/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/en-CA/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/lv/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/es-CL/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/hy-AM/viewer.ftlcore-web/src/main/java/org/silverpeas/core/web/util/viewgenerator/html/JavascriptPluginInclusion.javacore-war/src/main/webapp/media/jsp/pdf/locale/pa-IN/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/bqi/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/pages_viewButton.svgcore-war/src/main/webapp/media/jsp/pdf/locale/de/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/he/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/te/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/cursor-editorTextHighlight.svgcore-war/src/main/webapp/media/jsp/pdf/iccs/LICENSEcore-war/src/main/webapp/media/jsp/pdf/locale/locale.jsoncore-war/src/main/webapp/media/jsp/pdf/locale/sq/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/hu/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/oc/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/checkmark.svgcore-war/src/main/webapp/media/jsp/pdf/locale/sc/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/eu/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/images/signature-properties-row-check.svgcore-war/src/main/webapp/media/jsp/pdf/doc/README.mdcore-war/src/main/webapp/media/jsp/pdf/wasm/jbig2.wasmcore-war/src/main/webapp/media/jsp/pdf/locale/bg/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/locale/lt/viewer.ftlcore-war/src/main/webapp/media/jsp/pdf/wasm/quickjs-eval.wasmcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-signaturePropertiesVerified.svgcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_OPENJPEGcore-war/src/main/webapp/media/jsp/pdf/locale/es-MX/viewer.ftlc26f88f64443a7723b9bcd9aa671e8745b38876e1790255803000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comUpdate the embedded PDF viewer to PDF.js 6.3.289
The viewer was still running PDF.js 4.0.379. Beyond the sources themselves, the
upgrade requires the two manual modifications of viewer.min.js described in
doc/README.md to be applied again: the wiring of
window.SP_PDF_VIEWER_L10N_TEXT_MODIFIER into GenericL10n#createBundle, and the
completion of the webviewerloaded event detail in webViewerLoad, upstream
publishing only the source window there. Without the latter,
e.detail.viewerAppOptions is undefined and none of the Silverpeas settings is
applied, leaving the viewer with its default worker source.
The markup of the toolbars has been reworked upstream, so the body of viewer.jsp
is taken again from viewer.html: the left sidebar is replaced by the views
manager nested into the toolbar, most of the buttons are renamed with a Button
suffix, their former identifier being now the one of the wrapping
div.toolbarButtonWithContainer, and the alert, undo bar and signature dialogs are
new. The obsolete selectors of sp-viewer.css are updated accordingly.
PDF.js now decodes the JBIG2, OpenJPEG and QCMS streams and runs the PDF
scripting through WebAssembly, and reads the ICC profiles from its own resource
folder. Both folders are given to the viewer through new PdfViewerSettings
entries and applied as the wasmUrl and iccUrl options, along with
standardFontDataUrl which was never set: relative to viewer.jsp, their default
value resolves outside the plugin and fails to be fetched. The locale option is
replaced by localeProperties, and the edition tools are hidden by the
annotationEditorMode option rather than by removing each button, the viewer
taking care of its whole tool group by itself.
All the viewers of a page register their listener on the parent document, so
each one was also handling the events dispatched by the others: the first
replaced the presentation mode button by its clone, and every later pass worked
on a node already detached from the document, failing on a null parent. The
listener now handles only the event whose source is its own window.
2026-09-24 15:16:43 +0200c26f88f64443a7723b9bcd9aa671e8745b38876eUpdate the embedded PDF viewer to PDF.js 6.3.289editcore-war/src/main/webapp/media/jsp/pdf/locale/kab/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ar/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/be/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_JBIG2editcore-war/src/main/webapp/media/jsp/pdf/locale/nb-NO/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/viewer.min.cssaddcore-war/src/main/webapp/media/jsp/pdf/wasm/openjpeg_nowasm_fallback.jseditcore-war/src/main/webapp/media/jsp/pdf/locale/gn/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/oc/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/core/pdf.sandbox.min.jseditcore-war/src/main/webapp/media/jsp/pdf/locale/en-CA/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/si/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/eo/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/pages_closeButton.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/br/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/brx/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/wo/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ca/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/gu-IN/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/id/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/rm/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/mr/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/comment-popup-editButton.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/pt-PT/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/wasm/quickjs-eval.jseditcore-war/src/main/webapp/media/jsp/pdf/locale/ia/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-signaturePropertiesError.svgeditcore-war/src/main/webapp/media/jsp/pdf/viewer.jspeditcore-war/src/main/webapp/media/jsp/pdf/locale/ja/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/meh/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/wasm/qcms_bg.wasmeditcore-war/src/main/webapp/media/jsp/pdf/core/pdf.min.jseditcore-war/src/main/webapp/media/jsp/pdf/locale/zh-CN/viewer.ftleditcore-web/src/main/java/org/silverpeas/core/web/util/viewgenerator/html/JavascriptPluginInclusion.javaaddcore-war/src/main/webapp/media/jsp/pdf/images/messageBar_warning.svgaddcore-war/src/main/webapp/media/jsp/pdf/images/pages_viewArrow.svgaddcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-viewsManagerToggle.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/sv-SE/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/sp-viewer.csseditcore-war/src/main/webapp/media/jsp/pdf/locale/locale.jsoneditcore-war/src/main/webapp/media/jsp/pdf/locale/da/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/eu/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/hy-AM/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/nn-NO/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/de/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/vi/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/gd/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/th/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/skr/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/messageBar_info.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/my/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/trs/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/iccs/CGATS001Compat-v2-micro.iccaddcore-war/src/main/webapp/media/jsp/pdf/wasm/jbig2_nowasm_fallback.jseditcore-war/src/main/webapp/media/jsp/pdf/locale/ms/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/checkmark.svgaddcore-war/src/main/webapp/media/jsp/pdf/wasm/quickjs-eval.wasmeditcore-war/src/main/webapp/media/jsp/pdf/locale/es-AR/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/comment-actionsButton.svgaddcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-menuArrowNova.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/ltg/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/hr/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/hu/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ko/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/uk/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/comment-editButton.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/kn/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/bg/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/el/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/tr/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/lv/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/hi-IN/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/wasm/jbig2.wasmeditcore-war/src/main/webapp/media/jsp/pdf/locale/cs/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ta/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/km/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/an/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/bn/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/cak/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/locale/ml/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/altText_warning.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/sco/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/xh/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/es-MX/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/mk/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/sk/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-editorSignature.svgeditcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-editorStamp.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/kk/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/et/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/iccs/LICENSEeditcore-war/src/main/webapp/media/jsp/pdf/locale/is/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_PDFJS_JBIG2editcore-war/src/main/webapp/media/jsp/pdf/locale/lt/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ach/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/he/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/dsb/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/bs/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/lij/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/pt-BR/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/it/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/bo/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/fur/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_QCMSaddcore-war/src/main/webapp/media/jsp/pdf/images/cursor-editorFreeHighlight.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/es-CL/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_OPENJPEGeditcore-war/src/main/webapp/media/jsp/pdf/locale/sr/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/viewer.min.jseditcore-war/src/main/webapp/media/jsp/pdf/locale/sl/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/messageBar_closingButton.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/az/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ne-NP/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_PDFJS_OPENJPEGeditcore-war/src/main/webapp/media/jsp/pdf/locale/en-US/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/editor-toolbar-edit.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/ur/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/gl/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/fr/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ro/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-signaturePropertiesVerified.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/fa/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ff/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/sq/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/altText_disclaimer.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/es-ES/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/hye/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/comment-closeButton.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/zh-TW/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/te/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/altText_spinner.svgdeletecore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-sidebarToggle.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/tl/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/cy/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/szl/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/locale/bqi/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/pages_selected.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/nl/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/lo/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/core/pdf.worker.min.jseditcore-war/src/main/webapp/media/jsp/pdf/locale/fi/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/signature-properties-row-check.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/ast/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/images/toolbarButton-editorFreeText.svgaddcore-war/src/main/webapp/media/jsp/pdf/wasm/LICENSE_PDFJS_QCMSeditcore-war/src/main/webapp/media/jsp/pdf/locale/scn/viewer.ftldeletecore-war/src/main/webapp/media/jsp/pdf/images/gv-toolbarButton-openinapp.svgeditcore-war/src/main/webapp/media/jsp/pdf/standard_fonts/LICENSE_LIBERATIONeditcore-war/src/main/webapp/media/jsp/pdf/doc/README.mdaddcore-war/src/main/webapp/media/jsp/pdf/wasm/openjpeg.wasmeditcore-war/src/main/webapp/media/jsp/pdf/locale/ga-IE/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ckb/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/fy-NL/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/pa-IN/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/uz/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/pl/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/af/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ru/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/sat/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/en-GB/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/sc/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/tg/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/pages_viewButton.svgeditcore-war/src/main/webapp/media/jsp/pdf/locale/son/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/hsb/viewer.ftleditcore-war/src/main/webapp/media/jsp/pdf/locale/ka/viewer.ftladdcore-war/src/main/webapp/media/jsp/pdf/images/cursor-editorTextHighlight.svg
- core-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.java16f409d825312915c2a820091b3da9709e1042771790255899000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comStop the embedded PDF viewer from failing on the byte ranges it requests
Displaying a publication holding several attached documents ends frequently, on
one of the viewers and never the same one, in
Message: Invalid PDF structure.
The content of a pdf is guarded by a token set in cache by the viewer page and
consumed by EmbedMediaViewerResource#getPdfContent, which answers otherwise a
redirection to the viewer page. PDF.js doesn't fetch the document in a single
request: once the first one answered, it asks again on the same URL for the byte
ranges it needs, typically to reach the cross-reference table. That second
request finds no token anymore and receives the HTML of the viewer page in place
of the bytes of the document, which it reports as an invalid structure. Whether
the document is displayed depends on the full stream having been received before
the range answer was needed, hence the randomness. The time to live of ten
seconds adds a second way to fail when several viewers compete for the
connections of the browser.
The token is no longer consumed on the first reading and carries a time to idle
instead of a time to live, PerElementExpiration renewing it at each access: the
access stays valid as long as the viewer actually uses it and expires a minute
after the last one. The authorization itself is unchanged, getPdfContent still
resolving the document through getAuthorizedResourceView.
2026-09-24 15:18:19 +020016f409d825312915c2a820091b3da9709e104277Stop the embedded PDF viewer from failing on the byte ranges it requestseditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.java
- core-war/src/main/webapp/util/javaScript/silverpeas-identitycard.jsa66c5a517e740105ad5aa1f92aa5c99561543e7b1790256861000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comUser data to render in an identity card can be other than a string.
For its rendering any user data is unescaped for HTML. But this is a
string function and some user data can be not a string. So, test before
applying the `unescapeHTML()` function the user data is well a string.
Otherwise don't apply the function.
2026-09-24 15:34:21 +0200a66c5a517e740105ad5aa1f92aa5c99561543e7bUser data to render in an identity card can be other than a string.editcore-war/src/main/webapp/util/javaScript/silverpeas-identitycard.js
- core-war/src/main/webapp/util/javaScript/silverpeas-layout.js539a33537894703e6f9a66b649be686dc8712e451790258735000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comLog the close code of the SSE WebSockets and count each failed connection once
A WebSocket that fails fires an error event, carrying no information at all,
always followed by a close event. Both of them called the error handler of
SilverpeasEventSource, so each failed connection was counted twice in the
reconnection attempts and logged as a meaningless error ({"isTrusted":true}).
The close event is now the only one in charge of the reconnection, and it logs
the close code and reason, which are the only hints about the failure (1006
for an abnormal closure, as when a reverse proxy doesn't forward the Upgrade
headers of the handshake).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-24 16:05:35 +0200539a33537894703e6f9a66b649be686dc8712e45Log the close code of the SSE WebSockets and count each failed connection onceeditcore-war/src/main/webapp/util/javaScript/silverpeas-layout.js
- core-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jscore-war/src/main/webapp/util/javaScript/silverpeas-ddUpload.jscore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadData.java9b57c3fe0a2b3d7ef1303c4e35142388f6a9dc0a1790265833000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comFix bug #15479: the file name in the X-FULL-PATH header is again URI-encoded
HTTP headers can carry only ISO-8859-1 characters. Since the fix of bug #15388,
the name of a dropped file was sent raw in the X-FULL-PATH header. On Mac OS,
file names are in NFD form, so an accented character is followed by a combining
diacritic that isn't a Latin-1 character: XMLHttpRequest#setRequestHeader()
then throws an error and the file is never uploaded.
The name is now URI-encoded by the client (drag & drop and file upload
components) and decoded by FileUploadData before being normalized to NFC.
To keep the protection brought by the fix of vulnerability #15358, the
MassiveWebSecurityFilter checks also the URI-decoded value of the custom
X-* headers against XSS and SQL injections.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-24 18:03:53 +02009b57c3fe0a2b3d7ef1303c4e35142388f6a9dc0aFix bug #15479: the file name in the X-FULL-PATH header is again URI-encodededitcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javaeditcore-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jseditcore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadData.javaeditcore-war/src/main/webapp/util/javaScript/silverpeas-ddUpload.js
- core-web/src/main/java/org/silverpeas/core/webapi/comment/CommentEntity.javacore-api/src/test/java/org/silverpeas/core/util/JSONCodecTest.javacore-api/src/main/java/org/silverpeas/core/util/JSONCodec.javacore-rs/src/main/java/org/silverpeas/core/web/rs/ObjectMapperResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.java5cc19e86433a938243d9355b17b64b2842fd53041790325476000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comFix bug #15462: a comment can again be modified by its author
The comments widget sends back to the server, in a PUT request, the
whole JSON representation of a comment it got from a GET request, with
only the text changed. Since the migration to WildFly 39, such a request
was rejected with a 400 HTTP status: the JSON representation carries the
read-only properties of the comment's author (blockedState, status, ...),
and the Jackson mapper used by RESTEasy 6.2 rejects any property that is
unknown to the entity to deserialize.
Until 6.4, the REST API tolerated those properties without anyone knowing
why: the PSU SCIM library then embedded in the WAR registered for the
whole application a ContextResolver<ObjectMapper> whose mapper ignored
the unknown properties. With the switch to Apache SCIMple, whose JSON
provider is scoped to the SCIM resources only, that resolver went away
and the REST API fell back on the default, strict, mapper of RESTEasy.
So, Silverpeas now provides its own ContextResolver<ObjectMapper> to the
JAX-RS runtime. The mapper it serves is built by the new method
JSONCodec.newObjectMapper(), so that a bean is (un)marshalled the same
way by the REST API and by the JSON codec: Jackson and Jakarta XML
Binding annotations are both taken into account, null properties are
omitted, and unknown properties are ignored. The codec also uses now a
single shared mapper instead of building a new one at each call.
Also fix the URI of the comment returned by the PUT request, which
carried the comment identifier twice.
2026-09-25 10:37:56 +02005cc19e86433a938243d9355b17b64b2842fd5304Fix bug #15462: a comment can again be modified by its authoraddcore-rs/src/main/java/org/silverpeas/core/web/rs/ObjectMapperResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentEntity.javaeditcore-api/src/main/java/org/silverpeas/core/util/JSONCodec.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javaaddcore-api/src/test/java/org/silverpeas/core/util/JSONCodecTest.java
- core-war/src/main/java/org/silverpeas/web/socialnetwork/newsfeed/servlets/NewsFeedJSONServlet.java1304c37395ed48d15f3de5dd28778f74216c84a51790340800000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comFix the display of the accepted-invitation event in the news feed
The label of a RELATIONSHIP social information embeds the HTML fragment
generated by UserNameGenerator so that the name of the new contact is
zoomable. This fragment was passed to LocalizationBundle#getStringWithParams
which HTML-encodes all its string parameters, so the fragment was encoded a
second time and the <span> tags were displayed as text in the feed.
The message is now formatted directly with MessageFormat from the raw bundle
pattern. Only the full name of the contact remains HTML-encoded, which is
already done by UserNameGenerator.
2026-09-25 14:53:20 +02001304c37395ed48d15f3de5dd28778f74216c84a5Fix the display of the accepted-invitation event in the news feededitcore-war/src/main/java/org/silverpeas/web/socialnetwork/newsfeed/servlets/NewsFeedJSONServlet.java
- core-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.java40c8b4dd7931335c08801b762a355283f03d4ffa1790349587000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comThe password checking web service rejects a request without password
Since the fix of bug #15462, the Jackson mapper of the REST API ignores
the JSON properties unknown to the web entity to deserialize. A POST
request at password/policy/checking whose body carries no "value"
property is thus no longer rejected at deserialization: it yields a
PasswordEntity with a null password, which the PasswordRulesService
checked without complaint. The integration test
PasswordPolicyCheckingIT#postAnInvalidResourceState, which expects a 400
HTTP status for such a body, then failed with a 200.
Like the other resources handling POST requests, PasswordResource now
validates the entity it receives and answers with a 400 HTTP status when
it carries no password to check.
2026-09-25 17:19:47 +020040c8b4dd7931335c08801b762a355283f03d4ffaThe password checking web service rejects a request without passwordeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.java
- core-war/src/main/java/org/silverpeas/web/jobdomain/control/JobDomainPeasSessionController.java969e2118e87aad06e5a036b5cec76d30c7e308671790350669000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comRemove leftover debug code that removed 60 users instead of one
Commit 2d747ab27b (fix of bug #15217) left in
JobDomainPeasSessionController#removeUser a debugging loop that removed
the users whose identifiers range from the given one to the given one
plus 60, without any failure control. Restore the original behaviour:
only the requested user is removed, and a failure raises an exception.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-25 17:37:49 +0200969e2118e87aad06e5a036b5cec76d30c7e30867Remove leftover debug code that removed 60 users instead of oneeditcore-war/src/main/java/org/silverpeas/web/jobdomain/control/JobDomainPeasSessionController.java
githttps://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse1162https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1162/1160https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1160/Lancé par une alarme périodiqueSKIP_TESTfalseSKIP_QUALITYfalse116056f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube11603a57787faaff0b7941c04146ff51cccd1b963cfc3a57787faaff0b7941c04146ff51cccd1b963cfcrefs/remotes/origin/master3a57787faaff0b7941c04146ff51cccd1b963cfc3a57787faaff0b7941c04146ff51cccd1b963cfcrefs/remotes/origin/master3a57787faaff0b7941c04146ff51cccd1b963cfc3a57787faaff0b7941c04146ff51cccd1b963cfcrefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1160d68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11603371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1160ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11600c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11607b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Assemblybuild.yamlbuild.yamltarget/build.yamlfalse6.5-build2609211769110550775Silverpeas_Master_AutoDeploy 6.5-build2609211160false116062135SUCCESS1790184240597https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1160/false1161https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1161/blueLancé par une alarme périodiqueSKIP_TESTfalseSKIP_QUALITYfalse116056f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube11603a57787faaff0b7941c04146ff51cccd1b963cfc3a57787faaff0b7941c04146ff51cccd1b963cfcrefs/remotes/origin/master3a57787faaff0b7941c04146ff51cccd1b963cfc3a57787faaff0b7941c04146ff51cccd1b963cfcrefs/remotes/origin/master3a57787faaff0b7941c04146ff51cccd1b963cfc3a57787faaff0b7941c04146ff51cccd1b963cfcrefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1160d68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11603371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1160ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11600c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11607b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Assemblybuild.yamlbuild.yamltarget/build.yamlfalse6.5-build2609211769110550775Silverpeas_Master_AutoDeploy 6.5-build2609211160false116062135SUCCESS1790184240597https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1160/false1161https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1161/Stabilité du build : 2 des 5 derniers builds ont échoué.icon-health-40to59health-40to59.png60falseLancé par une alarme périodiqueSKIP_TESTfalseSKIP_QUALITYfalse116456f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube11643f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/master3f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/master3f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1164eca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/mastereca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/mastereca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11643371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1164ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11640c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11647b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-AssemblyAaD0l2pebQNaPUmG7crvSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=masterAaD0uxyCkj6CGoBn7yygSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Components&branch=masterbuild.yamlbuild.yamltarget/build.yamlfalse6.5-build2609302406508710550775Silverpeas_Master_AutoDeploy 6.5-build2609301164false116463961SUCCESS1790789040596https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1164/- core-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javacore-restapi/src/site/resources/index.htmlcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javacore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javacore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentListResource.javacore-web/src/main/java/org/silverpeas/core/webapi/publication/SharedPublicationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/rating/RatingResource.javacore-web/src/main/java/org/silverpeas/core/webapi/sharing/TicketResource.javacore-restapi/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javacore-web/src/main/java/org/silverpeas/core/webapi/publication/PublicationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javacore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/UserProfileResource.javacore-web/src/main/java/org/silverpeas/core/webapi/mylinks/MyLinksResource.javacore-web/src/main/java/org/silverpeas/core/webapi/security/CipherKeyResource.javacore-web/src/main/java/org/silverpeas/core/webapi/variables/VariablesResource.javacore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/RelationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/search/SearchResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentsResource.javacore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javacore-web/src/main/java/org/silverpeas/core/webapi/util/logging/LogResource.javacore-web/src/main/java/org/silverpeas/core/webapi/node/AbstractNodeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/AuthenticationResource.javacore-rs/pom.xmlcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authenticated.javacore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/UserGroupProfileResource.javacore-library/src/main/java/org/silverpeas/core/i18n/AbstractI18NBean.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/invitation/InvitationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscribeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/preferences/MyPreferencesResource.javacore-web/src/main/java/org/silverpeas/core/webapi/cache/VolatileCacheResource.javacore-web/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/FilteredPdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/selection/SelectionBasketResource.javacore-web/src/main/java/org/silverpeas/core/webapi/util/logging/SilverLoggerConfigurationResource.javapom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SharedAttachmentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/thesaurus/ThesaurusResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaPlayerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/language/LanguageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/sharing/SharingResource.javacore-web/src/main/java/org/silverpeas/core/webapi/wysiwyg/WysiwygEditorConfigResource.javacore-web/src/main/java/org/silverpeas/core/webapi/session/SilverpeasUserSessionTokenResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResourceCreator.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/AttachmentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/bundle/BundleResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/UnsubscribeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/workflow/ReplacementResource.javacore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaec9caee6b1242b8d5893ed5ece0884304d811cb01790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGenerate the documentation of the REST API with Swagger instead of Smart-Doc
Smart-Doc parses the sources with QDox and chokes on constructs Silverpeas
relies on, silently reporting a success while producing an incomplete
documentation. Swagger scans the compiled classes by reflection and understands
the JAX-RS annotations, so the whole REST API is covered.
The new core-restapi module gathers the web resources of all the modules into a
single OpenAPI 3.1 document, rendered by Redoc and published on its own at
docs/restapi/core. It produces nothing but that documentation and builds only
with the restapi profile, from which the Smart-Doc plugin is dropped.
All the 217 operations, spread over 168 paths and 86 schemas, are now
documented: a summary, a success response with its schema, and the errors the
endpoint can answer. The responses common to several endpoints are declared once
for all:
* @Authenticated and @Authorized, besides the security schemes they already
described, bring the 401 and 403 responses of the protected resources;
* the 503 is brought by CommonResponsesFilter, applied once the specification
has been figured out. It cannot come from another meta-annotation of the web
resources: at class level Swagger returns the responses of the first
meta-annotation declaring some instead of merging them all, so a second one
would silently discard the responses of @Authenticated and @Authorized;
* the recurring 404, 400 and 409 are factored out into the @NotFound,
@BadRequest and @Conflict annotations of the new annotation.doc package.
