• last updated 19 hours ago
Constraints: committers
Constraints: files
Constraints: dates
improved error message

make clear, what the name and what the item_id in the message are

    • -2
    • +2
use new path xowiki/lib/portlets/ instead of .../www/...

    • -3
    • +4
comment method

Deactivated script-dynamic again

activating "script-dynamic" for script-src prevents resources as the following from loading

<script type="text/javascript" src="/resources/xowiki/bootstrap-treeview/1.2.0/bootstrap-treeview.min.js" nonce="F8843D5CD542FB1CDB4C94C5D13C4E5ECC2E1DCA">

improve test coverage of apm_* API

reduce verbosity

added test for checking documentation in regard of valid HTML markup

Test the behavior of the file-storage when a malicious user would try to store a pre-existing file on the server as its own

The fix for the file-storage is a simple validation to make sure that the tmpfile exists, however, for the generic case of the file widget, we cannot trust the tmpfile value when this was not generated by the server. This will probably cause regression when one wants to show a "preview" of a form, to be continued.

Whitespace cleanup

replace occurrences of <br/> in api doc strings

Properly escape "<" and ">" in api-doc documentation.

Since all documentation is rendered via HTML, the characters

"<" and ">" have to be HTML-quoted, otherwise strange things

(omission, unintended renderings) might occur.

E.g. the sentence

Define an interface between a page and an

ADP <include> similar to the page_contract.

was rendered as

Define an interface between a page and an

ADP similar to the page_contract.

which is incorrect.

Incorporate feedback from downstream penetration tests:

do not skip basic validation in the file widget when a tmpfile is not found in the request.

forum_id is actually optional here

Port of downstream hotfix: questions defined with an empty scoring might later fail the score calculations

One might consider preventing empty scores altogether via validation

improving rendering in api-doc

- fixed validity of HTML (missing <dd>)

- use


instead of


and other variants. This improves stylability.

Moved styling to site-master.css

properly quote tags when meant literally

Extend test depending on the setting of EmailForgottenPasswordP

Changed "db_multirow" to use "db_list_of_lists" instead of "db_list_of_ns_sets"

Thanks to the recent improvements in NaviServer for

"db_list_of_lists", it is more efficient to use this in "db_multirow"

(actually in "db_multirow_helper"). The implementation revealed a bug

in "db_list_of_lists", when both options "-columns_var" and

"-with_headers" were set.

Extended regression test to cover the former bug.

new proc "ad_log_deprecated": unified interface for logging deprecated usages

The existing code used a larger variety of different messages to

denote invocations of deprecated procs and other

artifacts. "ad_log_deprecated" provides a unified interface, and

provides a usage hint what to use instead based on the API-doc

definitions in the log-file.

    • -3
    • +3
    • -6
    • +8
    • -3
    • +2
    • -6
    • +9
Added Drag and Drop interface for feedback files

- When grading a student, feedback files can be added via drag and drop

- Caution was spent to avoid potentially slow refresh operations on

log exam protocols. All interactions use AJAX and update the

DOM tree directly

- The feedback files are displayed as thumbnails

- When permissions allow, the thumbnail files can be directly viewed and/or deleted

- Supports Bootstrap3 and Bootstrap 5

- Support for composite questions.

- bumped version number to 5.10.1d43

    • -55
    • +246
Fix missing variable, test the bug

preserve comments hinting to ad_apply and apply whitespace changes

rename "iconified file" to "thumbnail file"

    • -1
    • +57
Improved styling: use boostrap card component for rendering includelets

Extended functionality of the DropZone widget

- added parameters "label", "disposition" and "file_name_prefix"

for better configurability

- added support for updating the current page with feedback of the

dropped files. This is used e.g. by the online exam in the exam

protocol to display incrementally thumbnails of feedback files.

- change property "uploader" to "disposition", since "uploader" is

somewhat ambiguous. "Disposition" defines, what happens after the

file was uploaded, e.g. whether the content has to be transformed,


- bumped version number to 5.10.1d35

    • -3
    • +3
    • -24
    • +100
reduce verbosity

fix typo

use bootstrap table renderer inside includelets for bootstrap3 and bootstrap5

plain table renderer: use "thead" and "tbody" inside "table"