Originally the projectdoc Toolbox was designed for small teams of developers where the team had full access to the server. Therefore making use cases possible had been the main concern at first. So we were for instance allowing any protocol for a HTTP request to enable the team to access their ressource. This has changed since larger companies started to use the projectdoc Toolbox for the information architecture.

As a preparation step for data center support this release removes a couple of security related issues. The attacker needed to have write access privileges to pages to take advantage of these issues.

To not break existing API this version introduces strict HTML rendering as a feature required to actively turned on. In the next major version this feature is activated by default.

The following issues fall into this category.

Query parameters may specify complex templates to render property values. To store these templates in one location as a space property, the macro parameters 'select', 'where', and 'sort-by' (for instance of the

Simply introduce the parameter value with the paragraph sign (§) and then add the name of the space property that defines the template.

Note that the template may be formatted with the Confluence editor. For instance to set a property in italics or add a line break.

See

The 

Dynamic links may loose the target document involuntarily. These issues are hard to detect. To help users to find and fix these issues this version of the projectdoc Toolbox adds the following improvements and features.

We encountered HTML encoding issues with the rendering of space properties. 

Originally the space properties where intended to be plain text properties to be used as variables for matching only. This simple concept has been abandoned a long time ago. Today a space property may contain any HTML fragment. With

We are working to get the data center compatibility approval of Atlassian for the projectdoc Toolbox.

We plan to provide the data center version by the end of 2021. In summer we will release version 5.0 of the projectdoc Toolbox that will require to update the database tables. This may come inconvenient since this will require to recalculate the document entries in these tables. For instance with a large number of projectdoc documents we recommend to check the upgrade in a test instance to estimate how long the table update will take.

To prepare your installation for this version we recommend to set system property de.smartics.projectdoc.security.strictHtmlEncoding to true. This will require to use the new template references for complex select templates where HTML code is required for rendering.

Please refer to