Contrary to the class level one, the method level lookup of Swagger does
merge, but the description of such an annotation takes precedence over the
one an endpoint would declare for the same status code, hence an endpoint
needing another wording must not be annotated.
Documenting the endpoints brought several defects to light, which are fixed
here: the wrong descriptions of the personal space endpoints of SpaceResource, a
test endpoint left over in CipherKeyResource, and the conflicting setters of
AbstractI18NBean for the translations property, which made the scan fail.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200ec9caee6b1242b8d5893ed5ece0884304d811cb0Generate the documentation of the REST API with Swagger instead of Smart-Doceditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaPlayerResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/RelationResource.javaeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authenticated.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/cache/VolatileCacheResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResourceCreator.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javaaddcore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javaeditpom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/UserGroupProfileResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/invitation/InvitationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/search/SearchResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/security/CipherKeyResource.javaeditcore-library/src/main/java/org/silverpeas/core/i18n/AbstractI18NBean.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/FilteredPdcResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/workflow/ReplacementResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/wysiwyg/WysiwygEditorConfigResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/session/SilverpeasUserSessionTokenResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscribeResource.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/sharing/TicketResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/rating/RatingResource.javaeditcore-web/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/mylinks/MyLinksResource.javaaddcore-restapi/src/site/resources/index.htmleditcore-web/src/main/java/org/silverpeas/core/webapi/util/logging/LogResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/UnsubscribeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/AttachmentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/thesaurus/ThesaurusResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/UserProfileResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/publication/PublicationResource.javaaddcore-restapi/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/language/LanguageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/variables/VariablesResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/selection/SelectionBasketResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/sharing/SharingResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/publication/SharedPublicationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/bundle/BundleResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentsResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/AuthenticationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SharedAttachmentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/util/logging/SilverLoggerConfigurationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentListResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/node/AbstractNodeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/preferences/MyPreferencesResource.javaeditcore-rs/pom.xml
- core-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javacore-restapi/pom.xmlc097c5d943af83fb5ce284ad45b733a9d806b7611790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comMake the schema resolver of Swagger aware of the JAXB annotations
The resolver figures the properties of a web entity out with a plain Jackson
object mapper, whereas Silverpeas serializes them with the introspector of the
JAXB annotations. The generated schemas were therefore describing properties
that never reach the wire and missing others that do:
* an entity whose access is set to XmlAccessType.FIELD was described by its
getters instead of its fields. SpaceAppearanceEntity came out with two
properties where six are serialized;
* a member annotated with @XmlTransient was described all the same.
PdcAxisValueEntity came out with eleven properties where nine are
serialized.
The JAXBAnnotationsHelper of Swagger is of no help here: it reads @XmlElement,
@XmlElementWrapper and @XmlAttribute only, and only to feed the XML metadata of
a schema, never its visibility. As for the Jackson module bringing that
introspector, it does declare itself to the ServiceLoader, but Swagger never
asks for the modules available in the classpath.
The resolver declared here sets the introspector on a mapper of its own, the
very way the JSON codec of Silverpeas does, so that it applies to the resolution
of the schemas only. Ten business objects were documented that no endpoint ever
answers -- User, UserDetail, Domain, Quota, SettingBundle, PdcPosition and the
like -- and they are gone now.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200c097c5d943af83fb5ce284ad45b733a9d806b761Make the schema resolver of Swagger aware of the JAXB annotationsaddcore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javaeditcore-restapi/pom.xml
- core-restapi/src/main/openapi/openapi.yamlcore-restapi/pom.xmlcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthenticatedAnnotationProcessor.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthorizedAnnotationProcessor.java692a545a5347eefc22d5e8f1949b6ce94151f2741790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comPublish nothing but the documentation of the REST API
The generated specification declared no info section, which OpenAPI requires. A
renderer refuses to display such a document, whatever the quality of the rest of
it, and Redoc did. Contrary to the plugin of SmallRye, the one of Swagger has no
parameter to fill that section in, hence the document of its own declared here:
the scan completes it, and Maven fills its version in.
Besides the documentation of the REST API, the module was publishing the site
Maven builds for it: the reports about the dependencies, the SCM, the javadoc of
a module that has almost no source. Those reports aren't produced any more, and
what the site brings along -- its decoration and its sitemap, of no use to the
rendering page -- is dropped once the site has been built, before it gets
published. The published tree is now made of the rendering page, the
specification in both of its formats, and the rendering engine.
Skipping the site altogether looked simpler but isn't an option: the deploy goal
of the site plugin reads the very same maven.site.skip property as its site
goal, so the documentation would have silently stopped being published.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200692a545a5347eefc22d5e8f1949b6ce94151f274Publish nothing but the documentation of the REST APIeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthorizedAnnotationProcessor.javaeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javaaddcore-restapi/src/main/openapi/openapi.yamleditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthenticatedAnnotationProcessor.javaeditcore-restapi/pom.xml
- core-restapi/pom.xml078323a23b15cb23bbbcaa797991a709645d0f7d1790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from the parent POM what doesn't depend on the project
The version of Redoc, swagger-core, the base document carrying the info section,
the output of the generated specification and the binding of the resolve goal of
Swagger, along with the execution stripping the Maven site, are now managed by
the parent POM. The module keeps what is its own: the packages to scan, the
routes of the SCIM API not to publish, its filter and its schema resolver, the
WAR whose classes are unpacked, and the URL the documentation is published at.
It also keeps the setting silencing the reports of the site plugin: that plugin
is declared by the root POM of the project, so managing the setting in the
parent would make every Maven site of Silverpeas lose its reports.
This takes effect once the parent POM is released: the project still refers to
the last released one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200078323a23b15cb23bbbcaa797991a709645d0f7dTake from the parent POM what doesn't depend on the projecteditcore-restapi/pom.xml
- core-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javacore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javacore-web/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javacore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javacore-restapi/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/BadRequest.javacore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/CommonResponsesFilter.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/JaxbAwareModelResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javacore-rs/pom.xmlb738adf1743bdd89b3f676bf5dcc7acd6ccf2d9a1790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGather in core-rs what generates the documentation of the REST API
The filter completing the responses of every endpoint and the resolver reading
the JAXB annotations of the web entities were duplicated, one copy per project
documenting its REST API, the two being identical but for their package. They
are gathered here, beside the annotations documenting the common errors, in a
package of their own: org.silverpeas.core.rs.doc.
Their name being the same for every project now, the parent POM declares them
once for all, and nothing is left to keep the copies in step.
The counterpart is that core-rs, a module of production, depends on swagger-core
to compile them. The dependency is provided, so nothing of it is shipped, and
neither the filter nor the resolver plays any role at runtime: both are read
when generating the documentation only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200b738adf1743bdd89b3f676bf5dcc7acd6ccf2d9aGather in core-rs what generates the documentation of the REST APIaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/JaxbAwareModelResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/Conflict.javadeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javaeditcore-web/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javadeletecore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/CommonResponsesFilter.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javadeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javaeditcore-restapi/pom.xmldeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/NotFound.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/BadRequest.javadeletecore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javaeditcore-rs/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.java
- core-restapi/pom.xmld41b4c150a336e2cb3019a2b3687c5a403cba3d41790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comOpt in the stripping of the Maven site
The strip-maven-site execution of the parent POM is now skipped by default: it
used to apply to every project inheriting from that POM and wiped out the Maven
site such a project publishes. This module publishes the documentation of the
REST API and nothing else, so it asks for the execution by setting
strip.maven.site.skip to false.
2026-09-28 14:12:17 +0200d41b4c150a336e2cb3019a2b3687c5a403cba3d4Opt in the stripping of the Maven siteeditcore-restapi/pom.xml
- core-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web-test/src/main/java/org/silverpeas/web/test/stub/TestHttpRequest.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.java5f5891af886c501d82d72d54f15552e3775e0ce71790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comHarden the detection of the event callbacks against the vulnerabilities #1458, #1459 and #1460
(GitHub issues, reported against 6.4.6)
The three reported stored XSS rely on an event callback attribute carried by an
element the browser fails to load on purpose. Such a declaration was detected by
the \s+on\w+\s*= pattern, which expects a whitespace before the attribute name.
According to the HTML tokenizer, an attribute name is also expected right after
the closing quote of the previous attribute value (a
missing-whitespace-between-attributes parse error, whose recovery is mandated by
the specification) and right after a solidus. So the following did declare an
onerror callback the browsers do run, while going through the filter:
<img src="x"onerror=alert(1)>
The pattern now accepts these separators as well.
Note this filter is an input guard, not an output encoding: it narrows the
reachability of the three flaws but it doesn't fix the rendering code itself.
MassiveWebSecurityFilterOnReportedXssIT covers the payloads of the three reports
on their actual endpoints and parameters, including when they are submitted as
multipart/form-data streams as the genuine forms do. It also delimits the
multipart exemption, which applies to the webPages component only.
TestHttpRequest.getContentType() returned null whatever the headers set on the
stub, which made the multipart branch untestable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 81589f6134e8e337c16a6c390b2d804e78006f8f)
2026-09-28 14:42:28 +02005f5891af886c501d82d72d54f15552e3775e0ce7Harden the detection of the event callbacks against the vulnerabilities #1458, #1459 and #1460editcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javaaddcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.javaeditcore-web-test/src/main/java/org/silverpeas/web/test/stub/TestHttpRequest.java
- core-war/src/main/webapp/defaultLoginQuestion.jsp018ed026afbb76a9ad52281cd62b8e284b9a914a1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1458
(GitHub issue, reported against 6.4.6)
The login question, which any authenticated user sets from their profile, was
printed raw by a JSP scriptlet on the password reminder page, an anonymous one.
Any script stored there was then run in the browser of every visitor of that
page, without any login required from them. The answer to that question, itself
a credential, is asked on the very same page.
The value is now HTML encoded on output, through a c:out tag. Doing so on the
rendering side rather than on the writing one closes both the ways the field is
fed: MyProfilRequestRouter, which the report points at, but also
ValidationQuestionHandler, which stores the question of the ValidateQuestion
function with no more filtering. It also neutralizes the values already stored.
The login of the hidden field below is encoded as well. It comes from a lookup
in the database and not from the request parameter, so exploiting it would
require a login holding a quote, but the encoding costs nothing here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 457be5fa780ce2656d7104f31515ea7064e2fbf6)
2026-09-28 14:42:28 +0200018ed026afbb76a9ad52281cd62b8e284b9a914aFix vulnerability #1458editcore-war/src/main/webapp/defaultLoginQuestion.jsp
- core-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javacore-services/importExport/src/main/java/org/silverpeas/core/importexport/report/HtmlExportPublicationGenerator.javacore-configuration/src/main/config/properties/org/silverpeas/util/security.propertiescore-library/src/main/java/org/silverpeas/core/contribution/content/form/displayers/WysiwygFCKFieldDisplayer.javacore-library/src/integration-test/resources/org/silverpeas/util/security.propertiescore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentRenderer.javacore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javacore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javacore-library/src/integration-test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygControllerIT.javacore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.javacore-services/importExport/src/main/java/org/silverpeas/core/importexport/control/PublicationsTypeManager.javacore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformer.javacore-library/src/integration-test/java/org/silverpeas/core/test/LibCoreWarBuilder.java37283d39cead2166ad9483d373658c2b8e414c951790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1459
(GitHub issue, reported against 6.4.6)
The WYSIWYG content of a form field was written into the response as raw HTML by
WysiwygFCKFieldDisplayer, so any script stored by the writer of a whitePages
card was run in the browser of every user viewing it. The same held for the
content of a publication, rendered by WysiwygContentRenderer, and for the two
export paths, none of which was reported.
Such a content is sanitized now, by the new SanitizeForRenderingDirective.
Unlike SanitizeDirective, which keeps only a restricted set of safe elements and
is left untouched for the contents extracted out of Silverpeas, this one keeps
the content as it is and drops only what can act on the visitor's browser:
- the elements able to run code or to take over the document, with their
content;
- the event callback attributes, whatever the element carrying them;
- the attributes referring a URL with a scripting scheme;
- the iframes and the media whose source isn't allowed.
This is deliberate: the WYSIWYG editor is set up to accept any content
(config.allowedContent = true in silverconfig.js), so an allow list applied at
rendering time would be narrower than what the users are entitled to write. It
would in particular have dropped the media produced by the video and html5audio
plugins and the rel attribute the userzoom and identitycard ones rely upon.
The parsing is delegated to the HTML tokenizer of the OWASP sanitizer, so the
content is read the way a browser reads it and the dropping can't be dodged by
playing with the HTML syntax.
The rule deciding whether the source of an iframe is allowed moves to the new
EmbeddedSourceValidator class, so that the filtering of the incoming requests
and this sanitization agree on it. It now serves the media as well, through the
new security.external.media.hosts.allowed property. That property is shipped
with the * value, which allows any host and hence preserves the behaviour of the
previous versions; setting it empty restricts the media to the ones Silverpeas
hosts itself. The inlined images are kept whatever it is, being carried by the
content itself.
The mail path is deliberately left out: its images are referred by cid URLs,
which such a sanitization drops, and its content isn't rendered in the
Silverpeas origin anyway.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 2961a40c81708375b2136cfa18f7c5f5e1d97321)
2026-09-28 14:42:28 +020037283d39cead2166ad9483d373658c2b8e414c95Fix vulnerability #1459addcore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javaeditcore-library/src/integration-test/java/org/silverpeas/core/test/LibCoreWarBuilder.javaaddcore-library/src/integration-test/resources/org/silverpeas/util/security.propertieseditcore-configuration/src/main/config/properties/org/silverpeas/util/security.propertieseditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentRenderer.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/form/displayers/WysiwygFCKFieldDisplayer.javaeditcore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javaaddcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javaeditcore-services/importExport/src/main/java/org/silverpeas/core/importexport/control/PublicationsTypeManager.javaeditcore-services/importExport/src/main/java/org/silverpeas/core/importexport/report/HtmlExportPublicationGenerator.javaeditcore-library/src/integration-test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygControllerIT.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformer.javaeditcore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.java
- core-library/src/main/java/org/silverpeas/core/util/HttpUtil.javab2900e3c4738e94ab34622ee8a48197f7921a09f1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1461
(GitHub issue, reported against 6.4.6)
Let the callers of HttpUtil complete the HTTP client.
Fixing that vulnerability requires the gallery component to request the image of
a watermark with a connection timeout and without following the redirections,
the latter being able to escape the verification of the address being requested.
httpClientBuilder() gives the builder of the HTTP client, already configured
with the proxy of Silverpeas, so that such a caller can complete the
configuration without having to duplicate that of the proxy. httpClient() now
delegates to it and is unchanged for its own callers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 16cff5ecd5e217798d51ebe7f5a97103f4d901b0)
2026-09-28 14:42:28 +0200b2900e3c4738e94ab34622ee8a48197f7921a09fFix vulnerability #1461editcore-library/src/main/java/org/silverpeas/core/util/HttpUtil.java
- core-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jscore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.java23acd94a451f35afaf18324777b344292593341b1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix the vulnerabilities CVE-2026-78738 and CVE-2026-78741
Both report a stored XSS through the name of an uploaded file, one from the
document management and the other from the image upload of the WYSIWYG editor.
They share their cause: the name is written as an HTML content by the upload
widget, whereas it is carried by the request and escaped on the sending side
only, which protects from nothing as a request can be forged.
The name is now set as a text. Note the formatted size which followed it was
already not displayed, html() taking a single argument, so the display is left
unchanged.
A scripting scheme given as the value of an attribute is detected as well by
MassiveWebSecurityFilter. Such a declaration holds no on prefix and was
therefore going through, and the colon introducing it is accepted written as
the character itself or as any of the HTML entities standing for it, as the
reported payload uses "javascript:". The data scheme is deliberately left
out: the contents do embed their inlined images with it.
(cherry picked from commit 4f92097f60d0d6e8072815cf5a77093d3f19f9e3)
2026-09-28 14:42:28 +020023acd94a451f35afaf18324777b344292593341bFix the vulnerabilities CVE-2026-78738 and CVE-2026-78741editcore-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jseditcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.java
- core-library/src/main/java/org/silverpeas/core/node/dao/NodeDAO.javacore-library/src/integration-test/resources/org/silverpeas/core/node/dao/nodes-sorting-dataset.sqlcore-library/src/integration-test/java/org/silverpeas/core/node/dao/NodeSortingIT.javacore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.java52843258f403c47fb8a0b51a75295f883fb98eda1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comSort only the nodes of the component instance being administrated
The sorting of the nodes was granted against the component instance referred by
the URL of the REST service, whereas the nodes to sort were taken from the
request body, each of them carrying the component instance it belongs to. An
administrator of any instance could hence ask to sort the nodes of another one.
The nodes are now identified within the instance of the URL, the one the
authorization has been checked against. Taking that instance from the body
brought nothing: the sorting applies by nature to the instance administrated.
That wasn't enough though. NodeDAO was updating the order of a node by its
identifier only, whereas such an identifier isn't unique by itself: the root
node of every component instance is numbered 0, and the ones below it can bear
the same numbers from an instance to another. So the instance of the node is
now part of the criteria. Beyond the authorization, this was a defect on its
own: sorting the nodes of an instance was renumbering the nodes of the other
ones bearing the same identifiers, whoever asked for that sorting.
NodeSortingIT covers the sorting of the nodes of an instance and the isolation
of the other instances from it, in both directions.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e7028e01e7261c16803ee20f841763ef5b84ab7b)
2026-09-28 14:42:28 +020052843258f403c47fb8a0b51a75295f883fb98edaSort only the nodes of the component instance being administratededitcore-library/src/main/java/org/silverpeas/core/node/dao/NodeDAO.javaaddcore-library/src/integration-test/resources/org/silverpeas/core/node/dao/nodes-sorting-dataset.sqleditcore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaaddcore-library/src/integration-test/java/org/silverpeas/core/node/dao/NodeSortingIT.java
- core-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-war/src/main/webapp/defaultLoginQuestion.jspdf92a06600aedb5b24bad01559165e839421c2b51790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake into account sonarcloud feedback
2026-09-28 14:42:28 +0200df92a06600aedb5b24bad01559165e839421c2b5Take into account sonarcloud feedbackeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-war/src/main/webapp/defaultLoginQuestion.jsp
- core-configuration/src/main/config/properties/org/silverpeas/util/security.propertiesdb15a2e30508fb101a2addaf4780cc6479eb92701790599436000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comNow the parameter security.external.media.hosts.allowed is empty.
This means all hosts out of Silverpeas will be refused in HTML media
tags (video, iframe, img, ...)
2026-09-28 14:43:56 +0200db15a2e30508fb101a2addaf4780cc6479eb9270Now the parameter security.external.media.hosts.allowed is empty.editcore-configuration/src/main/config/properties/org/silverpeas/util/security.properties
- core-library/src/main/java/org/silverpeas/core/index/indexing/parser/tika/TikaParser.javacore-library/src/main/java/org/silverpeas/core/index/indexing/model/IndexManager.javacore-library/src/main/java/org/silverpeas/core/index/indexing/parser/Parser.java3f5875d5832af01276050f9ad75a08f7ddb4dd301790608429000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comFix bug-15488
2026-09-28 17:13:49 +02003f5875d5832af01276050f9ad75a08f7ddb4dd30Fix bug-15488editcore-library/src/main/java/org/silverpeas/core/index/indexing/parser/tika/TikaParser.javaeditcore-library/src/main/java/org/silverpeas/core/index/indexing/model/IndexManager.javaeditcore-library/src/main/java/org/silverpeas/core/index/indexing/parser/Parser.java
git- suggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/TickerResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javagallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javaquickinfo/quickinfo-library/src/main/java/org/silverpeas/components/quickinfo/NewsSort.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javagallery/gallery-library/src/main/java/org/silverpeas/components/gallery/constant/MediaResolution.javapom.xmldelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javarssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javacomponents-restapi/src/site/resources/index.htmlkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/AbstractNewsResource.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/FolderResource.javaquickinfo/quickinfo-library/src/integration-test/java/org/silverpeas/components/quickinfo/repository/NewsRepositoryIT.javacomponents-restapi/pom.xmlf2fe8d93d99b4eb77e672c047d22ce154ba946731790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGenerate the documentation of the REST API with Swagger instead of Smart-Doc
The new components-restapi module gathers the web resources of the fourteen
applications into a single OpenAPI 3.1 document, rendered by Redoc and published
on its own at docs/restapi/components. It produces nothing but that
documentation and builds only with the restapi profile, from which the Smart-Doc
plugin is dropped.
All the 81 operations, spread over 70 paths and 81 schemas, are now documented.
The twenty-two operations of the almanach are inherited from the calendar
resources of Core and needed nothing: Swagger reads the annotations of the
overridden methods. The others got a summary, a success response with its
schema, and the errors they can answer, the recurring ones coming from the
@NotFound and @Conflict annotations of Core. The 503 common to every endpoint is
brought by CommonResponsesFilter, of which this project has its own copy.
Documenting the endpoints brought several defects to light, which are fixed
here:
* three of the four folder endpoints of Kmelia were invisible in the
documentation. Swagger strips the regular expression of a path template, so
{path: \d+(/\d+)*/children} was reduced to {path} and collided with the
three other ones. The literal suffix now sits outside the template, which
matches the very same URIs;
* NewsResource caught back the WebApplicationException it had just thrown and
turned it into a 503, so neither the 404 of an unknown news nor the refusal
to delete one ever reached the requester. That refusal answers a 403 now,
instead of a 401 without any challenge;
* MediaResolution read the settings of the application from its enum
constants, making the scan fail with an ExceptionInInitializerError. The
watermark size is read lazily now;
* five classes of Quickinfo were missing the licence header.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200f2fe8d93d99b4eb77e672c047d22ce154ba94673Generate the documentation of the REST API with Swagger instead of Smart-Docaddcomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javaeditrssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaeditgallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javaeditresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javaeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javaeditsuggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditpom.xmleditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javaeditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javaeditquickinfo/quickinfo-library/src/main/java/org/silverpeas/components/quickinfo/NewsSort.javaaddcomponents-restapi/pom.xmleditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/AbstractNewsResource.javaaddcomponents-restapi/src/site/resources/index.htmleditquickinfo/quickinfo-library/src/integration-test/java/org/silverpeas/components/quickinfo/repository/NewsRepositoryIT.javaeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/constant/MediaResolution.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/TickerResource.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/FolderResource.java
- components-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javacomponents-restapi/pom.xml59908ef73f929070700744af9c79e30cf0066fff1790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comMake the schema resolver of Swagger aware of the JAXB annotations
The resolver figures the properties of a web entity out with a plain Jackson
object mapper, whereas Silverpeas serializes them with the introspector of the
JAXB annotations. The generated schemas were therefore describing properties
that never reach the wire, those excluded by @XmlTransient or by an access set
to XmlAccessType.FIELD, and missing the fields that do reach it.
Same resolver as the one of Core, of which this project has its own copy, for
the very reason its filter completing the responses has one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +020059908ef73f929070700744af9c79e30cf0066fffMake the schema resolver of Swagger aware of the JAXB annotationseditcomponents-restapi/pom.xmladdcomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.java
- components-restapi/src/main/openapi/openapi.yamlcomponents-restapi/pom.xmlae522b0fb3a88fbb36407023c62f0c096c2a3ab31790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comPublish nothing but the documentation of the REST API
The generated specification declared no info section, which OpenAPI requires. A
renderer refuses to display such a document, whatever the quality of the rest of
it. Contrary to the plugin of SmallRye, the one of Swagger has no parameter to
fill that section in, hence the document of its own declared here: the scan
completes it, and Maven fills its version in.
Besides the documentation of the REST API, the module was publishing the site
Maven builds for it: the reports about the dependencies, the SCM, the javadoc of
a module that has almost no source. Those reports aren't produced any more, and
what the site brings along -- its decoration and its sitemap, of no use to the
rendering page -- is dropped once the site has been built, before it gets
published.
Same setting as the one of Core, of which this project has its own copy, for the
very reason its filter completing the responses has one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200ae522b0fb3a88fbb36407023c62f0c096c2a3ab3Publish nothing but the documentation of the REST APIaddcomponents-restapi/src/main/openapi/openapi.yamleditcomponents-restapi/pom.xml
- components-restapi/pom.xml01111927bc2afba8b8a88f23247f97c2e70eab181790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from the parent POM what doesn't depend on the project
The version of Redoc, swagger-core, the base document carrying the info section,
the output of the generated specification and the binding of the resolve goal of
Swagger, along with the execution stripping the Maven site, are now managed by
the parent POM. The module keeps what is its own: the packages to scan, its
filter and its schema resolver, the fourteen WAR whose classes are unpacked, and
the URL the documentation is published at.
It also keeps the setting silencing the reports of the site plugin: that plugin
is declared by the root POM of the project, so managing the setting in the
parent would make every Maven site of Silverpeas lose its reports.
This takes effect once the parent POM is released: the project still refers to
the last released one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +020001111927bc2afba8b8a88f23247f97c2e70eab18Take from the parent POM what doesn't depend on the projecteditcomponents-restapi/pom.xml
- suggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javagallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javapom.xmldelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javarssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javacomponents-restapi/pom.xml021fe614496d0adf069aaade785f13438a7998ca1790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from core-rs what generates the documentation of the REST API
The filter completing the responses of every endpoint and the resolver reading
the JAXB annotations of the web entities were copied here from Silverpeas Core,
where they now sit in a package of their own, org.silverpeas.core.rs.doc,
alongside the annotations documenting the common errors. The copies are dropped
and the parent POM declares the classes of core-rs instead.
The annotations documenting the common errors follow them: the endpoints of the
applications refer them at their new place.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200021fe614496d0adf069aaade785f13438a7998caTake from core-rs what generates the documentation of the REST APIeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaeditresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javaeditrssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javaeditpom.xmleditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javaeditcomponents-restapi/pom.xmldeletecomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javaeditsuggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javadeletecomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javaeditgallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.java
- components-restapi/pom.xml9d3490bf7cd64723cdac38d15472d03679bb89501790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comOpt in the stripping of the Maven site
The strip-maven-site execution of the parent POM is now skipped by default: it
used to apply to every project inheriting from that POM and wiped out the Maven
site such a project publishes. This module publishes the documentation of the
REST API and nothing else, so it asks for the execution by setting
strip.maven.site.skip to false.
2026-09-28 14:12:34 +02009d3490bf7cd64723cdac38d15472d03679bb8950Opt in the stripping of the Maven siteeditcomponents-restapi/pom.xml
- forums/forums-war/src/main/webapp/forums/jsp/modifyMessage.jspforums/forums-war/src/main/webapp/forums/jsp/viewMessage.jspforums/forums-war/src/main/webapp/forums/jsp/editMessageKeywords.jsp3b4d732f0a1b27af91286d6a8bf01e77d8d3bde21790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1460
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The title and the body of a forum message were printed raw by JSP scriptlets on
the thread page, so any script posted by a user of the forum was run in the
browser of every user reading it.
The title is now HTML encoded on output, as the other JSPs of the component
already do through WebEncodeHelper. Two other raw outputs of the title, which
the report doesn't mention, are encoded as well: the one of modifyMessage.jsp,
where the title lands in the value attribute of an input and is hence
exploitable by escaping that attribute, and the one of editMessageKeywords.jsp.
The body is sanitized by the applySanitizeForRenderingDirective directive
introduced in Silverpeas-Core for the vulnerability #1459, which drops what can
act on the visitor's browser while keeping the content as it is.
Note the report also states the title pollutes the title element of the page.
It does appear there, but viewMessage.jsp already prints it through a c:out tag,
so it is encoded and isn't a vector.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit ea479b045468c5015e93e8b6c0924b919f8e4f32)
2026-09-28 14:43:22 +02003b4d732f0a1b27af91286d6a8bf01e77d8d3bde2Fix vulnerability #1460editforums/forums-war/src/main/webapp/forums/jsp/viewMessage.jspeditforums/forums-war/src/main/webapp/forums/jsp/editMessageKeywords.jspeditforums/forums-war/src/main/webapp/forums/jsp/modifyMessage.jsp
- gallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javagallery/gallery-library/src/test/java/org/silverpeas/components/gallery/WatermarkTest.javab0d04438a605a666ee748f7c6ca310fef0ff6a4a1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1461
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The image of a watermark is an instance parameter any manager of the space
holding the gallery can set, and the server requests it as it is, at each media
creation. It could hence be pointed at a service the server keeps for itself.
Such an URL is now verified before being requested: only the HTTP and HTTPS
schemes are handled, and the host must resolve to neither a loopback nor a
link-local address, so that neither the services bound to the server itself nor
the metadata endpoint of a cloud provider can be reached. Every address the host
resolves to is verified, otherwise a host resolving to a forbidden address
beside an allowed one would go through.
The addresses of the private networks of an organization remain reachable on
purpose: they are where the internal resources of an intranet legitimately live,
and no address range can tell them from the internal services one would rather
protect. Only an explicit list of allowed hosts could, which is left to a
further decision.
The request is besides given a timeout and its response is no longer copied
without any bound, both being able to exhaust the resources of the server, and
the redirections are no longer followed as they would escape the verification
above.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 83864c0f72b6c5f62a1afdf2cb420f8b62840f20)
2026-09-28 14:43:22 +0200b0d04438a605a666ee748f7c6ca310fef0ff6a4aFix vulnerability #1461addgallery/gallery-library/src/test/java/org/silverpeas/components/gallery/WatermarkTest.javaeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.java
- infoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/previewLetter.jspinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/headerLetter.jspinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java03b14dd2f030f634a99944c3272b31500811242f1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1462 and secure the other writings of the newsletter
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
Publishing an issue of a newsletter changes its state, stamps its publication
date, notifies the subscribers and mails the external ones. It was requested by
a GET, and the synchronizer token is required on a GET only when its URL holds
one of a few keywords, which ValidateParution holds none of. Any logged user
lured into a cross-site visit was hence publishing the issue as themselves.
The publication is now submitted by POST, on which the token is required
whatever the URL, through the formRequest facility which stamps it.
Moreover the endpoint had no role check at all, so any reader of the newsletter
was able to publish an issue and to trigger the mailing, with no luring needed.
Only its publishers and its managers can do so now.
Three other writings, which the report doesn't mention, were exposed the same
way and are secured likewise:
- resetting the content of an issue with its template, which overwrites the
content being written;
- mailing an issue to oneself and to the managers, which sends the content of an
issue not published yet and was hence a way for any reader to get a draft.
As EditContent also serves the edition itself, a mere navigation which remains a
GET, the reset is explicitly refused when it isn't requested by POST: submitting
it by POST would otherwise protect nothing, the previous URL remaining
requestable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 4bd5e04d16207d889d2b271eed87fa1962fa8ab5)
2026-09-28 14:43:22 +020003b14dd2f030f634a99944c3272b31500811242fFix vulnerability #1462 and secure the other writings of the newslettereditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/headerLetter.jspeditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/previewLetter.jspeditinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java
- infoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterUser.jspinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterAdmin.jspinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java0b6076009ffb133c105e4861267e1cda62176d781790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerabilities #1463
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The operations on the issues themselves were exposed the same way and are
secured likewise: creating and modifying an issue, and modifying the headers of
the newsletter, were requestable by a GET although their forms are submitted by
POST, the router not caring about the method.
None of the operations of this router had any role check, so any reader was able
to write the content of an issue, to modify the headers of the newsletter, to
delete issues and to read the ones being written. They are now reserved to the
publishers and to the managers, but for the ones on the template and the
deletion of several issues at once, reserved to the managers.
Reading the inlined CSS rendering of an issue is how the readers get it from the
list, so the criterion there isn't the role but the issue itself: it is refused
to them as long as it isn't published.
(cherry picked from commit e455edb9286b8b429cbb7fc1c54de6f75ead8dfd)
2026-09-28 14:43:22 +02000b6076009ffb133c105e4861267e1cda62176d78Fix vulnerabilities #1463editinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterUser.jspeditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterAdmin.jspeditinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java
- kmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationLinksManager.jspkmelia/kmelia-war/src/main/webapp/kmelia/jsp/basket.jspkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/ajax/AjaxOperation.javakmelia/kmelia-war/src/main/webapp/kmelia/jsp/orderTopics.jspkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javadbb4f8e6ae7b2f71c500e2457c9a7cb299fa12dc1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1464
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
Loading publications into the clipboard and pasting them under another topic
were requestable by a GET, so any logged user lured into a cross-site visit was
moving publications as themselves.
The AJAX servlet of kmelia answers the GET as the POST, and none of its URLs
holds any of the keywords making the synchronizer token required on a GET. So
none of its operations was protected, including the deletion of publications
which the report takes as protected: its URL does hold the delete keyword, but
the rule applied to this servlet requires in addition the path to hold /jsp/,
which the path of a servlet doesn't.
The operations only reading something are now listed apart, every other one
being taken as writing something so that adding an operation doesn't expose it
by mistake, and a writing operation requested by a GET is refused. That refusal
is performed before the processing, whose catch-all would swallow it.
The user interface already submitted by POST the operations the report points
at, as well as the deletion, the copy and the move of publications: what made
the attack possible is the servlet accepting the GET. Three operations were
still requested by a GET and are now submitted by POST: sorting the topics,
emptying the trash from the basket, and binding a publication to another one.
(cherry picked from commit 9d1faf9ba0366440299b0907b00a0ab5397f5bdd)
2026-09-28 14:43:22 +0200dbb4f8e6ae7b2f71c500e2457c9a7cb299fa12dcFix vulnerability #1464editkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javaeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/orderTopics.jspeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/basket.jspeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationLinksManager.jspeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/ajax/AjaxOperation.java
- kmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javakmelia/kmelia-war/pom.xmlkmelia/kmelia-war/src/test/java/org/silverpeas/components/kmelia/web/KmeliaResourceTest.javaf371b6452d9360af47926ebccceba45e05d252ca1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #939
(GitHub issue of Silverpeas-Components, reported against 6.4.6)
Updating a publication was granted against the component instance referred by
the URL, whereas the publication to update was entirely defined by the request
body, which carries both its identifier and its component instance. Any user
could hence rewrite the metadata of any publication of the platform by referring
it in the body, the identifiers being enumerable.
The publication is now refused when it doesn't belong to the instance the
authorization has been checked against. Note the report states a WRITER role is
required: it is not, the authorization of the REST framework only validating the
access to the instance whatever the role played in it, so the exposure was wider
than reported. Writing a publication, be it created or updated, now requires
that role indeed.
KmeliaResourceTest covers the checks. The war had no test at all, hence the
test dependency added to its POM.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 1d8ec7ee0a903b041ffac54b022319ff099b12ce)
2026-09-28 14:43:22 +0200f371b6452d9360af47926ebccceba45e05d252caFix vulnerability #939editkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditkmelia/kmelia-war/pom.xmladdkmelia/kmelia-war/src/test/java/org/silverpeas/components/kmelia/web/KmeliaResourceTest.java
- delegatednews/delegatednews-war/src/test/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResourceTest.javadelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javabb7f36a57f96d33b8bd92d826056770e3c14e04c1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comReserve the management of the delegated news to the managers
Modifying and deleting the delegated news is reserved to the managers of the
application, as its user interface applies on its side. The REST service was
granted against a mere access to the component instance, whatever the role
played in it, so any of its users was able to reorder and to delete them by
requesting it directly.
Found while auditing the other REST resources against the flaw reported by the
issue #939 of this repository.
ListDelegatedNewsResourceTest covers the check.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e4271c328772c51f400cbeab7eeb6f7fb2876721)
2026-09-28 14:43:22 +0200bb7f36a57f96d33b8bd92d826056770e3c14e04cReserve the management of the delegated news to the managersadddelegatednews/delegatednews-war/src/test/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResourceTest.javaeditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.java
- gallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javaeca5145d6d01f77adce83ef714742073585675ca1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake into account sonarcloud feedback
2026-09-28 14:43:22 +0200eca5145d6d01f77adce83ef714742073585675caTake into account sonarcloud feedbackeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.java
githttps://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse1163https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1163/Lancé par une alarme périodiqueSKIP_TESTfalseSKIP_QUALITYfalse116456f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube11643f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/master3f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/master3f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1164eca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/mastereca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/mastereca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11643371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1164ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11640c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11647b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-AssemblyAaD0l2pebQNaPUmG7crvSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=masterAaD0uxyCkj6CGoBn7yygSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Components&branch=masterbuild.yamlbuild.yamltarget/build.yamlfalse6.5-build2609302406508710550775Silverpeas_Master_AutoDeploy 6.5-build2609301164false116463961SUCCESS1790789040596https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1164/- core-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javacore-restapi/src/site/resources/index.htmlcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javacore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javacore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentListResource.javacore-web/src/main/java/org/silverpeas/core/webapi/publication/SharedPublicationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/rating/RatingResource.javacore-web/src/main/java/org/silverpeas/core/webapi/sharing/TicketResource.javacore-restapi/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javacore-web/src/main/java/org/silverpeas/core/webapi/publication/PublicationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javacore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/UserProfileResource.javacore-web/src/main/java/org/silverpeas/core/webapi/mylinks/MyLinksResource.javacore-web/src/main/java/org/silverpeas/core/webapi/security/CipherKeyResource.javacore-web/src/main/java/org/silverpeas/core/webapi/variables/VariablesResource.javacore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/RelationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/search/SearchResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentsResource.javacore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javacore-web/src/main/java/org/silverpeas/core/webapi/util/logging/LogResource.javacore-web/src/main/java/org/silverpeas/core/webapi/node/AbstractNodeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/AuthenticationResource.javacore-rs/pom.xmlcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authenticated.javacore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/UserGroupProfileResource.javacore-library/src/main/java/org/silverpeas/core/i18n/AbstractI18NBean.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/invitation/InvitationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscribeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/preferences/MyPreferencesResource.javacore-web/src/main/java/org/silverpeas/core/webapi/cache/VolatileCacheResource.javacore-web/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/FilteredPdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/selection/SelectionBasketResource.javacore-web/src/main/java/org/silverpeas/core/webapi/util/logging/SilverLoggerConfigurationResource.javapom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SharedAttachmentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/thesaurus/ThesaurusResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaPlayerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/language/LanguageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/sharing/SharingResource.javacore-web/src/main/java/org/silverpeas/core/webapi/wysiwyg/WysiwygEditorConfigResource.javacore-web/src/main/java/org/silverpeas/core/webapi/session/SilverpeasUserSessionTokenResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResourceCreator.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/AttachmentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/bundle/BundleResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/UnsubscribeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/workflow/ReplacementResource.javacore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaec9caee6b1242b8d5893ed5ece0884304d811cb01790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGenerate the documentation of the REST API with Swagger instead of Smart-Doc
Smart-Doc parses the sources with QDox and chokes on constructs Silverpeas
relies on, silently reporting a success while producing an incomplete
documentation. Swagger scans the compiled classes by reflection and understands
the JAX-RS annotations, so the whole REST API is covered.
The new core-restapi module gathers the web resources of all the modules into a
single OpenAPI 3.1 document, rendered by Redoc and published on its own at
docs/restapi/core. It produces nothing but that documentation and builds only
with the restapi profile, from which the Smart-Doc plugin is dropped.
All the 217 operations, spread over 168 paths and 86 schemas, are now
documented: a summary, a success response with its schema, and the errors the
endpoint can answer. The responses common to several endpoints are declared once
for all:
* @Authenticated and @Authorized, besides the security schemes they already
described, bring the 401 and 403 responses of the protected resources;
* the 503 is brought by CommonResponsesFilter, applied once the specification
has been figured out. It cannot come from another meta-annotation of the web
resources: at class level Swagger returns the responses of the first
meta-annotation declaring some instead of merging them all, so a second one
would silently discard the responses of @Authenticated and @Authorized;
* the recurring 404, 400 and 409 are factored out into the @NotFound,
@BadRequest and @Conflict annotations of the new annotation.doc package.
Contrary to the class level one, the method level lookup of Swagger does
merge, but the description of such an annotation takes precedence over the
one an endpoint would declare for the same status code, hence an endpoint
needing another wording must not be annotated.
Documenting the endpoints brought several defects to light, which are fixed
here: the wrong descriptions of the personal space endpoints of SpaceResource, a
test endpoint left over in CipherKeyResource, and the conflicting setters of
AbstractI18NBean for the translations property, which made the scan fail.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200ec9caee6b1242b8d5893ed5ece0884304d811cb0Generate the documentation of the REST API with Swagger instead of Smart-Doceditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaPlayerResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/RelationResource.javaeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authenticated.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/cache/VolatileCacheResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResourceCreator.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javaaddcore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javaeditpom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/UserGroupProfileResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/invitation/InvitationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/search/SearchResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/security/CipherKeyResource.javaeditcore-library/src/main/java/org/silverpeas/core/i18n/AbstractI18NBean.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/FilteredPdcResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/workflow/ReplacementResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/wysiwyg/WysiwygEditorConfigResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/session/SilverpeasUserSessionTokenResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscribeResource.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/sharing/TicketResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/rating/RatingResource.javaeditcore-web/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/mylinks/MyLinksResource.javaaddcore-restapi/src/site/resources/index.htmleditcore-web/src/main/java/org/silverpeas/core/webapi/util/logging/LogResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/UnsubscribeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/AttachmentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/thesaurus/ThesaurusResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/UserProfileResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/publication/PublicationResource.javaaddcore-restapi/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/language/LanguageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/variables/VariablesResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/selection/SelectionBasketResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/sharing/SharingResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/publication/SharedPublicationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/bundle/BundleResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentsResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/AuthenticationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SharedAttachmentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/util/logging/SilverLoggerConfigurationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentListResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/node/AbstractNodeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/preferences/MyPreferencesResource.javaeditcore-rs/pom.xml
- core-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javacore-restapi/pom.xmlc097c5d943af83fb5ce284ad45b733a9d806b7611790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comMake the schema resolver of Swagger aware of the JAXB annotations
The resolver figures the properties of a web entity out with a plain Jackson
object mapper, whereas Silverpeas serializes them with the introspector of the
JAXB annotations. The generated schemas were therefore describing properties
that never reach the wire and missing others that do:
* an entity whose access is set to XmlAccessType.FIELD was described by its
getters instead of its fields. SpaceAppearanceEntity came out with two
properties where six are serialized;
* a member annotated with @XmlTransient was described all the same.
PdcAxisValueEntity came out with eleven properties where nine are
serialized.
The JAXBAnnotationsHelper of Swagger is of no help here: it reads @XmlElement,
@XmlElementWrapper and @XmlAttribute only, and only to feed the XML metadata of
a schema, never its visibility. As for the Jackson module bringing that
introspector, it does declare itself to the ServiceLoader, but Swagger never
asks for the modules available in the classpath.
The resolver declared here sets the introspector on a mapper of its own, the
very way the JSON codec of Silverpeas does, so that it applies to the resolution
of the schemas only. Ten business objects were documented that no endpoint ever
answers -- User, UserDetail, Domain, Quota, SettingBundle, PdcPosition and the
like -- and they are gone now.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200c097c5d943af83fb5ce284ad45b733a9d806b761Make the schema resolver of Swagger aware of the JAXB annotationsaddcore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javaeditcore-restapi/pom.xml
- core-restapi/src/main/openapi/openapi.yamlcore-restapi/pom.xmlcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthenticatedAnnotationProcessor.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthorizedAnnotationProcessor.java692a545a5347eefc22d5e8f1949b6ce94151f2741790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comPublish nothing but the documentation of the REST API
The generated specification declared no info section, which OpenAPI requires. A
renderer refuses to display such a document, whatever the quality of the rest of
it, and Redoc did. Contrary to the plugin of SmallRye, the one of Swagger has no
parameter to fill that section in, hence the document of its own declared here:
the scan completes it, and Maven fills its version in.
Besides the documentation of the REST API, the module was publishing the site
Maven builds for it: the reports about the dependencies, the SCM, the javadoc of
a module that has almost no source. Those reports aren't produced any more, and
what the site brings along -- its decoration and its sitemap, of no use to the
rendering page -- is dropped once the site has been built, before it gets
published. The published tree is now made of the rendering page, the
specification in both of its formats, and the rendering engine.
Skipping the site altogether looked simpler but isn't an option: the deploy goal
of the site plugin reads the very same maven.site.skip property as its site
goal, so the documentation would have silently stopped being published.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200692a545a5347eefc22d5e8f1949b6ce94151f274Publish nothing but the documentation of the REST APIeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthorizedAnnotationProcessor.javaeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javaaddcore-restapi/src/main/openapi/openapi.yamleditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthenticatedAnnotationProcessor.javaeditcore-restapi/pom.xml
- core-restapi/pom.xml078323a23b15cb23bbbcaa797991a709645d0f7d1790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from the parent POM what doesn't depend on the project
The version of Redoc, swagger-core, the base document carrying the info section,
the output of the generated specification and the binding of the resolve goal of
Swagger, along with the execution stripping the Maven site, are now managed by
the parent POM. The module keeps what is its own: the packages to scan, the
routes of the SCIM API not to publish, its filter and its schema resolver, the
WAR whose classes are unpacked, and the URL the documentation is published at.
It also keeps the setting silencing the reports of the site plugin: that plugin
is declared by the root POM of the project, so managing the setting in the
parent would make every Maven site of Silverpeas lose its reports.
This takes effect once the parent POM is released: the project still refers to
the last released one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200078323a23b15cb23bbbcaa797991a709645d0f7dTake from the parent POM what doesn't depend on the projecteditcore-restapi/pom.xml
- core-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javacore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javacore-web/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javacore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javacore-restapi/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/BadRequest.javacore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/CommonResponsesFilter.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/JaxbAwareModelResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javacore-rs/pom.xmlb738adf1743bdd89b3f676bf5dcc7acd6ccf2d9a1790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGather in core-rs what generates the documentation of the REST API
The filter completing the responses of every endpoint and the resolver reading
the JAXB annotations of the web entities were duplicated, one copy per project
documenting its REST API, the two being identical but for their package. They
are gathered here, beside the annotations documenting the common errors, in a
package of their own: org.silverpeas.core.rs.doc.
Their name being the same for every project now, the parent POM declares them
once for all, and nothing is left to keep the copies in step.
The counterpart is that core-rs, a module of production, depends on swagger-core
to compile them. The dependency is provided, so nothing of it is shipped, and
neither the filter nor the resolver plays any role at runtime: both are read
when generating the documentation only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200b738adf1743bdd89b3f676bf5dcc7acd6ccf2d9aGather in core-rs what generates the documentation of the REST APIaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/JaxbAwareModelResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/Conflict.javadeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javaeditcore-web/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javadeletecore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/CommonResponsesFilter.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javadeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javaeditcore-restapi/pom.xmldeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/NotFound.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/BadRequest.javadeletecore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javaeditcore-rs/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.java
- core-restapi/pom.xmld41b4c150a336e2cb3019a2b3687c5a403cba3d41790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comOpt in the stripping of the Maven site
The strip-maven-site execution of the parent POM is now skipped by default: it
used to apply to every project inheriting from that POM and wiped out the Maven
site such a project publishes. This module publishes the documentation of the
REST API and nothing else, so it asks for the execution by setting
strip.maven.site.skip to false.
2026-09-28 14:12:17 +0200d41b4c150a336e2cb3019a2b3687c5a403cba3d4Opt in the stripping of the Maven siteeditcore-restapi/pom.xml
- core-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web-test/src/main/java/org/silverpeas/web/test/stub/TestHttpRequest.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.java5f5891af886c501d82d72d54f15552e3775e0ce71790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comHarden the detection of the event callbacks against the vulnerabilities #1458, #1459 and #1460
(GitHub issues, reported against 6.4.6)
The three reported stored XSS rely on an event callback attribute carried by an
element the browser fails to load on purpose. Such a declaration was detected by
the \s+on\w+\s*= pattern, which expects a whitespace before the attribute name.
According to the HTML tokenizer, an attribute name is also expected right after
the closing quote of the previous attribute value (a
missing-whitespace-between-attributes parse error, whose recovery is mandated by
the specification) and right after a solidus. So the following did declare an
onerror callback the browsers do run, while going through the filter:
<img src="x"onerror=alert(1)>
The pattern now accepts these separators as well.
Note this filter is an input guard, not an output encoding: it narrows the
reachability of the three flaws but it doesn't fix the rendering code itself.
MassiveWebSecurityFilterOnReportedXssIT covers the payloads of the three reports
on their actual endpoints and parameters, including when they are submitted as
multipart/form-data streams as the genuine forms do. It also delimits the
multipart exemption, which applies to the webPages component only.
TestHttpRequest.getContentType() returned null whatever the headers set on the
stub, which made the multipart branch untestable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 81589f6134e8e337c16a6c390b2d804e78006f8f)
2026-09-28 14:42:28 +02005f5891af886c501d82d72d54f15552e3775e0ce7Harden the detection of the event callbacks against the vulnerabilities #1458, #1459 and #1460editcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javaaddcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.javaeditcore-web-test/src/main/java/org/silverpeas/web/test/stub/TestHttpRequest.java
- core-war/src/main/webapp/defaultLoginQuestion.jsp018ed026afbb76a9ad52281cd62b8e284b9a914a1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1458
(GitHub issue, reported against 6.4.6)
The login question, which any authenticated user sets from their profile, was
printed raw by a JSP scriptlet on the password reminder page, an anonymous one.
Any script stored there was then run in the browser of every visitor of that
page, without any login required from them. The answer to that question, itself
a credential, is asked on the very same page.
The value is now HTML encoded on output, through a c:out tag. Doing so on the
rendering side rather than on the writing one closes both the ways the field is
fed: MyProfilRequestRouter, which the report points at, but also
ValidationQuestionHandler, which stores the question of the ValidateQuestion
function with no more filtering. It also neutralizes the values already stored.
The login of the hidden field below is encoded as well. It comes from a lookup
in the database and not from the request parameter, so exploiting it would
require a login holding a quote, but the encoding costs nothing here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 457be5fa780ce2656d7104f31515ea7064e2fbf6)
2026-09-28 14:42:28 +0200018ed026afbb76a9ad52281cd62b8e284b9a914aFix vulnerability #1458editcore-war/src/main/webapp/defaultLoginQuestion.jsp
- core-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javacore-services/importExport/src/main/java/org/silverpeas/core/importexport/report/HtmlExportPublicationGenerator.javacore-configuration/src/main/config/properties/org/silverpeas/util/security.propertiescore-library/src/main/java/org/silverpeas/core/contribution/content/form/displayers/WysiwygFCKFieldDisplayer.javacore-library/src/integration-test/resources/org/silverpeas/util/security.propertiescore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentRenderer.javacore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javacore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javacore-library/src/integration-test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygControllerIT.javacore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.javacore-services/importExport/src/main/java/org/silverpeas/core/importexport/control/PublicationsTypeManager.javacore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformer.javacore-library/src/integration-test/java/org/silverpeas/core/test/LibCoreWarBuilder.java37283d39cead2166ad9483d373658c2b8e414c951790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1459
(GitHub issue, reported against 6.4.6)
The WYSIWYG content of a form field was written into the response as raw HTML by
WysiwygFCKFieldDisplayer, so any script stored by the writer of a whitePages
card was run in the browser of every user viewing it. The same held for the
content of a publication, rendered by WysiwygContentRenderer, and for the two
export paths, none of which was reported.
Such a content is sanitized now, by the new SanitizeForRenderingDirective.
Unlike SanitizeDirective, which keeps only a restricted set of safe elements and
is left untouched for the contents extracted out of Silverpeas, this one keeps
the content as it is and drops only what can act on the visitor's browser:
- the elements able to run code or to take over the document, with their
content;
- the event callback attributes, whatever the element carrying them;
- the attributes referring a URL with a scripting scheme;
- the iframes and the media whose source isn't allowed.
This is deliberate: the WYSIWYG editor is set up to accept any content
(config.allowedContent = true in silverconfig.js), so an allow list applied at
rendering time would be narrower than what the users are entitled to write. It
would in particular have dropped the media produced by the video and html5audio
plugins and the rel attribute the userzoom and identitycard ones rely upon.
The parsing is delegated to the HTML tokenizer of the OWASP sanitizer, so the
content is read the way a browser reads it and the dropping can't be dodged by
playing with the HTML syntax.
The rule deciding whether the source of an iframe is allowed moves to the new
EmbeddedSourceValidator class, so that the filtering of the incoming requests
and this sanitization agree on it. It now serves the media as well, through the
new security.external.media.hosts.allowed property. That property is shipped
with the * value, which allows any host and hence preserves the behaviour of the
previous versions; setting it empty restricts the media to the ones Silverpeas
hosts itself. The inlined images are kept whatever it is, being carried by the
content itself.
The mail path is deliberately left out: its images are referred by cid URLs,
which such a sanitization drops, and its content isn't rendered in the
Silverpeas origin anyway.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 2961a40c81708375b2136cfa18f7c5f5e1d97321)
2026-09-28 14:42:28 +020037283d39cead2166ad9483d373658c2b8e414c95Fix vulnerability #1459addcore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javaeditcore-library/src/integration-test/java/org/silverpeas/core/test/LibCoreWarBuilder.javaaddcore-library/src/integration-test/resources/org/silverpeas/util/security.propertieseditcore-configuration/src/main/config/properties/org/silverpeas/util/security.propertieseditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentRenderer.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/form/displayers/WysiwygFCKFieldDisplayer.javaeditcore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javaaddcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javaeditcore-services/importExport/src/main/java/org/silverpeas/core/importexport/control/PublicationsTypeManager.javaeditcore-services/importExport/src/main/java/org/silverpeas/core/importexport/report/HtmlExportPublicationGenerator.javaeditcore-library/src/integration-test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygControllerIT.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformer.javaeditcore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.java
- core-library/src/main/java/org/silverpeas/core/util/HttpUtil.javab2900e3c4738e94ab34622ee8a48197f7921a09f1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1461
(GitHub issue, reported against 6.4.6)
Let the callers of HttpUtil complete the HTTP client.
Fixing that vulnerability requires the gallery component to request the image of
a watermark with a connection timeout and without following the redirections,
the latter being able to escape the verification of the address being requested.
httpClientBuilder() gives the builder of the HTTP client, already configured
with the proxy of Silverpeas, so that such a caller can complete the
configuration without having to duplicate that of the proxy. httpClient() now
delegates to it and is unchanged for its own callers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 16cff5ecd5e217798d51ebe7f5a97103f4d901b0)
2026-09-28 14:42:28 +0200b2900e3c4738e94ab34622ee8a48197f7921a09fFix vulnerability #1461editcore-library/src/main/java/org/silverpeas/core/util/HttpUtil.java
- core-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jscore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.java23acd94a451f35afaf18324777b344292593341b1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix the vulnerabilities CVE-2026-78738 and CVE-2026-78741
Both report a stored XSS through the name of an uploaded file, one from the
document management and the other from the image upload of the WYSIWYG editor.
They share their cause: the name is written as an HTML content by the upload
widget, whereas it is carried by the request and escaped on the sending side
only, which protects from nothing as a request can be forged.
The name is now set as a text. Note the formatted size which followed it was
already not displayed, html() taking a single argument, so the display is left
unchanged.
A scripting scheme given as the value of an attribute is detected as well by
MassiveWebSecurityFilter. Such a declaration holds no on prefix and was
therefore going through, and the colon introducing it is accepted written as
the character itself or as any of the HTML entities standing for it, as the
reported payload uses "javascript:". The data scheme is deliberately left
out: the contents do embed their inlined images with it.
(cherry picked from commit 4f92097f60d0d6e8072815cf5a77093d3f19f9e3)
2026-09-28 14:42:28 +020023acd94a451f35afaf18324777b344292593341bFix the vulnerabilities CVE-2026-78738 and CVE-2026-78741editcore-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jseditcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.java
- core-library/src/main/java/org/silverpeas/core/node/dao/NodeDAO.javacore-library/src/integration-test/resources/org/silverpeas/core/node/dao/nodes-sorting-dataset.sqlcore-library/src/integration-test/java/org/silverpeas/core/node/dao/NodeSortingIT.javacore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.java52843258f403c47fb8a0b51a75295f883fb98eda1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comSort only the nodes of the component instance being administrated
The sorting of the nodes was granted against the component instance referred by
the URL of the REST service, whereas the nodes to sort were taken from the
request body, each of them carrying the component instance it belongs to. An
administrator of any instance could hence ask to sort the nodes of another one.
The nodes are now identified within the instance of the URL, the one the
authorization has been checked against. Taking that instance from the body
brought nothing: the sorting applies by nature to the instance administrated.
That wasn't enough though. NodeDAO was updating the order of a node by its
identifier only, whereas such an identifier isn't unique by itself: the root
node of every component instance is numbered 0, and the ones below it can bear
the same numbers from an instance to another. So the instance of the node is
now part of the criteria. Beyond the authorization, this was a defect on its
own: sorting the nodes of an instance was renumbering the nodes of the other
ones bearing the same identifiers, whoever asked for that sorting.
NodeSortingIT covers the sorting of the nodes of an instance and the isolation
of the other instances from it, in both directions.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e7028e01e7261c16803ee20f841763ef5b84ab7b)
2026-09-28 14:42:28 +020052843258f403c47fb8a0b51a75295f883fb98edaSort only the nodes of the component instance being administratededitcore-library/src/main/java/org/silverpeas/core/node/dao/NodeDAO.javaaddcore-library/src/integration-test/resources/org/silverpeas/core/node/dao/nodes-sorting-dataset.sqleditcore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaaddcore-library/src/integration-test/java/org/silverpeas/core/node/dao/NodeSortingIT.java
- core-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-war/src/main/webapp/defaultLoginQuestion.jspdf92a06600aedb5b24bad01559165e839421c2b51790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake into account sonarcloud feedback
2026-09-28 14:42:28 +0200df92a06600aedb5b24bad01559165e839421c2b5Take into account sonarcloud feedbackeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-war/src/main/webapp/defaultLoginQuestion.jsp
- core-configuration/src/main/config/properties/org/silverpeas/util/security.propertiesdb15a2e30508fb101a2addaf4780cc6479eb92701790599436000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comNow the parameter security.external.media.hosts.allowed is empty.
This means all hosts out of Silverpeas will be refused in HTML media
tags (video, iframe, img, ...)
2026-09-28 14:43:56 +0200db15a2e30508fb101a2addaf4780cc6479eb9270Now the parameter security.external.media.hosts.allowed is empty.editcore-configuration/src/main/config/properties/org/silverpeas/util/security.properties
- core-library/src/main/java/org/silverpeas/core/index/indexing/parser/tika/TikaParser.javacore-library/src/main/java/org/silverpeas/core/index/indexing/model/IndexManager.javacore-library/src/main/java/org/silverpeas/core/index/indexing/parser/Parser.java3f5875d5832af01276050f9ad75a08f7ddb4dd301790608429000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comFix bug-15488
2026-09-28 17:13:49 +02003f5875d5832af01276050f9ad75a08f7ddb4dd30Fix bug-15488editcore-library/src/main/java/org/silverpeas/core/index/indexing/parser/tika/TikaParser.javaeditcore-library/src/main/java/org/silverpeas/core/index/indexing/model/IndexManager.javaeditcore-library/src/main/java/org/silverpeas/core/index/indexing/parser/Parser.java
git- suggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/TickerResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javagallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javaquickinfo/quickinfo-library/src/main/java/org/silverpeas/components/quickinfo/NewsSort.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javagallery/gallery-library/src/main/java/org/silverpeas/components/gallery/constant/MediaResolution.javapom.xmldelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javarssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javacomponents-restapi/src/site/resources/index.htmlkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/AbstractNewsResource.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/FolderResource.javaquickinfo/quickinfo-library/src/integration-test/java/org/silverpeas/components/quickinfo/repository/NewsRepositoryIT.javacomponents-restapi/pom.xmlf2fe8d93d99b4eb77e672c047d22ce154ba946731790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGenerate the documentation of the REST API with Swagger instead of Smart-Doc
The new components-restapi module gathers the web resources of the fourteen
applications into a single OpenAPI 3.1 document, rendered by Redoc and published
on its own at docs/restapi/components. It produces nothing but that
documentation and builds only with the restapi profile, from which the Smart-Doc
plugin is dropped.
All the 81 operations, spread over 70 paths and 81 schemas, are now documented.
The twenty-two operations of the almanach are inherited from the calendar
resources of Core and needed nothing: Swagger reads the annotations of the
overridden methods. The others got a summary, a success response with its
schema, and the errors they can answer, the recurring ones coming from the
@NotFound and @Conflict annotations of Core. The 503 common to every endpoint is
brought by CommonResponsesFilter, of which this project has its own copy.
Documenting the endpoints brought several defects to light, which are fixed
here:
* three of the four folder endpoints of Kmelia were invisible in the
documentation. Swagger strips the regular expression of a path template, so
{path: \d+(/\d+)*/children} was reduced to {path} and collided with the
three other ones. The literal suffix now sits outside the template, which
matches the very same URIs;
* NewsResource caught back the WebApplicationException it had just thrown and
turned it into a 503, so neither the 404 of an unknown news nor the refusal
to delete one ever reached the requester. That refusal answers a 403 now,
instead of a 401 without any challenge;
* MediaResolution read the settings of the application from its enum
constants, making the scan fail with an ExceptionInInitializerError. The
watermark size is read lazily now;
* five classes of Quickinfo were missing the licence header.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200f2fe8d93d99b4eb77e672c047d22ce154ba94673Generate the documentation of the REST API with Swagger instead of Smart-Docaddcomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javaeditrssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaeditgallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javaeditresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javaeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javaeditsuggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditpom.xmleditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javaeditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javaeditquickinfo/quickinfo-library/src/main/java/org/silverpeas/components/quickinfo/NewsSort.javaaddcomponents-restapi/pom.xmleditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/AbstractNewsResource.javaaddcomponents-restapi/src/site/resources/index.htmleditquickinfo/quickinfo-library/src/integration-test/java/org/silverpeas/components/quickinfo/repository/NewsRepositoryIT.javaeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/constant/MediaResolution.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/TickerResource.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/FolderResource.java
- components-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javacomponents-restapi/pom.xml59908ef73f929070700744af9c79e30cf0066fff1790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comMake the schema resolver of Swagger aware of the JAXB annotations
The resolver figures the properties of a web entity out with a plain Jackson
object mapper, whereas Silverpeas serializes them with the introspector of the
JAXB annotations. The generated schemas were therefore describing properties
that never reach the wire, those excluded by @XmlTransient or by an access set
to XmlAccessType.FIELD, and missing the fields that do reach it.
Same resolver as the one of Core, of which this project has its own copy, for
the very reason its filter completing the responses has one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +020059908ef73f929070700744af9c79e30cf0066fffMake the schema resolver of Swagger aware of the JAXB annotationseditcomponents-restapi/pom.xmladdcomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.java
- components-restapi/src/main/openapi/openapi.yamlcomponents-restapi/pom.xmlae522b0fb3a88fbb36407023c62f0c096c2a3ab31790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comPublish nothing but the documentation of the REST API
The generated specification declared no info section, which OpenAPI requires. A
renderer refuses to display such a document, whatever the quality of the rest of
it. Contrary to the plugin of SmallRye, the one of Swagger has no parameter to
fill that section in, hence the document of its own declared here: the scan
completes it, and Maven fills its version in.
Besides the documentation of the REST API, the module was publishing the site
Maven builds for it: the reports about the dependencies, the SCM, the javadoc of
a module that has almost no source. Those reports aren't produced any more, and
what the site brings along -- its decoration and its sitemap, of no use to the
rendering page -- is dropped once the site has been built, before it gets
published.
Same setting as the one of Core, of which this project has its own copy, for the
very reason its filter completing the responses has one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200ae522b0fb3a88fbb36407023c62f0c096c2a3ab3Publish nothing but the documentation of the REST APIaddcomponents-restapi/src/main/openapi/openapi.yamleditcomponents-restapi/pom.xml
- components-restapi/pom.xml01111927bc2afba8b8a88f23247f97c2e70eab181790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from the parent POM what doesn't depend on the project
The version of Redoc, swagger-core, the base document carrying the info section,
the output of the generated specification and the binding of the resolve goal of
Swagger, along with the execution stripping the Maven site, are now managed by
the parent POM. The module keeps what is its own: the packages to scan, its
filter and its schema resolver, the fourteen WAR whose classes are unpacked, and
the URL the documentation is published at.
It also keeps the setting silencing the reports of the site plugin: that plugin
is declared by the root POM of the project, so managing the setting in the
parent would make every Maven site of Silverpeas lose its reports.
This takes effect once the parent POM is released: the project still refers to
the last released one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +020001111927bc2afba8b8a88f23247f97c2e70eab18Take from the parent POM what doesn't depend on the projecteditcomponents-restapi/pom.xml
- suggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javagallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javapom.xmldelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javarssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javacomponents-restapi/pom.xml021fe614496d0adf069aaade785f13438a7998ca1790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from core-rs what generates the documentation of the REST API
The filter completing the responses of every endpoint and the resolver reading
the JAXB annotations of the web entities were copied here from Silverpeas Core,
where they now sit in a package of their own, org.silverpeas.core.rs.doc,
alongside the annotations documenting the common errors. The copies are dropped
and the parent POM declares the classes of core-rs instead.
The annotations documenting the common errors follow them: the endpoints of the
applications refer them at their new place.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200021fe614496d0adf069aaade785f13438a7998caTake from core-rs what generates the documentation of the REST APIeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaeditresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javaeditrssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javaeditpom.xmleditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javaeditcomponents-restapi/pom.xmldeletecomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javaeditsuggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javadeletecomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javaeditgallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.java
- components-restapi/pom.xml9d3490bf7cd64723cdac38d15472d03679bb89501790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comOpt in the stripping of the Maven site
The strip-maven-site execution of the parent POM is now skipped by default: it
used to apply to every project inheriting from that POM and wiped out the Maven
site such a project publishes. This module publishes the documentation of the
REST API and nothing else, so it asks for the execution by setting
strip.maven.site.skip to false.
2026-09-28 14:12:34 +02009d3490bf7cd64723cdac38d15472d03679bb8950Opt in the stripping of the Maven siteeditcomponents-restapi/pom.xml
- forums/forums-war/src/main/webapp/forums/jsp/modifyMessage.jspforums/forums-war/src/main/webapp/forums/jsp/viewMessage.jspforums/forums-war/src/main/webapp/forums/jsp/editMessageKeywords.jsp3b4d732f0a1b27af91286d6a8bf01e77d8d3bde21790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1460
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The title and the body of a forum message were printed raw by JSP scriptlets on
the thread page, so any script posted by a user of the forum was run in the
browser of every user reading it.
The title is now HTML encoded on output, as the other JSPs of the component
already do through WebEncodeHelper. Two other raw outputs of the title, which
the report doesn't mention, are encoded as well: the one of modifyMessage.jsp,
where the title lands in the value attribute of an input and is hence
exploitable by escaping that attribute, and the one of editMessageKeywords.jsp.
The body is sanitized by the applySanitizeForRenderingDirective directive
introduced in Silverpeas-Core for the vulnerability #1459, which drops what can
act on the visitor's browser while keeping the content as it is.
Note the report also states the title pollutes the title element of the page.
It does appear there, but viewMessage.jsp already prints it through a c:out tag,
so it is encoded and isn't a vector.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit ea479b045468c5015e93e8b6c0924b919f8e4f32)
2026-09-28 14:43:22 +02003b4d732f0a1b27af91286d6a8bf01e77d8d3bde2Fix vulnerability #1460editforums/forums-war/src/main/webapp/forums/jsp/viewMessage.jspeditforums/forums-war/src/main/webapp/forums/jsp/editMessageKeywords.jspeditforums/forums-war/src/main/webapp/forums/jsp/modifyMessage.jsp
- gallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javagallery/gallery-library/src/test/java/org/silverpeas/components/gallery/WatermarkTest.javab0d04438a605a666ee748f7c6ca310fef0ff6a4a1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1461
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The image of a watermark is an instance parameter any manager of the space
holding the gallery can set, and the server requests it as it is, at each media
creation. It could hence be pointed at a service the server keeps for itself.
Such an URL is now verified before being requested: only the HTTP and HTTPS
schemes are handled, and the host must resolve to neither a loopback nor a
link-local address, so that neither the services bound to the server itself nor
the metadata endpoint of a cloud provider can be reached. Every address the host
resolves to is verified, otherwise a host resolving to a forbidden address
beside an allowed one would go through.
The addresses of the private networks of an organization remain reachable on
purpose: they are where the internal resources of an intranet legitimately live,
and no address range can tell them from the internal services one would rather
protect. Only an explicit list of allowed hosts could, which is left to a
further decision.
The request is besides given a timeout and its response is no longer copied
without any bound, both being able to exhaust the resources of the server, and
the redirections are no longer followed as they would escape the verification
above.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 83864c0f72b6c5f62a1afdf2cb420f8b62840f20)
2026-09-28 14:43:22 +0200b0d04438a605a666ee748f7c6ca310fef0ff6a4aFix vulnerability #1461addgallery/gallery-library/src/test/java/org/silverpeas/components/gallery/WatermarkTest.javaeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.java
- infoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/previewLetter.jspinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/headerLetter.jspinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java03b14dd2f030f634a99944c3272b31500811242f1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1462 and secure the other writings of the newsletter
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
Publishing an issue of a newsletter changes its state, stamps its publication
date, notifies the subscribers and mails the external ones. It was requested by
a GET, and the synchronizer token is required on a GET only when its URL holds
one of a few keywords, which ValidateParution holds none of. Any logged user
lured into a cross-site visit was hence publishing the issue as themselves.
The publication is now submitted by POST, on which the token is required
whatever the URL, through the formRequest facility which stamps it.
Moreover the endpoint had no role check at all, so any reader of the newsletter
was able to publish an issue and to trigger the mailing, with no luring needed.
Only its publishers and its managers can do so now.
Three other writings, which the report doesn't mention, were exposed the same
way and are secured likewise:
- resetting the content of an issue with its template, which overwrites the
content being written;
- mailing an issue to oneself and to the managers, which sends the content of an
issue not published yet and was hence a way for any reader to get a draft.
As EditContent also serves the edition itself, a mere navigation which remains a
GET, the reset is explicitly refused when it isn't requested by POST: submitting
it by POST would otherwise protect nothing, the previous URL remaining
requestable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 4bd5e04d16207d889d2b271eed87fa1962fa8ab5)
2026-09-28 14:43:22 +020003b14dd2f030f634a99944c3272b31500811242fFix vulnerability #1462 and secure the other writings of the newslettereditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/headerLetter.jspeditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/previewLetter.jspeditinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java
- infoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterUser.jspinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterAdmin.jspinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java0b6076009ffb133c105e4861267e1cda62176d781790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerabilities #1463
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The operations on the issues themselves were exposed the same way and are
secured likewise: creating and modifying an issue, and modifying the headers of
the newsletter, were requestable by a GET although their forms are submitted by
POST, the router not caring about the method.
None of the operations of this router had any role check, so any reader was able
to write the content of an issue, to modify the headers of the newsletter, to
delete issues and to read the ones being written. They are now reserved to the
publishers and to the managers, but for the ones on the template and the
deletion of several issues at once, reserved to the managers.
Reading the inlined CSS rendering of an issue is how the readers get it from the
list, so the criterion there isn't the role but the issue itself: it is refused
to them as long as it isn't published.
(cherry picked from commit e455edb9286b8b429cbb7fc1c54de6f75ead8dfd)
2026-09-28 14:43:22 +02000b6076009ffb133c105e4861267e1cda62176d78Fix vulnerabilities #1463editinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterUser.jspeditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterAdmin.jspeditinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java
- kmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationLinksManager.jspkmelia/kmelia-war/src/main/webapp/kmelia/jsp/basket.jspkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/ajax/AjaxOperation.javakmelia/kmelia-war/src/main/webapp/kmelia/jsp/orderTopics.jspkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javadbb4f8e6ae7b2f71c500e2457c9a7cb299fa12dc1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1464
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
Loading publications into the clipboard and pasting them under another topic
were requestable by a GET, so any logged user lured into a cross-site visit was
moving publications as themselves.
The AJAX servlet of kmelia answers the GET as the POST, and none of its URLs
holds any of the keywords making the synchronizer token required on a GET. So
none of its operations was protected, including the deletion of publications
which the report takes as protected: its URL does hold the delete keyword, but
the rule applied to this servlet requires in addition the path to hold /jsp/,
which the path of a servlet doesn't.
The operations only reading something are now listed apart, every other one
being taken as writing something so that adding an operation doesn't expose it
by mistake, and a writing operation requested by a GET is refused. That refusal
is performed before the processing, whose catch-all would swallow it.
The user interface already submitted by POST the operations the report points
at, as well as the deletion, the copy and the move of publications: what made
the attack possible is the servlet accepting the GET. Three operations were
still requested by a GET and are now submitted by POST: sorting the topics,
emptying the trash from the basket, and binding a publication to another one.
(cherry picked from commit 9d1faf9ba0366440299b0907b00a0ab5397f5bdd)
2026-09-28 14:43:22 +0200dbb4f8e6ae7b2f71c500e2457c9a7cb299fa12dcFix vulnerability #1464editkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javaeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/orderTopics.jspeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/basket.jspeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationLinksManager.jspeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/ajax/AjaxOperation.java
- kmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javakmelia/kmelia-war/pom.xmlkmelia/kmelia-war/src/test/java/org/silverpeas/components/kmelia/web/KmeliaResourceTest.javaf371b6452d9360af47926ebccceba45e05d252ca1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #939
(GitHub issue of Silverpeas-Components, reported against 6.4.6)
Updating a publication was granted against the component instance referred by
the URL, whereas the publication to update was entirely defined by the request
body, which carries both its identifier and its component instance. Any user
could hence rewrite the metadata of any publication of the platform by referring
it in the body, the identifiers being enumerable.
The publication is now refused when it doesn't belong to the instance the
authorization has been checked against. Note the report states a WRITER role is
required: it is not, the authorization of the REST framework only validating the
access to the instance whatever the role played in it, so the exposure was wider
than reported. Writing a publication, be it created or updated, now requires
that role indeed.
KmeliaResourceTest covers the checks. The war had no test at all, hence the
test dependency added to its POM.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 1d8ec7ee0a903b041ffac54b022319ff099b12ce)
2026-09-28 14:43:22 +0200f371b6452d9360af47926ebccceba45e05d252caFix vulnerability #939editkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditkmelia/kmelia-war/pom.xmladdkmelia/kmelia-war/src/test/java/org/silverpeas/components/kmelia/web/KmeliaResourceTest.java
- delegatednews/delegatednews-war/src/test/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResourceTest.javadelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javabb7f36a57f96d33b8bd92d826056770e3c14e04c1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comReserve the management of the delegated news to the managers
Modifying and deleting the delegated news is reserved to the managers of the
application, as its user interface applies on its side. The REST service was
granted against a mere access to the component instance, whatever the role
played in it, so any of its users was able to reorder and to delete them by
requesting it directly.
Found while auditing the other REST resources against the flaw reported by the
issue #939 of this repository.
ListDelegatedNewsResourceTest covers the check.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e4271c328772c51f400cbeab7eeb6f7fb2876721)
2026-09-28 14:43:22 +0200bb7f36a57f96d33b8bd92d826056770e3c14e04cReserve the management of the delegated news to the managersadddelegatednews/delegatednews-war/src/test/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResourceTest.javaeditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.java
- gallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javaeca5145d6d01f77adce83ef714742073585675ca1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake into account sonarcloud feedback
2026-09-28 14:43:22 +0200eca5145d6d01f77adce83ef714742073585675caTake into account sonarcloud feedbackeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.java
githttps://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse1163https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1163/SKIP_TESTfalseSKIP_QUALITYfalseDémarré par l'utilisateur Miguel MoquillonmmoquillonMiguel Moquillon116256f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube1162969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/master969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/master969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1162d68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11623371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1162ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11620c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11627b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Assemblyfalse#1162313550010550775Silverpeas_Master_AutoDeploy #11621162false116263310FAILURE1790584035065https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1162/https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse1163https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1163/1161https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1161/Lancé par une alarme périodiqueSKIP_TESTfalseSKIP_QUALITYfalse116456f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube11643f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/master3f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/master3f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1164eca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/mastereca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/mastereca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11643371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1164ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11640c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11647b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-AssemblyAaD0l2pebQNaPUmG7crvSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=masterAaD0uxyCkj6CGoBn7yygSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Components&branch=masterbuild.yamlbuild.yamltarget/build.yamlfalse6.5-build2609302406508710550775Silverpeas_Master_AutoDeploy 6.5-build2609301164false116463961SUCCESS1790789040596https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1164/- core-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javacore-restapi/src/site/resources/index.htmlcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javacore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javacore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentListResource.javacore-web/src/main/java/org/silverpeas/core/webapi/publication/SharedPublicationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/rating/RatingResource.javacore-web/src/main/java/org/silverpeas/core/webapi/sharing/TicketResource.javacore-restapi/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javacore-web/src/main/java/org/silverpeas/core/webapi/publication/PublicationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javacore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/UserProfileResource.javacore-web/src/main/java/org/silverpeas/core/webapi/mylinks/MyLinksResource.javacore-web/src/main/java/org/silverpeas/core/webapi/security/CipherKeyResource.javacore-web/src/main/java/org/silverpeas/core/webapi/variables/VariablesResource.javacore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/RelationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/search/SearchResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentsResource.javacore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javacore-web/src/main/java/org/silverpeas/core/webapi/util/logging/LogResource.javacore-web/src/main/java/org/silverpeas/core/webapi/node/AbstractNodeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/AuthenticationResource.javacore-rs/pom.xmlcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authenticated.javacore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/UserGroupProfileResource.javacore-library/src/main/java/org/silverpeas/core/i18n/AbstractI18NBean.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/invitation/InvitationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscribeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/preferences/MyPreferencesResource.javacore-web/src/main/java/org/silverpeas/core/webapi/cache/VolatileCacheResource.javacore-web/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/FilteredPdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/selection/SelectionBasketResource.javacore-web/src/main/java/org/silverpeas/core/webapi/util/logging/SilverLoggerConfigurationResource.javapom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SharedAttachmentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/thesaurus/ThesaurusResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaPlayerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/language/LanguageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/sharing/SharingResource.javacore-web/src/main/java/org/silverpeas/core/webapi/wysiwyg/WysiwygEditorConfigResource.javacore-web/src/main/java/org/silverpeas/core/webapi/session/SilverpeasUserSessionTokenResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResourceCreator.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/AttachmentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/bundle/BundleResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/UnsubscribeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/workflow/ReplacementResource.javacore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaec9caee6b1242b8d5893ed5ece0884304d811cb01790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGenerate the documentation of the REST API with Swagger instead of Smart-Doc
Smart-Doc parses the sources with QDox and chokes on constructs Silverpeas
relies on, silently reporting a success while producing an incomplete
documentation. Swagger scans the compiled classes by reflection and understands
the JAX-RS annotations, so the whole REST API is covered.
The new core-restapi module gathers the web resources of all the modules into a
single OpenAPI 3.1 document, rendered by Redoc and published on its own at
docs/restapi/core. It produces nothing but that documentation and builds only
with the restapi profile, from which the Smart-Doc plugin is dropped.
All the 217 operations, spread over 168 paths and 86 schemas, are now
documented: a summary, a success response with its schema, and the errors the
endpoint can answer. The responses common to several endpoints are declared once
for all:
* @Authenticated and @Authorized, besides the security schemes they already
described, bring the 401 and 403 responses of the protected resources;
* the 503 is brought by CommonResponsesFilter, applied once the specification
has been figured out. It cannot come from another meta-annotation of the web
resources: at class level Swagger returns the responses of the first
meta-annotation declaring some instead of merging them all, so a second one
would silently discard the responses of @Authenticated and @Authorized;
* the recurring 404, 400 and 409 are factored out into the @NotFound,
@BadRequest and @Conflict annotations of the new annotation.doc package.
Contrary to the class level one, the method level lookup of Swagger does
merge, but the description of such an annotation takes precedence over the
one an endpoint would declare for the same status code, hence an endpoint
needing another wording must not be annotated.
Documenting the endpoints brought several defects to light, which are fixed
here: the wrong descriptions of the personal space endpoints of SpaceResource, a
test endpoint left over in CipherKeyResource, and the conflicting setters of
AbstractI18NBean for the translations property, which made the scan fail.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200ec9caee6b1242b8d5893ed5ece0884304d811cb0Generate the documentation of the REST API with Swagger instead of Smart-Doceditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaPlayerResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/RelationResource.javaeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authenticated.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/cache/VolatileCacheResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResourceCreator.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javaaddcore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javaeditpom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/UserGroupProfileResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/invitation/InvitationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/search/SearchResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/security/CipherKeyResource.javaeditcore-library/src/main/java/org/silverpeas/core/i18n/AbstractI18NBean.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/FilteredPdcResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/workflow/ReplacementResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/wysiwyg/WysiwygEditorConfigResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/session/SilverpeasUserSessionTokenResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscribeResource.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/sharing/TicketResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/rating/RatingResource.javaeditcore-web/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/mylinks/MyLinksResource.javaaddcore-restapi/src/site/resources/index.htmleditcore-web/src/main/java/org/silverpeas/core/webapi/util/logging/LogResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/UnsubscribeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/AttachmentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/thesaurus/ThesaurusResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/UserProfileResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/publication/PublicationResource.javaaddcore-restapi/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/language/LanguageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/variables/VariablesResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/selection/SelectionBasketResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/sharing/SharingResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/publication/SharedPublicationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/bundle/BundleResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentsResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/AuthenticationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SharedAttachmentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/util/logging/SilverLoggerConfigurationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentListResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/node/AbstractNodeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/preferences/MyPreferencesResource.javaeditcore-rs/pom.xml
- core-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javacore-restapi/pom.xmlc097c5d943af83fb5ce284ad45b733a9d806b7611790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comMake the schema resolver of Swagger aware of the JAXB annotations
The resolver figures the properties of a web entity out with a plain Jackson
object mapper, whereas Silverpeas serializes them with the introspector of the
JAXB annotations. The generated schemas were therefore describing properties
that never reach the wire and missing others that do:
* an entity whose access is set to XmlAccessType.FIELD was described by its
getters instead of its fields. SpaceAppearanceEntity came out with two
properties where six are serialized;
* a member annotated with @XmlTransient was described all the same.
PdcAxisValueEntity came out with eleven properties where nine are
serialized.
The JAXBAnnotationsHelper of Swagger is of no help here: it reads @XmlElement,
@XmlElementWrapper and @XmlAttribute only, and only to feed the XML metadata of
a schema, never its visibility. As for the Jackson module bringing that
introspector, it does declare itself to the ServiceLoader, but Swagger never
asks for the modules available in the classpath.
The resolver declared here sets the introspector on a mapper of its own, the
very way the JSON codec of Silverpeas does, so that it applies to the resolution
of the schemas only. Ten business objects were documented that no endpoint ever
answers -- User, UserDetail, Domain, Quota, SettingBundle, PdcPosition and the
like -- and they are gone now.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200c097c5d943af83fb5ce284ad45b733a9d806b761Make the schema resolver of Swagger aware of the JAXB annotationsaddcore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javaeditcore-restapi/pom.xml
- core-restapi/src/main/openapi/openapi.yamlcore-restapi/pom.xmlcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthenticatedAnnotationProcessor.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthorizedAnnotationProcessor.java692a545a5347eefc22d5e8f1949b6ce94151f2741790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comPublish nothing but the documentation of the REST API
The generated specification declared no info section, which OpenAPI requires. A
renderer refuses to display such a document, whatever the quality of the rest of
it, and Redoc did. Contrary to the plugin of SmallRye, the one of Swagger has no
parameter to fill that section in, hence the document of its own declared here:
the scan completes it, and Maven fills its version in.
Besides the documentation of the REST API, the module was publishing the site
Maven builds for it: the reports about the dependencies, the SCM, the javadoc of
a module that has almost no source. Those reports aren't produced any more, and
what the site brings along -- its decoration and its sitemap, of no use to the
rendering page -- is dropped once the site has been built, before it gets
published. The published tree is now made of the rendering page, the
specification in both of its formats, and the rendering engine.
Skipping the site altogether looked simpler but isn't an option: the deploy goal
of the site plugin reads the very same maven.site.skip property as its site
goal, so the documentation would have silently stopped being published.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200692a545a5347eefc22d5e8f1949b6ce94151f274Publish nothing but the documentation of the REST APIeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthorizedAnnotationProcessor.javaeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javaaddcore-restapi/src/main/openapi/openapi.yamleditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthenticatedAnnotationProcessor.javaeditcore-restapi/pom.xml
- core-restapi/pom.xml078323a23b15cb23bbbcaa797991a709645d0f7d1790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from the parent POM what doesn't depend on the project
The version of Redoc, swagger-core, the base document carrying the info section,
the output of the generated specification and the binding of the resolve goal of
Swagger, along with the execution stripping the Maven site, are now managed by
the parent POM. The module keeps what is its own: the packages to scan, the
routes of the SCIM API not to publish, its filter and its schema resolver, the
WAR whose classes are unpacked, and the URL the documentation is published at.
It also keeps the setting silencing the reports of the site plugin: that plugin
is declared by the root POM of the project, so managing the setting in the
parent would make every Maven site of Silverpeas lose its reports.
This takes effect once the parent POM is released: the project still refers to
the last released one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200078323a23b15cb23bbbcaa797991a709645d0f7dTake from the parent POM what doesn't depend on the projecteditcore-restapi/pom.xml
- core-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javacore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javacore-web/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javacore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javacore-restapi/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/BadRequest.javacore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/CommonResponsesFilter.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/JaxbAwareModelResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javacore-rs/pom.xmlb738adf1743bdd89b3f676bf5dcc7acd6ccf2d9a1790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGather in core-rs what generates the documentation of the REST API
The filter completing the responses of every endpoint and the resolver reading
the JAXB annotations of the web entities were duplicated, one copy per project
documenting its REST API, the two being identical but for their package. They
are gathered here, beside the annotations documenting the common errors, in a
package of their own: org.silverpeas.core.rs.doc.
Their name being the same for every project now, the parent POM declares them
once for all, and nothing is left to keep the copies in step.
The counterpart is that core-rs, a module of production, depends on swagger-core
to compile them. The dependency is provided, so nothing of it is shipped, and
neither the filter nor the resolver plays any role at runtime: both are read
when generating the documentation only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200b738adf1743bdd89b3f676bf5dcc7acd6ccf2d9aGather in core-rs what generates the documentation of the REST APIaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/JaxbAwareModelResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/Conflict.javadeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javaeditcore-web/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javadeletecore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/CommonResponsesFilter.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javadeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javaeditcore-restapi/pom.xmldeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/NotFound.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/BadRequest.javadeletecore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javaeditcore-rs/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.java
- core-restapi/pom.xmld41b4c150a336e2cb3019a2b3687c5a403cba3d41790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comOpt in the stripping of the Maven site
The strip-maven-site execution of the parent POM is now skipped by default: it
used to apply to every project inheriting from that POM and wiped out the Maven
site such a project publishes. This module publishes the documentation of the
REST API and nothing else, so it asks for the execution by setting
strip.maven.site.skip to false.
2026-09-28 14:12:17 +0200d41b4c150a336e2cb3019a2b3687c5a403cba3d4Opt in the stripping of the Maven siteeditcore-restapi/pom.xml
- core-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web-test/src/main/java/org/silverpeas/web/test/stub/TestHttpRequest.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.java5f5891af886c501d82d72d54f15552e3775e0ce71790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comHarden the detection of the event callbacks against the vulnerabilities #1458, #1459 and #1460
(GitHub issues, reported against 6.4.6)
The three reported stored XSS rely on an event callback attribute carried by an
element the browser fails to load on purpose. Such a declaration was detected by
the \s+on\w+\s*= pattern, which expects a whitespace before the attribute name.
According to the HTML tokenizer, an attribute name is also expected right after
the closing quote of the previous attribute value (a
missing-whitespace-between-attributes parse error, whose recovery is mandated by
the specification) and right after a solidus. So the following did declare an
onerror callback the browsers do run, while going through the filter:
<img src="x"onerror=alert(1)>
The pattern now accepts these separators as well.
Note this filter is an input guard, not an output encoding: it narrows the
reachability of the three flaws but it doesn't fix the rendering code itself.
MassiveWebSecurityFilterOnReportedXssIT covers the payloads of the three reports
on their actual endpoints and parameters, including when they are submitted as
multipart/form-data streams as the genuine forms do. It also delimits the
multipart exemption, which applies to the webPages component only.
TestHttpRequest.getContentType() returned null whatever the headers set on the
stub, which made the multipart branch untestable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 81589f6134e8e337c16a6c390b2d804e78006f8f)
2026-09-28 14:42:28 +02005f5891af886c501d82d72d54f15552e3775e0ce7Harden the detection of the event callbacks against the vulnerabilities #1458, #1459 and #1460editcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javaaddcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.javaeditcore-web-test/src/main/java/org/silverpeas/web/test/stub/TestHttpRequest.java
- core-war/src/main/webapp/defaultLoginQuestion.jsp018ed026afbb76a9ad52281cd62b8e284b9a914a1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1458
(GitHub issue, reported against 6.4.6)
The login question, which any authenticated user sets from their profile, was
printed raw by a JSP scriptlet on the password reminder page, an anonymous one.
Any script stored there was then run in the browser of every visitor of that
page, without any login required from them. The answer to that question, itself
a credential, is asked on the very same page.
The value is now HTML encoded on output, through a c:out tag. Doing so on the
rendering side rather than on the writing one closes both the ways the field is
fed: MyProfilRequestRouter, which the report points at, but also
ValidationQuestionHandler, which stores the question of the ValidateQuestion
function with no more filtering. It also neutralizes the values already stored.
The login of the hidden field below is encoded as well. It comes from a lookup
in the database and not from the request parameter, so exploiting it would
require a login holding a quote, but the encoding costs nothing here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 457be5fa780ce2656d7104f31515ea7064e2fbf6)
2026-09-28 14:42:28 +0200018ed026afbb76a9ad52281cd62b8e284b9a914aFix vulnerability #1458editcore-war/src/main/webapp/defaultLoginQuestion.jsp
- core-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javacore-services/importExport/src/main/java/org/silverpeas/core/importexport/report/HtmlExportPublicationGenerator.javacore-configuration/src/main/config/properties/org/silverpeas/util/security.propertiescore-library/src/main/java/org/silverpeas/core/contribution/content/form/displayers/WysiwygFCKFieldDisplayer.javacore-library/src/integration-test/resources/org/silverpeas/util/security.propertiescore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentRenderer.javacore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javacore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javacore-library/src/integration-test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygControllerIT.javacore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.javacore-services/importExport/src/main/java/org/silverpeas/core/importexport/control/PublicationsTypeManager.javacore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformer.javacore-library/src/integration-test/java/org/silverpeas/core/test/LibCoreWarBuilder.java37283d39cead2166ad9483d373658c2b8e414c951790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1459
(GitHub issue, reported against 6.4.6)
The WYSIWYG content of a form field was written into the response as raw HTML by
WysiwygFCKFieldDisplayer, so any script stored by the writer of a whitePages
card was run in the browser of every user viewing it. The same held for the
content of a publication, rendered by WysiwygContentRenderer, and for the two
export paths, none of which was reported.
Such a content is sanitized now, by the new SanitizeForRenderingDirective.
Unlike SanitizeDirective, which keeps only a restricted set of safe elements and
is left untouched for the contents extracted out of Silverpeas, this one keeps
the content as it is and drops only what can act on the visitor's browser:
- the elements able to run code or to take over the document, with their
content;
- the event callback attributes, whatever the element carrying them;
- the attributes referring a URL with a scripting scheme;
- the iframes and the media whose source isn't allowed.
This is deliberate: the WYSIWYG editor is set up to accept any content
(config.allowedContent = true in silverconfig.js), so an allow list applied at
rendering time would be narrower than what the users are entitled to write. It
would in particular have dropped the media produced by the video and html5audio
plugins and the rel attribute the userzoom and identitycard ones rely upon.
The parsing is delegated to the HTML tokenizer of the OWASP sanitizer, so the
content is read the way a browser reads it and the dropping can't be dodged by
playing with the HTML syntax.
The rule deciding whether the source of an iframe is allowed moves to the new
EmbeddedSourceValidator class, so that the filtering of the incoming requests
and this sanitization agree on it. It now serves the media as well, through the
new security.external.media.hosts.allowed property. That property is shipped
with the * value, which allows any host and hence preserves the behaviour of the
previous versions; setting it empty restricts the media to the ones Silverpeas
hosts itself. The inlined images are kept whatever it is, being carried by the
content itself.
The mail path is deliberately left out: its images are referred by cid URLs,
which such a sanitization drops, and its content isn't rendered in the
Silverpeas origin anyway.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 2961a40c81708375b2136cfa18f7c5f5e1d97321)
2026-09-28 14:42:28 +020037283d39cead2166ad9483d373658c2b8e414c95Fix vulnerability #1459addcore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javaeditcore-library/src/integration-test/java/org/silverpeas/core/test/LibCoreWarBuilder.javaaddcore-library/src/integration-test/resources/org/silverpeas/util/security.propertieseditcore-configuration/src/main/config/properties/org/silverpeas/util/security.propertieseditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentRenderer.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/form/displayers/WysiwygFCKFieldDisplayer.javaeditcore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javaaddcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javaeditcore-services/importExport/src/main/java/org/silverpeas/core/importexport/control/PublicationsTypeManager.javaeditcore-services/importExport/src/main/java/org/silverpeas/core/importexport/report/HtmlExportPublicationGenerator.javaeditcore-library/src/integration-test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygControllerIT.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformer.javaeditcore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.java
- core-library/src/main/java/org/silverpeas/core/util/HttpUtil.javab2900e3c4738e94ab34622ee8a48197f7921a09f1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1461
(GitHub issue, reported against 6.4.6)
Let the callers of HttpUtil complete the HTTP client.
Fixing that vulnerability requires the gallery component to request the image of
a watermark with a connection timeout and without following the redirections,
the latter being able to escape the verification of the address being requested.
httpClientBuilder() gives the builder of the HTTP client, already configured
with the proxy of Silverpeas, so that such a caller can complete the
configuration without having to duplicate that of the proxy. httpClient() now
delegates to it and is unchanged for its own callers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 16cff5ecd5e217798d51ebe7f5a97103f4d901b0)
2026-09-28 14:42:28 +0200b2900e3c4738e94ab34622ee8a48197f7921a09fFix vulnerability #1461editcore-library/src/main/java/org/silverpeas/core/util/HttpUtil.java
- core-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jscore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.java23acd94a451f35afaf18324777b344292593341b1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix the vulnerabilities CVE-2026-78738 and CVE-2026-78741
Both report a stored XSS through the name of an uploaded file, one from the
document management and the other from the image upload of the WYSIWYG editor.
They share their cause: the name is written as an HTML content by the upload
widget, whereas it is carried by the request and escaped on the sending side
only, which protects from nothing as a request can be forged.
The name is now set as a text. Note the formatted size which followed it was
already not displayed, html() taking a single argument, so the display is left
unchanged.
A scripting scheme given as the value of an attribute is detected as well by
MassiveWebSecurityFilter. Such a declaration holds no on prefix and was
therefore going through, and the colon introducing it is accepted written as
the character itself or as any of the HTML entities standing for it, as the
reported payload uses "javascript:". The data scheme is deliberately left
out: the contents do embed their inlined images with it.
(cherry picked from commit 4f92097f60d0d6e8072815cf5a77093d3f19f9e3)
2026-09-28 14:42:28 +020023acd94a451f35afaf18324777b344292593341bFix the vulnerabilities CVE-2026-78738 and CVE-2026-78741editcore-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jseditcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.java
- core-library/src/main/java/org/silverpeas/core/node/dao/NodeDAO.javacore-library/src/integration-test/resources/org/silverpeas/core/node/dao/nodes-sorting-dataset.sqlcore-library/src/integration-test/java/org/silverpeas/core/node/dao/NodeSortingIT.javacore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.java52843258f403c47fb8a0b51a75295f883fb98eda1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comSort only the nodes of the component instance being administrated
The sorting of the nodes was granted against the component instance referred by
the URL of the REST service, whereas the nodes to sort were taken from the
request body, each of them carrying the component instance it belongs to. An
administrator of any instance could hence ask to sort the nodes of another one.
The nodes are now identified within the instance of the URL, the one the
authorization has been checked against. Taking that instance from the body
brought nothing: the sorting applies by nature to the instance administrated.
That wasn't enough though. NodeDAO was updating the order of a node by its
identifier only, whereas such an identifier isn't unique by itself: the root
node of every component instance is numbered 0, and the ones below it can bear
the same numbers from an instance to another. So the instance of the node is
now part of the criteria. Beyond the authorization, this was a defect on its
own: sorting the nodes of an instance was renumbering the nodes of the other
ones bearing the same identifiers, whoever asked for that sorting.
NodeSortingIT covers the sorting of the nodes of an instance and the isolation
of the other instances from it, in both directions.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e7028e01e7261c16803ee20f841763ef5b84ab7b)
2026-09-28 14:42:28 +020052843258f403c47fb8a0b51a75295f883fb98edaSort only the nodes of the component instance being administratededitcore-library/src/main/java/org/silverpeas/core/node/dao/NodeDAO.javaaddcore-library/src/integration-test/resources/org/silverpeas/core/node/dao/nodes-sorting-dataset.sqleditcore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaaddcore-library/src/integration-test/java/org/silverpeas/core/node/dao/NodeSortingIT.java
- core-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-war/src/main/webapp/defaultLoginQuestion.jspdf92a06600aedb5b24bad01559165e839421c2b51790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake into account sonarcloud feedback
2026-09-28 14:42:28 +0200df92a06600aedb5b24bad01559165e839421c2b5Take into account sonarcloud feedbackeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-war/src/main/webapp/defaultLoginQuestion.jsp
- core-configuration/src/main/config/properties/org/silverpeas/util/security.propertiesdb15a2e30508fb101a2addaf4780cc6479eb92701790599436000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comNow the parameter security.external.media.hosts.allowed is empty.
This means all hosts out of Silverpeas will be refused in HTML media
tags (video, iframe, img, ...)
2026-09-28 14:43:56 +0200db15a2e30508fb101a2addaf4780cc6479eb9270Now the parameter security.external.media.hosts.allowed is empty.editcore-configuration/src/main/config/properties/org/silverpeas/util/security.properties
- core-library/src/main/java/org/silverpeas/core/index/indexing/parser/tika/TikaParser.javacore-library/src/main/java/org/silverpeas/core/index/indexing/model/IndexManager.javacore-library/src/main/java/org/silverpeas/core/index/indexing/parser/Parser.java3f5875d5832af01276050f9ad75a08f7ddb4dd301790608429000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comFix bug-15488
2026-09-28 17:13:49 +02003f5875d5832af01276050f9ad75a08f7ddb4dd30Fix bug-15488editcore-library/src/main/java/org/silverpeas/core/index/indexing/parser/tika/TikaParser.javaeditcore-library/src/main/java/org/silverpeas/core/index/indexing/model/IndexManager.javaeditcore-library/src/main/java/org/silverpeas/core/index/indexing/parser/Parser.java
git- suggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/TickerResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javagallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javaquickinfo/quickinfo-library/src/main/java/org/silverpeas/components/quickinfo/NewsSort.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javagallery/gallery-library/src/main/java/org/silverpeas/components/gallery/constant/MediaResolution.javapom.xmldelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javarssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javacomponents-restapi/src/site/resources/index.htmlkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/AbstractNewsResource.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/FolderResource.javaquickinfo/quickinfo-library/src/integration-test/java/org/silverpeas/components/quickinfo/repository/NewsRepositoryIT.javacomponents-restapi/pom.xmlf2fe8d93d99b4eb77e672c047d22ce154ba946731790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGenerate the documentation of the REST API with Swagger instead of Smart-Doc
The new components-restapi module gathers the web resources of the fourteen
applications into a single OpenAPI 3.1 document, rendered by Redoc and published
on its own at docs/restapi/components. It produces nothing but that
documentation and builds only with the restapi profile, from which the Smart-Doc
plugin is dropped.
All the 81 operations, spread over 70 paths and 81 schemas, are now documented.
The twenty-two operations of the almanach are inherited from the calendar
resources of Core and needed nothing: Swagger reads the annotations of the
overridden methods. The others got a summary, a success response with its
schema, and the errors they can answer, the recurring ones coming from the
@NotFound and @Conflict annotations of Core. The 503 common to every endpoint is
brought by CommonResponsesFilter, of which this project has its own copy.
Documenting the endpoints brought several defects to light, which are fixed
here:
* three of the four folder endpoints of Kmelia were invisible in the
documentation. Swagger strips the regular expression of a path template, so
{path: \d+(/\d+)*/children} was reduced to {path} and collided with the
three other ones. The literal suffix now sits outside the template, which
matches the very same URIs;
* NewsResource caught back the WebApplicationException it had just thrown and
turned it into a 503, so neither the 404 of an unknown news nor the refusal
to delete one ever reached the requester. That refusal answers a 403 now,
instead of a 401 without any challenge;
* MediaResolution read the settings of the application from its enum
constants, making the scan fail with an ExceptionInInitializerError. The
watermark size is read lazily now;
* five classes of Quickinfo were missing the licence header.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200f2fe8d93d99b4eb77e672c047d22ce154ba94673Generate the documentation of the REST API with Swagger instead of Smart-Docaddcomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javaeditrssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaeditgallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javaeditresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javaeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javaeditsuggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditpom.xmleditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javaeditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javaeditquickinfo/quickinfo-library/src/main/java/org/silverpeas/components/quickinfo/NewsSort.javaaddcomponents-restapi/pom.xmleditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/AbstractNewsResource.javaaddcomponents-restapi/src/site/resources/index.htmleditquickinfo/quickinfo-library/src/integration-test/java/org/silverpeas/components/quickinfo/repository/NewsRepositoryIT.javaeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/constant/MediaResolution.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/TickerResource.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/FolderResource.java
- components-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javacomponents-restapi/pom.xml59908ef73f929070700744af9c79e30cf0066fff1790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comMake the schema resolver of Swagger aware of the JAXB annotations
The resolver figures the properties of a web entity out with a plain Jackson
object mapper, whereas Silverpeas serializes them with the introspector of the
JAXB annotations. The generated schemas were therefore describing properties
that never reach the wire, those excluded by @XmlTransient or by an access set
to XmlAccessType.FIELD, and missing the fields that do reach it.
Same resolver as the one of Core, of which this project has its own copy, for
the very reason its filter completing the responses has one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +020059908ef73f929070700744af9c79e30cf0066fffMake the schema resolver of Swagger aware of the JAXB annotationseditcomponents-restapi/pom.xmladdcomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.java
- components-restapi/src/main/openapi/openapi.yamlcomponents-restapi/pom.xmlae522b0fb3a88fbb36407023c62f0c096c2a3ab31790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comPublish nothing but the documentation of the REST API
The generated specification declared no info section, which OpenAPI requires. A
renderer refuses to display such a document, whatever the quality of the rest of
it. Contrary to the plugin of SmallRye, the one of Swagger has no parameter to
fill that section in, hence the document of its own declared here: the scan
completes it, and Maven fills its version in.
Besides the documentation of the REST API, the module was publishing the site
Maven builds for it: the reports about the dependencies, the SCM, the javadoc of
a module that has almost no source. Those reports aren't produced any more, and
what the site brings along -- its decoration and its sitemap, of no use to the
rendering page -- is dropped once the site has been built, before it gets
published.
Same setting as the one of Core, of which this project has its own copy, for the
very reason its filter completing the responses has one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200ae522b0fb3a88fbb36407023c62f0c096c2a3ab3Publish nothing but the documentation of the REST APIaddcomponents-restapi/src/main/openapi/openapi.yamleditcomponents-restapi/pom.xml
- components-restapi/pom.xml01111927bc2afba8b8a88f23247f97c2e70eab181790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from the parent POM what doesn't depend on the project
The version of Redoc, swagger-core, the base document carrying the info section,
the output of the generated specification and the binding of the resolve goal of
Swagger, along with the execution stripping the Maven site, are now managed by
the parent POM. The module keeps what is its own: the packages to scan, its
filter and its schema resolver, the fourteen WAR whose classes are unpacked, and
the URL the documentation is published at.
It also keeps the setting silencing the reports of the site plugin: that plugin
is declared by the root POM of the project, so managing the setting in the
parent would make every Maven site of Silverpeas lose its reports.
This takes effect once the parent POM is released: the project still refers to
the last released one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +020001111927bc2afba8b8a88f23247f97c2e70eab18Take from the parent POM what doesn't depend on the projecteditcomponents-restapi/pom.xml
- suggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javagallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javapom.xmldelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javarssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javacomponents-restapi/pom.xml021fe614496d0adf069aaade785f13438a7998ca1790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from core-rs what generates the documentation of the REST API
The filter completing the responses of every endpoint and the resolver reading
the JAXB annotations of the web entities were copied here from Silverpeas Core,
where they now sit in a package of their own, org.silverpeas.core.rs.doc,
alongside the annotations documenting the common errors. The copies are dropped
and the parent POM declares the classes of core-rs instead.
The annotations documenting the common errors follow them: the endpoints of the
applications refer them at their new place.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200021fe614496d0adf069aaade785f13438a7998caTake from core-rs what generates the documentation of the REST APIeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaeditresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javaeditrssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javaeditpom.xmleditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javaeditcomponents-restapi/pom.xmldeletecomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javaeditsuggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javadeletecomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javaeditgallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.java
- components-restapi/pom.xml9d3490bf7cd64723cdac38d15472d03679bb89501790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comOpt in the stripping of the Maven site
The strip-maven-site execution of the parent POM is now skipped by default: it
used to apply to every project inheriting from that POM and wiped out the Maven
site such a project publishes. This module publishes the documentation of the
REST API and nothing else, so it asks for the execution by setting
strip.maven.site.skip to false.
2026-09-28 14:12:34 +02009d3490bf7cd64723cdac38d15472d03679bb8950Opt in the stripping of the Maven siteeditcomponents-restapi/pom.xml
- forums/forums-war/src/main/webapp/forums/jsp/modifyMessage.jspforums/forums-war/src/main/webapp/forums/jsp/viewMessage.jspforums/forums-war/src/main/webapp/forums/jsp/editMessageKeywords.jsp3b4d732f0a1b27af91286d6a8bf01e77d8d3bde21790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1460
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The title and the body of a forum message were printed raw by JSP scriptlets on
the thread page, so any script posted by a user of the forum was run in the
browser of every user reading it.
The title is now HTML encoded on output, as the other JSPs of the component
already do through WebEncodeHelper. Two other raw outputs of the title, which
the report doesn't mention, are encoded as well: the one of modifyMessage.jsp,
where the title lands in the value attribute of an input and is hence
exploitable by escaping that attribute, and the one of editMessageKeywords.jsp.
The body is sanitized by the applySanitizeForRenderingDirective directive
introduced in Silverpeas-Core for the vulnerability #1459, which drops what can
act on the visitor's browser while keeping the content as it is.
Note the report also states the title pollutes the title element of the page.
It does appear there, but viewMessage.jsp already prints it through a c:out tag,
so it is encoded and isn't a vector.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit ea479b045468c5015e93e8b6c0924b919f8e4f32)
2026-09-28 14:43:22 +02003b4d732f0a1b27af91286d6a8bf01e77d8d3bde2Fix vulnerability #1460editforums/forums-war/src/main/webapp/forums/jsp/viewMessage.jspeditforums/forums-war/src/main/webapp/forums/jsp/editMessageKeywords.jspeditforums/forums-war/src/main/webapp/forums/jsp/modifyMessage.jsp
- gallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javagallery/gallery-library/src/test/java/org/silverpeas/components/gallery/WatermarkTest.javab0d04438a605a666ee748f7c6ca310fef0ff6a4a1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1461
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The image of a watermark is an instance parameter any manager of the space
holding the gallery can set, and the server requests it as it is, at each media
creation. It could hence be pointed at a service the server keeps for itself.
Such an URL is now verified before being requested: only the HTTP and HTTPS
schemes are handled, and the host must resolve to neither a loopback nor a
link-local address, so that neither the services bound to the server itself nor
the metadata endpoint of a cloud provider can be reached. Every address the host
resolves to is verified, otherwise a host resolving to a forbidden address
beside an allowed one would go through.
The addresses of the private networks of an organization remain reachable on
purpose: they are where the internal resources of an intranet legitimately live,
and no address range can tell them from the internal services one would rather
protect. Only an explicit list of allowed hosts could, which is left to a
further decision.
The request is besides given a timeout and its response is no longer copied
without any bound, both being able to exhaust the resources of the server, and
the redirections are no longer followed as they would escape the verification
above.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 83864c0f72b6c5f62a1afdf2cb420f8b62840f20)
2026-09-28 14:43:22 +0200b0d04438a605a666ee748f7c6ca310fef0ff6a4aFix vulnerability #1461addgallery/gallery-library/src/test/java/org/silverpeas/components/gallery/WatermarkTest.javaeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.java
- infoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/previewLetter.jspinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/headerLetter.jspinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java03b14dd2f030f634a99944c3272b31500811242f1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1462 and secure the other writings of the newsletter
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
Publishing an issue of a newsletter changes its state, stamps its publication
date, notifies the subscribers and mails the external ones. It was requested by
a GET, and the synchronizer token is required on a GET only when its URL holds
one of a few keywords, which ValidateParution holds none of. Any logged user
lured into a cross-site visit was hence publishing the issue as themselves.
The publication is now submitted by POST, on which the token is required
whatever the URL, through the formRequest facility which stamps it.
Moreover the endpoint had no role check at all, so any reader of the newsletter
was able to publish an issue and to trigger the mailing, with no luring needed.
Only its publishers and its managers can do so now.
Three other writings, which the report doesn't mention, were exposed the same
way and are secured likewise:
- resetting the content of an issue with its template, which overwrites the
content being written;
- mailing an issue to oneself and to the managers, which sends the content of an
issue not published yet and was hence a way for any reader to get a draft.
As EditContent also serves the edition itself, a mere navigation which remains a
GET, the reset is explicitly refused when it isn't requested by POST: submitting
it by POST would otherwise protect nothing, the previous URL remaining
requestable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 4bd5e04d16207d889d2b271eed87fa1962fa8ab5)
2026-09-28 14:43:22 +020003b14dd2f030f634a99944c3272b31500811242fFix vulnerability #1462 and secure the other writings of the newslettereditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/headerLetter.jspeditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/previewLetter.jspeditinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java
- infoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterUser.jspinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterAdmin.jspinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java0b6076009ffb133c105e4861267e1cda62176d781790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerabilities #1463
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The operations on the issues themselves were exposed the same way and are
secured likewise: creating and modifying an issue, and modifying the headers of
the newsletter, were requestable by a GET although their forms are submitted by
POST, the router not caring about the method.
None of the operations of this router had any role check, so any reader was able
to write the content of an issue, to modify the headers of the newsletter, to
delete issues and to read the ones being written. They are now reserved to the
publishers and to the managers, but for the ones on the template and the
deletion of several issues at once, reserved to the managers.
Reading the inlined CSS rendering of an issue is how the readers get it from the
list, so the criterion there isn't the role but the issue itself: it is refused
to them as long as it isn't published.
(cherry picked from commit e455edb9286b8b429cbb7fc1c54de6f75ead8dfd)
2026-09-28 14:43:22 +02000b6076009ffb133c105e4861267e1cda62176d78Fix vulnerabilities #1463editinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterUser.jspeditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterAdmin.jspeditinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java
- kmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationLinksManager.jspkmelia/kmelia-war/src/main/webapp/kmelia/jsp/basket.jspkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/ajax/AjaxOperation.javakmelia/kmelia-war/src/main/webapp/kmelia/jsp/orderTopics.jspkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javadbb4f8e6ae7b2f71c500e2457c9a7cb299fa12dc1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1464
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
Loading publications into the clipboard and pasting them under another topic
were requestable by a GET, so any logged user lured into a cross-site visit was
moving publications as themselves.
The AJAX servlet of kmelia answers the GET as the POST, and none of its URLs
holds any of the keywords making the synchronizer token required on a GET. So
none of its operations was protected, including the deletion of publications
which the report takes as protected: its URL does hold the delete keyword, but
the rule applied to this servlet requires in addition the path to hold /jsp/,
which the path of a servlet doesn't.
The operations only reading something are now listed apart, every other one
being taken as writing something so that adding an operation doesn't expose it
by mistake, and a writing operation requested by a GET is refused. That refusal
is performed before the processing, whose catch-all would swallow it.
The user interface already submitted by POST the operations the report points
at, as well as the deletion, the copy and the move of publications: what made
the attack possible is the servlet accepting the GET. Three operations were
still requested by a GET and are now submitted by POST: sorting the topics,
emptying the trash from the basket, and binding a publication to another one.
(cherry picked from commit 9d1faf9ba0366440299b0907b00a0ab5397f5bdd)
2026-09-28 14:43:22 +0200dbb4f8e6ae7b2f71c500e2457c9a7cb299fa12dcFix vulnerability #1464editkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javaeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/orderTopics.jspeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/basket.jspeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationLinksManager.jspeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/ajax/AjaxOperation.java
- kmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javakmelia/kmelia-war/pom.xmlkmelia/kmelia-war/src/test/java/org/silverpeas/components/kmelia/web/KmeliaResourceTest.javaf371b6452d9360af47926ebccceba45e05d252ca1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #939
(GitHub issue of Silverpeas-Components, reported against 6.4.6)
Updating a publication was granted against the component instance referred by
the URL, whereas the publication to update was entirely defined by the request
body, which carries both its identifier and its component instance. Any user
could hence rewrite the metadata of any publication of the platform by referring
it in the body, the identifiers being enumerable.
The publication is now refused when it doesn't belong to the instance the
authorization has been checked against. Note the report states a WRITER role is
required: it is not, the authorization of the REST framework only validating the
access to the instance whatever the role played in it, so the exposure was wider
than reported. Writing a publication, be it created or updated, now requires
that role indeed.
KmeliaResourceTest covers the checks. The war had no test at all, hence the
test dependency added to its POM.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 1d8ec7ee0a903b041ffac54b022319ff099b12ce)
2026-09-28 14:43:22 +0200f371b6452d9360af47926ebccceba45e05d252caFix vulnerability #939editkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditkmelia/kmelia-war/pom.xmladdkmelia/kmelia-war/src/test/java/org/silverpeas/components/kmelia/web/KmeliaResourceTest.java
- delegatednews/delegatednews-war/src/test/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResourceTest.javadelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javabb7f36a57f96d33b8bd92d826056770e3c14e04c1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comReserve the management of the delegated news to the managers
Modifying and deleting the delegated news is reserved to the managers of the
application, as its user interface applies on its side. The REST service was
granted against a mere access to the component instance, whatever the role
played in it, so any of its users was able to reorder and to delete them by
requesting it directly.
Found while auditing the other REST resources against the flaw reported by the
issue #939 of this repository.
ListDelegatedNewsResourceTest covers the check.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e4271c328772c51f400cbeab7eeb6f7fb2876721)
2026-09-28 14:43:22 +0200bb7f36a57f96d33b8bd92d826056770e3c14e04cReserve the management of the delegated news to the managersadddelegatednews/delegatednews-war/src/test/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResourceTest.javaeditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.java
- gallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javaeca5145d6d01f77adce83ef714742073585675ca1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake into account sonarcloud feedback
2026-09-28 14:43:22 +0200eca5145d6d01f77adce83ef714742073585675caTake into account sonarcloud feedbackeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.java
githttps://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse1163https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1163/Lancé par une alarme périodiqueSKIP_TESTfalseSKIP_QUALITYfalse116456f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube11643f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/master3f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/master3f5875d5832af01276050f9ad75a08f7ddb4dd303f5875d5832af01276050f9ad75a08f7ddb4dd30refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1164eca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/mastereca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/mastereca5145d6d01f77adce83ef714742073585675caeca5145d6d01f77adce83ef714742073585675carefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11643371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1164ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11640c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11647b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-AssemblyAaD0l2pebQNaPUmG7crvSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Core2&branch=masterAaD0uxyCkj6CGoBn7yygSilverpeas SonarCloudhttps://sonarcloud.iotruehttps://sonarcloud.iofalsehttps://sonarcloud.io/dashboard?id=Silverpeas_Silverpeas-Components&branch=masterbuild.yamlbuild.yamltarget/build.yamlfalse6.5-build2609302406508710550775Silverpeas_Master_AutoDeploy 6.5-build2609301164false116463961SUCCESS1790789040596https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1164/- core-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javacore-restapi/src/site/resources/index.htmlcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javacore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javacore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentListResource.javacore-web/src/main/java/org/silverpeas/core/webapi/publication/SharedPublicationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/rating/RatingResource.javacore-web/src/main/java/org/silverpeas/core/webapi/sharing/TicketResource.javacore-restapi/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javacore-web/src/main/java/org/silverpeas/core/webapi/publication/PublicationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javacore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/UserProfileResource.javacore-web/src/main/java/org/silverpeas/core/webapi/mylinks/MyLinksResource.javacore-web/src/main/java/org/silverpeas/core/webapi/security/CipherKeyResource.javacore-web/src/main/java/org/silverpeas/core/webapi/variables/VariablesResource.javacore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/RelationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/search/SearchResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentsResource.javacore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javacore-web/src/main/java/org/silverpeas/core/webapi/util/logging/LogResource.javacore-web/src/main/java/org/silverpeas/core/webapi/node/AbstractNodeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/AuthenticationResource.javacore-rs/pom.xmlcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authenticated.javacore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/profile/UserGroupProfileResource.javacore-library/src/main/java/org/silverpeas/core/i18n/AbstractI18NBean.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/invitation/InvitationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscribeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/preferences/MyPreferencesResource.javacore-web/src/main/java/org/silverpeas/core/webapi/cache/VolatileCacheResource.javacore-web/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/FilteredPdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/selection/SelectionBasketResource.javacore-web/src/main/java/org/silverpeas/core/webapi/util/logging/SilverLoggerConfigurationResource.javapom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SharedAttachmentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/thesaurus/ThesaurusResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaPlayerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/language/LanguageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javacore-web/src/main/java/org/silverpeas/core/webapi/sharing/SharingResource.javacore-web/src/main/java/org/silverpeas/core/webapi/wysiwyg/WysiwygEditorConfigResource.javacore-web/src/main/java/org/silverpeas/core/webapi/session/SilverpeasUserSessionTokenResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResourceCreator.javacore-web/src/main/java/org/silverpeas/core/webapi/attachment/AttachmentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/bundle/BundleResource.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/UnsubscribeResource.javacore-web/src/main/java/org/silverpeas/core/webapi/workflow/ReplacementResource.javacore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaec9caee6b1242b8d5893ed5ece0884304d811cb01790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGenerate the documentation of the REST API with Swagger instead of Smart-Doc
Smart-Doc parses the sources with QDox and chokes on constructs Silverpeas
relies on, silently reporting a success while producing an incomplete
documentation. Swagger scans the compiled classes by reflection and understands
the JAX-RS annotations, so the whole REST API is covered.
The new core-restapi module gathers the web resources of all the modules into a
single OpenAPI 3.1 document, rendered by Redoc and published on its own at
docs/restapi/core. It produces nothing but that documentation and builds only
with the restapi profile, from which the Smart-Doc plugin is dropped.
All the 217 operations, spread over 168 paths and 86 schemas, are now
documented: a summary, a success response with its schema, and the errors the
endpoint can answer. The responses common to several endpoints are declared once
for all:
* @Authenticated and @Authorized, besides the security schemes they already
described, bring the 401 and 403 responses of the protected resources;
* the 503 is brought by CommonResponsesFilter, applied once the specification
has been figured out. It cannot come from another meta-annotation of the web
resources: at class level Swagger returns the responses of the first
meta-annotation declaring some instead of merging them all, so a second one
would silently discard the responses of @Authenticated and @Authorized;
* the recurring 404, 400 and 409 are factored out into the @NotFound,
@BadRequest and @Conflict annotations of the new annotation.doc package.
Contrary to the class level one, the method level lookup of Swagger does
merge, but the description of such an annotation takes precedence over the
one an endpoint would declare for the same status code, hence an endpoint
needing another wording must not be annotated.
Documenting the endpoints brought several defects to light, which are fixed
here: the wrong descriptions of the personal space endpoints of SpaceResource, a
test endpoint left over in CipherKeyResource, and the conflicting setters of
AbstractI18NBean for the translations property, which made the scan fail.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200ec9caee6b1242b8d5893ed5ece0884304d811cb0Generate the documentation of the REST API with Swagger instead of Smart-Doceditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaPlayerResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/RelationResource.javaeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authenticated.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/cache/VolatileCacheResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResourceCreator.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javaaddcore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javaeditpom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/UserGroupProfileResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/socialnetwork/invitation/InvitationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/search/SearchResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/security/CipherKeyResource.javaeditcore-library/src/main/java/org/silverpeas/core/i18n/AbstractI18NBean.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/FilteredPdcResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/workflow/ReplacementResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/wysiwyg/WysiwygEditorConfigResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/session/SilverpeasUserSessionTokenResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscribeResource.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/sharing/TicketResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/rating/RatingResource.javaeditcore-web/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/mylinks/MyLinksResource.javaaddcore-restapi/src/site/resources/index.htmleditcore-web/src/main/java/org/silverpeas/core/webapi/util/logging/LogResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/UnsubscribeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/AttachmentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/thesaurus/ThesaurusResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/UserProfileResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/EmbedMediaViewerResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/publication/PublicationResource.javaaddcore-restapi/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/language/LanguageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/variables/VariablesResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/upload/FileUploadResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/selection/SelectionBasketResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javaaddcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/sharing/SharingResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/publication/SharedPublicationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/bundle/BundleResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentsResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/profile/AuthenticationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SharedAttachmentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/util/logging/SilverLoggerConfigurationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/attachment/SimpleDocumentListResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/node/AbstractNodeResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/preferences/MyPreferencesResource.javaeditcore-rs/pom.xml
- core-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javacore-restapi/pom.xmlc097c5d943af83fb5ce284ad45b733a9d806b7611790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comMake the schema resolver of Swagger aware of the JAXB annotations
The resolver figures the properties of a web entity out with a plain Jackson
object mapper, whereas Silverpeas serializes them with the introspector of the
JAXB annotations. The generated schemas were therefore describing properties
that never reach the wire and missing others that do:
* an entity whose access is set to XmlAccessType.FIELD was described by its
getters instead of its fields. SpaceAppearanceEntity came out with two
properties where six are serialized;
* a member annotated with @XmlTransient was described all the same.
PdcAxisValueEntity came out with eleven properties where nine are
serialized.
The JAXBAnnotationsHelper of Swagger is of no help here: it reads @XmlElement,
@XmlElementWrapper and @XmlAttribute only, and only to feed the XML metadata of
a schema, never its visibility. As for the Jackson module bringing that
introspector, it does declare itself to the ServiceLoader, but Swagger never
asks for the modules available in the classpath.
The resolver declared here sets the introspector on a mapper of its own, the
very way the JSON codec of Silverpeas does, so that it applies to the resolution
of the schemas only. Ten business objects were documented that no endpoint ever
answers -- User, UserDetail, Domain, Quota, SettingBundle, PdcPosition and the
like -- and they are gone now.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200c097c5d943af83fb5ce284ad45b733a9d806b761Make the schema resolver of Swagger aware of the JAXB annotationsaddcore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javaeditcore-restapi/pom.xml
- core-restapi/src/main/openapi/openapi.yamlcore-restapi/pom.xmlcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthenticatedAnnotationProcessor.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthorizedAnnotationProcessor.java692a545a5347eefc22d5e8f1949b6ce94151f2741790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comPublish nothing but the documentation of the REST API
The generated specification declared no info section, which OpenAPI requires. A
renderer refuses to display such a document, whatever the quality of the rest of
it, and Redoc did. Contrary to the plugin of SmallRye, the one of Swagger has no
parameter to fill that section in, hence the document of its own declared here:
the scan completes it, and Maven fills its version in.
Besides the documentation of the REST API, the module was publishing the site
Maven builds for it: the reports about the dependencies, the SCM, the javadoc of
a module that has almost no source. Those reports aren't produced any more, and
what the site brings along -- its decoration and its sitemap, of no use to the
rendering page -- is dropped once the site has been built, before it gets
published. The published tree is now made of the rendering page, the
specification in both of its formats, and the rendering engine.
Skipping the site altogether looked simpler but isn't an option: the deploy goal
of the site plugin reads the very same maven.site.skip property as its site
goal, so the documentation would have silently stopped being published.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200692a545a5347eefc22d5e8f1949b6ce94151f274Publish nothing but the documentation of the REST APIeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthorizedAnnotationProcessor.javaeditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/Authorized.javaaddcore-restapi/src/main/openapi/openapi.yamleditcore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/processing/AuthenticatedAnnotationProcessor.javaeditcore-restapi/pom.xml
- core-restapi/pom.xml078323a23b15cb23bbbcaa797991a709645d0f7d1790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from the parent POM what doesn't depend on the project
The version of Redoc, swagger-core, the base document carrying the info section,
the output of the generated specification and the binding of the resolve goal of
Swagger, along with the execution stripping the Maven site, are now managed by
the parent POM. The module keeps what is its own: the packages to scan, the
routes of the SCIM API not to publish, its filter and its schema resolver, the
WAR whose classes are unpacked, and the URL the documentation is published at.
It also keeps the setting silencing the reports of the site plugin: that plugin
is declared by the root POM of the project, so managing the setting in the
parent would make every Maven site of Silverpeas lose its reports.
This takes effect once the parent POM is released: the project still refers to
the last released one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200078323a23b15cb23bbbcaa797991a709645d0f7dTake from the parent POM what doesn't depend on the projecteditcore-restapi/pom.xml
- core-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javacore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javacore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javacore-web/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javacore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javacore-restapi/pom.xmlcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/BadRequest.javacore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javacore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javacore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javacore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/Conflict.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/CommonResponsesFilter.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/NotFound.javacore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javacore-rs/src/main/java/org/silverpeas/core/rs/doc/JaxbAwareModelResolver.javacore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javacore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javacore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.javacore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javacore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javacore-rs/pom.xmlb738adf1743bdd89b3f676bf5dcc7acd6ccf2d9a1790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGather in core-rs what generates the documentation of the REST API
The filter completing the responses of every endpoint and the resolver reading
the JAXB annotations of the web entities were duplicated, one copy per project
documenting its REST API, the two being identical but for their package. They
are gathered here, beside the annotations documenting the common errors, in a
package of their own: org.silverpeas.core.rs.doc.
Their name being the same for every project now, the parent POM declares them
once for all, and nothing is left to keep the copies in step.
The counterpart is that core-rs, a module of production, depends on swagger-core
to compile them. The dependency is provided, so nothing of it is shipped, and
neither the filter nor the resolver plays any role at runtime: both are read
when generating the documentation only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:17 +0200b738adf1743bdd89b3f676bf5dcc7acd6ccf2d9aGather in core-rs what generates the documentation of the REST APIaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/JaxbAwareModelResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcClassificationResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/Conflict.javadeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/Conflict.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/media/streaming/StreamingPlayerResource.javaeditcore-web/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/comment/CommentResource.javadeletecore-restapi/src/main/java/org/silverpeas/core/restapi/CommonResponsesFilter.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/MessageResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/password/PasswordResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/ICalendarResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/CommonResponsesFilter.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/ComponentResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/calendar/CalendarResource.javadeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/BadRequest.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/DocumentViewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/look/DisplayResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcPredefinedClassificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/notification/user/InboxUserNotificationResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/documenttemplate/DocumentTemplateResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/admin/SpaceResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/contribution/ContributionContentResource.javaeditcore-restapi/pom.xmldeletecore-rs/src/main/java/org/silverpeas/core/web/rs/annotation/doc/NotFound.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/reminder/ReminderResource.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/NotFound.javaaddcore-rs/src/main/java/org/silverpeas/core/rs/doc/BadRequest.javadeletecore-restapi/src/main/java/org/silverpeas/core/restapi/JaxbAwareModelResolver.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/viewer/PreviewResource.javaeditcore-web/src/main/java/org/silverpeas/core/webapi/subscribe/SubscriptionResource.javaeditcore-rs/pom.xmleditcore-web/src/main/java/org/silverpeas/core/webapi/pdc/PdcResource.java
- core-restapi/pom.xmld41b4c150a336e2cb3019a2b3687c5a403cba3d41790597537000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comOpt in the stripping of the Maven site
The strip-maven-site execution of the parent POM is now skipped by default: it
used to apply to every project inheriting from that POM and wiped out the Maven
site such a project publishes. This module publishes the documentation of the
REST API and nothing else, so it asks for the execution by setting
strip.maven.site.skip to false.
2026-09-28 14:12:17 +0200d41b4c150a336e2cb3019a2b3687c5a403cba3d4Opt in the stripping of the Maven siteeditcore-restapi/pom.xml
- core-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web-test/src/main/java/org/silverpeas/web/test/stub/TestHttpRequest.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.java5f5891af886c501d82d72d54f15552e3775e0ce71790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comHarden the detection of the event callbacks against the vulnerabilities #1458, #1459 and #1460
(GitHub issues, reported against 6.4.6)
The three reported stored XSS rely on an event callback attribute carried by an
element the browser fails to load on purpose. Such a declaration was detected by
the \s+on\w+\s*= pattern, which expects a whitespace before the attribute name.
According to the HTML tokenizer, an attribute name is also expected right after
the closing quote of the previous attribute value (a
missing-whitespace-between-attributes parse error, whose recovery is mandated by
the specification) and right after a solidus. So the following did declare an
onerror callback the browsers do run, while going through the filter:
<img src="x"onerror=alert(1)>
The pattern now accepts these separators as well.
Note this filter is an input guard, not an output encoding: it narrows the
reachability of the three flaws but it doesn't fix the rendering code itself.
MassiveWebSecurityFilterOnReportedXssIT covers the payloads of the three reports
on their actual endpoints and parameters, including when they are submitted as
multipart/form-data streams as the genuine forms do. It also delimits the
multipart exemption, which applies to the webPages component only.
TestHttpRequest.getContentType() returned null whatever the headers set on the
stub, which made the multipart branch untestable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 81589f6134e8e337c16a6c390b2d804e78006f8f)
2026-09-28 14:42:28 +02005f5891af886c501d82d72d54f15552e3775e0ce7Harden the detection of the event callbacks against the vulnerabilities #1458, #1459 and #1460editcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javaaddcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.javaeditcore-web-test/src/main/java/org/silverpeas/web/test/stub/TestHttpRequest.java
- core-war/src/main/webapp/defaultLoginQuestion.jsp018ed026afbb76a9ad52281cd62b8e284b9a914a1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1458
(GitHub issue, reported against 6.4.6)
The login question, which any authenticated user sets from their profile, was
printed raw by a JSP scriptlet on the password reminder page, an anonymous one.
Any script stored there was then run in the browser of every visitor of that
page, without any login required from them. The answer to that question, itself
a credential, is asked on the very same page.
The value is now HTML encoded on output, through a c:out tag. Doing so on the
rendering side rather than on the writing one closes both the ways the field is
fed: MyProfilRequestRouter, which the report points at, but also
ValidationQuestionHandler, which stores the question of the ValidateQuestion
function with no more filtering. It also neutralizes the values already stored.
The login of the hidden field below is encoded as well. It comes from a lookup
in the database and not from the request parameter, so exploiting it would
require a login holding a quote, but the encoding costs nothing here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 457be5fa780ce2656d7104f31515ea7064e2fbf6)
2026-09-28 14:42:28 +0200018ed026afbb76a9ad52281cd62b8e284b9a914aFix vulnerability #1458editcore-war/src/main/webapp/defaultLoginQuestion.jsp
- core-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javacore-services/importExport/src/main/java/org/silverpeas/core/importexport/report/HtmlExportPublicationGenerator.javacore-configuration/src/main/config/properties/org/silverpeas/util/security.propertiescore-library/src/main/java/org/silverpeas/core/contribution/content/form/displayers/WysiwygFCKFieldDisplayer.javacore-library/src/integration-test/resources/org/silverpeas/util/security.propertiescore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentRenderer.javacore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javacore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javacore-library/src/integration-test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygControllerIT.javacore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.javacore-services/importExport/src/main/java/org/silverpeas/core/importexport/control/PublicationsTypeManager.javacore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformer.javacore-library/src/integration-test/java/org/silverpeas/core/test/LibCoreWarBuilder.java37283d39cead2166ad9483d373658c2b8e414c951790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1459
(GitHub issue, reported against 6.4.6)
The WYSIWYG content of a form field was written into the response as raw HTML by
WysiwygFCKFieldDisplayer, so any script stored by the writer of a whitePages
card was run in the browser of every user viewing it. The same held for the
content of a publication, rendered by WysiwygContentRenderer, and for the two
export paths, none of which was reported.
Such a content is sanitized now, by the new SanitizeForRenderingDirective.
Unlike SanitizeDirective, which keeps only a restricted set of safe elements and
is left untouched for the contents extracted out of Silverpeas, this one keeps
the content as it is and drops only what can act on the visitor's browser:
- the elements able to run code or to take over the document, with their
content;
- the event callback attributes, whatever the element carrying them;
- the attributes referring a URL with a scripting scheme;
- the iframes and the media whose source isn't allowed.
This is deliberate: the WYSIWYG editor is set up to accept any content
(config.allowedContent = true in silverconfig.js), so an allow list applied at
rendering time would be narrower than what the users are entitled to write. It
would in particular have dropped the media produced by the video and html5audio
plugins and the rel attribute the userzoom and identitycard ones rely upon.
The parsing is delegated to the HTML tokenizer of the OWASP sanitizer, so the
content is read the way a browser reads it and the dropping can't be dodged by
playing with the HTML syntax.
The rule deciding whether the source of an iframe is allowed moves to the new
EmbeddedSourceValidator class, so that the filtering of the incoming requests
and this sanitization agree on it. It now serves the media as well, through the
new security.external.media.hosts.allowed property. That property is shipped
with the * value, which allows any host and hence preserves the behaviour of the
previous versions; setting it empty restricts the media to the ones Silverpeas
hosts itself. The inlined images are kept whatever it is, being carried by the
content itself.
The mail path is deliberately left out: its images are referred by cid URLs,
which such a sanitization drops, and its content isn't rendered in the
Silverpeas origin anyway.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 2961a40c81708375b2136cfa18f7c5f5e1d97321)
2026-09-28 14:42:28 +020037283d39cead2166ad9483d373658c2b8e414c95Fix vulnerability #1459addcore-api/src/main/java/org/silverpeas/core/security/html/EmbeddedSourceValidator.javaeditcore-library/src/integration-test/java/org/silverpeas/core/test/LibCoreWarBuilder.javaaddcore-library/src/integration-test/resources/org/silverpeas/util/security.propertieseditcore-configuration/src/main/config/properties/org/silverpeas/util/security.propertieseditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentRenderer.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/form/displayers/WysiwygFCKFieldDisplayer.javaeditcore-library/src/test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformerTest.javaaddcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/IFrameChecker.javaeditcore-services/importExport/src/main/java/org/silverpeas/core/importexport/control/PublicationsTypeManager.javaeditcore-services/importExport/src/main/java/org/silverpeas/core/importexport/report/HtmlExportPublicationGenerator.javaeditcore-library/src/integration-test/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygControllerIT.javaeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/WysiwygContentTransformer.javaeditcore-api/src/main/java/org/silverpeas/core/util/security/SecuritySettings.java
- core-library/src/main/java/org/silverpeas/core/util/HttpUtil.javab2900e3c4738e94ab34622ee8a48197f7921a09f1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1461
(GitHub issue, reported against 6.4.6)
Let the callers of HttpUtil complete the HTTP client.
Fixing that vulnerability requires the gallery component to request the image of
a watermark with a connection timeout and without following the redirections,
the latter being able to escape the verification of the address being requested.
httpClientBuilder() gives the builder of the HTTP client, already configured
with the proxy of Silverpeas, so that such a caller can complete the
configuration without having to duplicate that of the proxy. httpClient() now
delegates to it and is unchanged for its own callers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 16cff5ecd5e217798d51ebe7f5a97103f4d901b0)
2026-09-28 14:42:28 +0200b2900e3c4738e94ab34622ee8a48197f7921a09fFix vulnerability #1461editcore-library/src/main/java/org/silverpeas/core/util/HttpUtil.java
- core-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jscore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.javacore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.java23acd94a451f35afaf18324777b344292593341b1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix the vulnerabilities CVE-2026-78738 and CVE-2026-78741
Both report a stored XSS through the name of an uploaded file, one from the
document management and the other from the image upload of the WYSIWYG editor.
They share their cause: the name is written as an HTML content by the upload
widget, whereas it is carried by the request and escaped on the sending side
only, which protects from nothing as a request can be forged.
The name is now set as a text. Note the formatted size which followed it was
already not displayed, html() taking a single argument, so the display is left
unchanged.
A scripting scheme given as the value of an attribute is detected as well by
MassiveWebSecurityFilter. Such a declaration holds no on prefix and was
therefore going through, and the colon introducing it is accepted written as
the character itself or as any of the HTML entities standing for it, as the
reported payload uses "javascript:". The data scheme is deliberately left
out: the contents do embed their inlined images with it.
(cherry picked from commit 4f92097f60d0d6e8072815cf5a77093d3f19f9e3)
2026-09-28 14:42:28 +020023acd94a451f35afaf18324777b344292593341bFix the vulnerabilities CVE-2026-78738 and CVE-2026-78741editcore-war/src/main/webapp/util/javaScript/silverpeas-fileUpload.jseditcore-web/src/integration-test/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilterOnReportedXssIT.javaeditcore-web/src/main/java/org/silverpeas/core/web/filter/MassiveWebSecurityFilter.java
- core-library/src/main/java/org/silverpeas/core/node/dao/NodeDAO.javacore-library/src/integration-test/resources/org/silverpeas/core/node/dao/nodes-sorting-dataset.sqlcore-library/src/integration-test/java/org/silverpeas/core/node/dao/NodeSortingIT.javacore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.java52843258f403c47fb8a0b51a75295f883fb98eda1790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comSort only the nodes of the component instance being administrated
The sorting of the nodes was granted against the component instance referred by
the URL of the REST service, whereas the nodes to sort were taken from the
request body, each of them carrying the component instance it belongs to. An
administrator of any instance could hence ask to sort the nodes of another one.
The nodes are now identified within the instance of the URL, the one the
authorization has been checked against. Taking that instance from the body
brought nothing: the sorting applies by nature to the instance administrated.
That wasn't enough though. NodeDAO was updating the order of a node by its
identifier only, whereas such an identifier isn't unique by itself: the root
node of every component instance is numbered 0, and the ones below it can bear
the same numbers from an instance to another. So the instance of the node is
now part of the criteria. Beyond the authorization, this was a defect on its
own: sorting the nodes of an instance was renumbering the nodes of the other
ones bearing the same identifiers, whoever asked for that sorting.
NodeSortingIT covers the sorting of the nodes of an instance and the isolation
of the other instances from it, in both directions.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e7028e01e7261c16803ee20f841763ef5b84ab7b)
2026-09-28 14:42:28 +020052843258f403c47fb8a0b51a75295f883fb98edaSort only the nodes of the component instance being administratededitcore-library/src/main/java/org/silverpeas/core/node/dao/NodeDAO.javaaddcore-library/src/integration-test/resources/org/silverpeas/core/node/dao/nodes-sorting-dataset.sqleditcore-web/src/main/java/org/silverpeas/core/webapi/node/ListNodeResource.javaaddcore-library/src/integration-test/java/org/silverpeas/core/node/dao/NodeSortingIT.java
- core-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javacore-war/src/main/webapp/defaultLoginQuestion.jspdf92a06600aedb5b24bad01559165e839421c2b51790599348000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake into account sonarcloud feedback
2026-09-28 14:42:28 +0200df92a06600aedb5b24bad01559165e839421c2b5Take into account sonarcloud feedbackeditcore-library/src/main/java/org/silverpeas/core/contribution/content/wysiwyg/service/directive/SanitizeForRenderingDirective.javaeditcore-war/src/main/webapp/defaultLoginQuestion.jsp
- core-configuration/src/main/config/properties/org/silverpeas/util/security.propertiesdb15a2e30508fb101a2addaf4780cc6479eb92701790599436000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comNow the parameter security.external.media.hosts.allowed is empty.
This means all hosts out of Silverpeas will be refused in HTML media
tags (video, iframe, img, ...)
2026-09-28 14:43:56 +0200db15a2e30508fb101a2addaf4780cc6479eb9270Now the parameter security.external.media.hosts.allowed is empty.editcore-configuration/src/main/config/properties/org/silverpeas/util/security.properties
- core-library/src/main/java/org/silverpeas/core/index/indexing/parser/tika/TikaParser.javacore-library/src/main/java/org/silverpeas/core/index/indexing/model/IndexManager.javacore-library/src/main/java/org/silverpeas/core/index/indexing/parser/Parser.java3f5875d5832af01276050f9ad75a08f7ddb4dd301790608429000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@silverpeas.comFix bug-15488
2026-09-28 17:13:49 +02003f5875d5832af01276050f9ad75a08f7ddb4dd30Fix bug-15488editcore-library/src/main/java/org/silverpeas/core/index/indexing/parser/tika/TikaParser.javaeditcore-library/src/main/java/org/silverpeas/core/index/indexing/model/IndexManager.javaeditcore-library/src/main/java/org/silverpeas/core/index/indexing/parser/Parser.java
git- suggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/TickerResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javagallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javaquickinfo/quickinfo-library/src/main/java/org/silverpeas/components/quickinfo/NewsSort.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javagallery/gallery-library/src/main/java/org/silverpeas/components/gallery/constant/MediaResolution.javapom.xmldelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javarssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javacomponents-restapi/src/site/resources/index.htmlkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/AbstractNewsResource.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/FolderResource.javaquickinfo/quickinfo-library/src/integration-test/java/org/silverpeas/components/quickinfo/repository/NewsRepositoryIT.javacomponents-restapi/pom.xmlf2fe8d93d99b4eb77e672c047d22ce154ba946731790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comGenerate the documentation of the REST API with Swagger instead of Smart-Doc
The new components-restapi module gathers the web resources of the fourteen
applications into a single OpenAPI 3.1 document, rendered by Redoc and published
on its own at docs/restapi/components. It produces nothing but that
documentation and builds only with the restapi profile, from which the Smart-Doc
plugin is dropped.
All the 81 operations, spread over 70 paths and 81 schemas, are now documented.
The twenty-two operations of the almanach are inherited from the calendar
resources of Core and needed nothing: Swagger reads the annotations of the
overridden methods. The others got a summary, a success response with its
schema, and the errors they can answer, the recurring ones coming from the
@NotFound and @Conflict annotations of Core. The 503 common to every endpoint is
brought by CommonResponsesFilter, of which this project has its own copy.
Documenting the endpoints brought several defects to light, which are fixed
here:
* three of the four folder endpoints of Kmelia were invisible in the
documentation. Swagger strips the regular expression of a path template, so
{path: \d+(/\d+)*/children} was reduced to {path} and collided with the
three other ones. The literal suffix now sits outside the template, which
matches the very same URIs;
* NewsResource caught back the WebApplicationException it had just thrown and
turned it into a 503, so neither the 404 of an unknown news nor the refusal
to delete one ever reached the requester. That refusal answers a 403 now,
instead of a 401 without any challenge;
* MediaResolution read the settings of the application from its enum
constants, making the scan fail with an ExceptionInInitializerError. The
watermark size is read lazily now;
* five classes of Quickinfo were missing the licence header.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200f2fe8d93d99b4eb77e672c047d22ce154ba94673Generate the documentation of the REST API with Swagger instead of Smart-Docaddcomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javaeditrssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaeditgallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javaeditresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javaeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javaeditsuggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditpom.xmleditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javaeditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javaeditquickinfo/quickinfo-library/src/main/java/org/silverpeas/components/quickinfo/NewsSort.javaaddcomponents-restapi/pom.xmleditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/AbstractNewsResource.javaaddcomponents-restapi/src/site/resources/index.htmleditquickinfo/quickinfo-library/src/integration-test/java/org/silverpeas/components/quickinfo/repository/NewsRepositoryIT.javaeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/constant/MediaResolution.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/TickerResource.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/FolderResource.java
- components-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javacomponents-restapi/pom.xml59908ef73f929070700744af9c79e30cf0066fff1790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comMake the schema resolver of Swagger aware of the JAXB annotations
The resolver figures the properties of a web entity out with a plain Jackson
object mapper, whereas Silverpeas serializes them with the introspector of the
JAXB annotations. The generated schemas were therefore describing properties
that never reach the wire, those excluded by @XmlTransient or by an access set
to XmlAccessType.FIELD, and missing the fields that do reach it.
Same resolver as the one of Core, of which this project has its own copy, for
the very reason its filter completing the responses has one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +020059908ef73f929070700744af9c79e30cf0066fffMake the schema resolver of Swagger aware of the JAXB annotationseditcomponents-restapi/pom.xmladdcomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.java
- components-restapi/src/main/openapi/openapi.yamlcomponents-restapi/pom.xmlae522b0fb3a88fbb36407023c62f0c096c2a3ab31790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comPublish nothing but the documentation of the REST API
The generated specification declared no info section, which OpenAPI requires. A
renderer refuses to display such a document, whatever the quality of the rest of
it. Contrary to the plugin of SmallRye, the one of Swagger has no parameter to
fill that section in, hence the document of its own declared here: the scan
completes it, and Maven fills its version in.
Besides the documentation of the REST API, the module was publishing the site
Maven builds for it: the reports about the dependencies, the SCM, the javadoc of
a module that has almost no source. Those reports aren't produced any more, and
what the site brings along -- its decoration and its sitemap, of no use to the
rendering page -- is dropped once the site has been built, before it gets
published.
Same setting as the one of Core, of which this project has its own copy, for the
very reason its filter completing the responses has one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200ae522b0fb3a88fbb36407023c62f0c096c2a3ab3Publish nothing but the documentation of the REST APIaddcomponents-restapi/src/main/openapi/openapi.yamleditcomponents-restapi/pom.xml
- components-restapi/pom.xml01111927bc2afba8b8a88f23247f97c2e70eab181790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from the parent POM what doesn't depend on the project
The version of Redoc, swagger-core, the base document carrying the info section,
the output of the generated specification and the binding of the resolve goal of
Swagger, along with the execution stripping the Maven site, are now managed by
the parent POM. The module keeps what is its own: the packages to scan, its
filter and its schema resolver, the fourteen WAR whose classes are unpacked, and
the URL the documentation is published at.
It also keeps the setting silencing the reports of the site plugin: that plugin
is declared by the root POM of the project, so managing the setting in the
parent would make every Maven site of Silverpeas lose its reports.
This takes effect once the parent POM is released: the project still refers to
the last released one.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +020001111927bc2afba8b8a88f23247f97c2e70eab18Take from the parent POM what doesn't depend on the projecteditcomponents-restapi/pom.xml
- suggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javaquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javagallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javapom.xmldelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javacommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javacomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javarssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javacomponents-restapi/pom.xml021fe614496d0adf069aaade785f13438a7998ca1790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake from core-rs what generates the documentation of the REST API
The filter completing the responses of every endpoint and the resolver reading
the JAXB annotations of the web entities were copied here from Silverpeas Core,
where they now sit in a package of their own, org.silverpeas.core.rs.doc,
alongside the annotations documenting the common errors. The copies are dropped
and the parent POM declares the classes of core-rs instead.
The annotations documenting the common errors follow them: the endpoints of the
applications refer them at their new place.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-28 14:12:34 +0200021fe614496d0adf069aaade785f13438a7998caTake from core-rs what generates the documentation of the REST APIeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/QuestionResource.javaeditresourcesManager/resourcesManager-war/src/main/java/org/silverpeas/components/resourcesmanager/web/ResourceManagerResource.javaeditrssAggregator/rssAggregator-war/src/main/java/org/silverpeas/components/rssaggregator/web/RSSResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityOfUsersResource.javaeditcommunity/community-war/src/main/java/org/silverpeas/components/community/web/CommunityMembershipResource.javaeditpom.xmleditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javaeditcomponents-restapi/pom.xmldeletecomponents-restapi/src/main/java/org/silverpeas/components/restapi/CommonResponsesFilter.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditquestionReply/questionReply-war/src/main/java/org/silverpeas/components/questionreply/web/ReplyResource.javaeditquickinfo/quickinfo-war/src/main/java/org/silverpeas/components/quickinfo/web/NewsResource.javaeditsuggestionBox/suggestionBox-war/src/main/java/org/silverpeas/components/suggestionbox/web/SuggestionBoxResource.javadeletecomponents-restapi/src/main/java/org/silverpeas/components/restapi/JaxbAwareModelResolver.javaeditgallery/gallery-war/src/main/java/org/silverpeas/components/gallery/web/GalleryResource.java
- components-restapi/pom.xml9d3490bf7cd64723cdac38d15472d03679bb89501790597554000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comOpt in the stripping of the Maven site
The strip-maven-site execution of the parent POM is now skipped by default: it
used to apply to every project inheriting from that POM and wiped out the Maven
site such a project publishes. This module publishes the documentation of the
REST API and nothing else, so it asks for the execution by setting
strip.maven.site.skip to false.
2026-09-28 14:12:34 +02009d3490bf7cd64723cdac38d15472d03679bb8950Opt in the stripping of the Maven siteeditcomponents-restapi/pom.xml
- forums/forums-war/src/main/webapp/forums/jsp/modifyMessage.jspforums/forums-war/src/main/webapp/forums/jsp/viewMessage.jspforums/forums-war/src/main/webapp/forums/jsp/editMessageKeywords.jsp3b4d732f0a1b27af91286d6a8bf01e77d8d3bde21790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1460
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The title and the body of a forum message were printed raw by JSP scriptlets on
the thread page, so any script posted by a user of the forum was run in the
browser of every user reading it.
The title is now HTML encoded on output, as the other JSPs of the component
already do through WebEncodeHelper. Two other raw outputs of the title, which
the report doesn't mention, are encoded as well: the one of modifyMessage.jsp,
where the title lands in the value attribute of an input and is hence
exploitable by escaping that attribute, and the one of editMessageKeywords.jsp.
The body is sanitized by the applySanitizeForRenderingDirective directive
introduced in Silverpeas-Core for the vulnerability #1459, which drops what can
act on the visitor's browser while keeping the content as it is.
Note the report also states the title pollutes the title element of the page.
It does appear there, but viewMessage.jsp already prints it through a c:out tag,
so it is encoded and isn't a vector.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit ea479b045468c5015e93e8b6c0924b919f8e4f32)
2026-09-28 14:43:22 +02003b4d732f0a1b27af91286d6a8bf01e77d8d3bde2Fix vulnerability #1460editforums/forums-war/src/main/webapp/forums/jsp/viewMessage.jspeditforums/forums-war/src/main/webapp/forums/jsp/editMessageKeywords.jspeditforums/forums-war/src/main/webapp/forums/jsp/modifyMessage.jsp
- gallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javagallery/gallery-library/src/test/java/org/silverpeas/components/gallery/WatermarkTest.javab0d04438a605a666ee748f7c6ca310fef0ff6a4a1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1461
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The image of a watermark is an instance parameter any manager of the space
holding the gallery can set, and the server requests it as it is, at each media
creation. It could hence be pointed at a service the server keeps for itself.
Such an URL is now verified before being requested: only the HTTP and HTTPS
schemes are handled, and the host must resolve to neither a loopback nor a
link-local address, so that neither the services bound to the server itself nor
the metadata endpoint of a cloud provider can be reached. Every address the host
resolves to is verified, otherwise a host resolving to a forbidden address
beside an allowed one would go through.
The addresses of the private networks of an organization remain reachable on
purpose: they are where the internal resources of an intranet legitimately live,
and no address range can tell them from the internal services one would rather
protect. Only an explicit list of allowed hosts could, which is left to a
further decision.
The request is besides given a timeout and its response is no longer copied
without any bound, both being able to exhaust the resources of the server, and
the redirections are no longer followed as they would escape the verification
above.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 83864c0f72b6c5f62a1afdf2cb420f8b62840f20)
2026-09-28 14:43:22 +0200b0d04438a605a666ee748f7c6ca310fef0ff6a4aFix vulnerability #1461addgallery/gallery-library/src/test/java/org/silverpeas/components/gallery/WatermarkTest.javaeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.java
- infoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/previewLetter.jspinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/headerLetter.jspinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java03b14dd2f030f634a99944c3272b31500811242f1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1462 and secure the other writings of the newsletter
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
Publishing an issue of a newsletter changes its state, stamps its publication
date, notifies the subscribers and mails the external ones. It was requested by
a GET, and the synchronizer token is required on a GET only when its URL holds
one of a few keywords, which ValidateParution holds none of. Any logged user
lured into a cross-site visit was hence publishing the issue as themselves.
The publication is now submitted by POST, on which the token is required
whatever the URL, through the formRequest facility which stamps it.
Moreover the endpoint had no role check at all, so any reader of the newsletter
was able to publish an issue and to trigger the mailing, with no luring needed.
Only its publishers and its managers can do so now.
Three other writings, which the report doesn't mention, were exposed the same
way and are secured likewise:
- resetting the content of an issue with its template, which overwrites the
content being written;
- mailing an issue to oneself and to the managers, which sends the content of an
issue not published yet and was hence a way for any reader to get a draft.
As EditContent also serves the edition itself, a mere navigation which remains a
GET, the reset is explicitly refused when it isn't requested by POST: submitting
it by POST would otherwise protect nothing, the previous URL remaining
requestable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 4bd5e04d16207d889d2b271eed87fa1962fa8ab5)
2026-09-28 14:43:22 +020003b14dd2f030f634a99944c3272b31500811242fFix vulnerability #1462 and secure the other writings of the newslettereditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/headerLetter.jspeditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/previewLetter.jspeditinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java
- infoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterUser.jspinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterAdmin.jspinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java0b6076009ffb133c105e4861267e1cda62176d781790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerabilities #1463
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
The operations on the issues themselves were exposed the same way and are
secured likewise: creating and modifying an issue, and modifying the headers of
the newsletter, were requestable by a GET although their forms are submitted by
POST, the router not caring about the method.
None of the operations of this router had any role check, so any reader was able
to write the content of an issue, to modify the headers of the newsletter, to
delete issues and to read the ones being written. They are now reserved to the
publishers and to the managers, but for the ones on the template and the
deletion of several issues at once, reserved to the managers.
Reading the inlined CSS rendering of an issue is how the readers get it from the
list, so the criterion there isn't the role but the issue itself: it is refused
to them as long as it isn't published.
(cherry picked from commit e455edb9286b8b429cbb7fc1c54de6f75ead8dfd)
2026-09-28 14:43:22 +02000b6076009ffb133c105e4861267e1cda62176d78Fix vulnerabilities #1463editinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterUser.jspeditinfoLetter/infoLetter-war/src/main/webapp/infoLetter/jsp/listLetterAdmin.jspeditinfoLetter/infoLetter-war/src/main/java/org/silverpeas/components/infoletter/servlets/InfoLetterRequestRouter.java
- kmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationLinksManager.jspkmelia/kmelia-war/src/main/webapp/kmelia/jsp/basket.jspkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/ajax/AjaxOperation.javakmelia/kmelia-war/src/main/webapp/kmelia/jsp/orderTopics.jspkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javadbb4f8e6ae7b2f71c500e2457c9a7cb299fa12dc1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #1464
(GitHub issue of Silverpeas-Core, reported against 6.4.6)
Loading publications into the clipboard and pasting them under another topic
were requestable by a GET, so any logged user lured into a cross-site visit was
moving publications as themselves.
The AJAX servlet of kmelia answers the GET as the POST, and none of its URLs
holds any of the keywords making the synchronizer token required on a GET. So
none of its operations was protected, including the deletion of publications
which the report takes as protected: its URL does hold the delete keyword, but
the rule applied to this servlet requires in addition the path to hold /jsp/,
which the path of a servlet doesn't.
The operations only reading something are now listed apart, every other one
being taken as writing something so that adding an operation doesn't expose it
by mistake, and a writing operation requested by a GET is refused. That refusal
is performed before the processing, whose catch-all would swallow it.
The user interface already submitted by POST the operations the report points
at, as well as the deletion, the copy and the move of publications: what made
the attack possible is the servlet accepting the GET. Three operations were
still requested by a GET and are now submitted by POST: sorting the topics,
emptying the trash from the basket, and binding a publication to another one.
(cherry picked from commit 9d1faf9ba0366440299b0907b00a0ab5397f5bdd)
2026-09-28 14:43:22 +0200dbb4f8e6ae7b2f71c500e2457c9a7cb299fa12dcFix vulnerability #1464editkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javaeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/orderTopics.jspeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/basket.jspeditkmelia/kmelia-war/src/main/webapp/kmelia/jsp/publicationLinksManager.jspeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/ajax/AjaxOperation.java
- kmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javakmelia/kmelia-war/pom.xmlkmelia/kmelia-war/src/test/java/org/silverpeas/components/kmelia/web/KmeliaResourceTest.javaf371b6452d9360af47926ebccceba45e05d252ca1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comFix vulnerability #939
(GitHub issue of Silverpeas-Components, reported against 6.4.6)
Updating a publication was granted against the component instance referred by
the URL, whereas the publication to update was entirely defined by the request
body, which carries both its identifier and its component instance. Any user
could hence rewrite the metadata of any publication of the platform by referring
it in the body, the identifiers being enumerable.
The publication is now refused when it doesn't belong to the instance the
authorization has been checked against. Note the report states a WRITER role is
required: it is not, the authorization of the REST framework only validating the
access to the instance whatever the role played in it, so the exposure was wider
than reported. Writing a publication, be it created or updated, now requires
that role indeed.
KmeliaResourceTest covers the checks. The war had no test at all, hence the
test dependency added to its POM.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 1d8ec7ee0a903b041ffac54b022319ff099b12ce)
2026-09-28 14:43:22 +0200f371b6452d9360af47926ebccceba45e05d252caFix vulnerability #939editkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/web/KmeliaResource.javaeditkmelia/kmelia-war/pom.xmladdkmelia/kmelia-war/src/test/java/org/silverpeas/components/kmelia/web/KmeliaResourceTest.java
- delegatednews/delegatednews-war/src/test/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResourceTest.javadelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.javabb7f36a57f96d33b8bd92d826056770e3c14e04c1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comReserve the management of the delegated news to the managers
Modifying and deleting the delegated news is reserved to the managers of the
application, as its user interface applies on its side. The REST service was
granted against a mere access to the component instance, whatever the role
played in it, so any of its users was able to reorder and to delete them by
requesting it directly.
Found while auditing the other REST resources against the flaw reported by the
issue #939 of this repository.
ListDelegatedNewsResourceTest covers the check.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e4271c328772c51f400cbeab7eeb6f7fb2876721)
2026-09-28 14:43:22 +0200bb7f36a57f96d33b8bd92d826056770e3c14e04cReserve the management of the delegated news to the managersadddelegatednews/delegatednews-war/src/test/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResourceTest.javaeditdelegatednews/delegatednews-war/src/main/java/org/silverpeas/components/delegatednews/web/ListDelegatedNewsResource.java
- gallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javakmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.javaeca5145d6d01f77adce83ef714742073585675ca1790599402000https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonmiguel.moquillon@gmail.comTake into account sonarcloud feedback
2026-09-28 14:43:22 +0200eca5145d6d01f77adce83ef714742073585675caTake into account sonarcloud feedbackeditgallery/gallery-library/src/main/java/org/silverpeas/components/gallery/Watermark.javaeditkmelia/kmelia-war/src/main/java/org/silverpeas/components/kmelia/servlets/AjaxServlet.java
githttps://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse1163https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1163/SKIP_TESTfalseSKIP_QUALITYfalseDémarré par l'utilisateur Miguel MoquillonmmoquillonMiguel Moquillon116256f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/master56f5661a313b8828cac18f92b68f2f116fbd2cc256f5661a313b8828cac18f92b68f2f116fbd2cc2refs/remotes/origin/masterhttps://github.com/Silverpeas/Jenkins-Pipelines.git26196a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube96a3a41e61a0a59a294dd74fce10884c559e77f496a3a41e61a0a59a294dd74fce10884c559e77f4refs/remotes/origin/sonarqube1162969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/master969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/master969e2118e87aad06e5a036b5cec76d30c7e30867969e2118e87aad06e5a036b5cec76d30c7e30867refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Core1162d68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterd68cf30b72373be33de0696997667755117f3fb6d68cf30b72373be33de0696997667755117f3fb6refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Components11623371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/master3371d6a08cdacadc5573189be43a2d6beaff54373371d6a08cdacadc5573189be43a2d6beaff5437refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Looks1162ba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterba454f4f93b74cf8e576d2a33606dc23d5431702ba454f4f93b74cf8e576d2a33606dc23d5431702refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Setup11620c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/master0c4cdcb02f8e0a964f759187b9cfdfa8870d806b0c4cdcb02f8e0a964f759187b9cfdfa8870d806brefs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Distribution11627b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/master7b2e624fce9db2e795b6e3d50485622b4024aa167b2e624fce9db2e795b6e3d50485622b4024aa16refs/remotes/origin/masterhttps://github.com/Silverpeas/Silverpeas-Assemblyfalse#1162313550010550775Silverpeas_Master_AutoDeploy #11621162false116263310FAILURE1790584035065https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1162/https://integration.silverpeas.org/jenkins/user/mmoquillonMiguel Moquillonfalse1163https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1163/1161https://integration.silverpeas.org/jenkins/job/Silverpeas_Master_AutoDeploy/1161/1165SKIP_TESTfalseFlag indicating if the execution of the tests should be skippedSKIP_TESTBooleanParameterDefinitionSKIP_QUALITYfalseIndicates whether the code quality analysis have to be skippedSKIP_QUALITYBooleanParameterDefinitiontruefalsefalsefalse