Second milestone of the XWiki Enterprise 2.5 version (Roadmap).

The highlights of this release are: support for viewing attached office documents in the wiki, an experimental Extension Manager, experimental CSRF protection, further improvements to the edit UI, more consistent use of user avatars, and an experimental xwiki/2.1 wiki syntax.

New and Noteworthy (since XWiki Enterprise 2.4)

Support for viewing attached office documents in the wiki

Experimental Extension Manager

Further improvements to the edit UI

More image manipulation settings

For a long time it was possible to scale attached images on the server, thus reducing the download time and ensuring consistent scaling of images across browsers. This is achieved by appending width and/or height query string parameters to the URL of the image. This feature has been further enhanced:

• It is now possible to force the same aspect ratio of the original picture even when both width/height parameters were used (the keepAspectRatio parameter).
• The size of the generated JPGs can be further tweaked by specifying an encoding quality (the configurable default is at 30%, but will be changed to 50% before the final release). This does not affect lossless image formats such as PNG.
• The WYSIWYG editor also supports the width and height parameters, setting them as needed when manually resizing the image in the editor.

Better handling of attachment versions when rolling back documents

Rolling back a document will also roll back the correct attachment version, including restoring a deleted attachment from the trash (if not manually deleted from there). Even if an attachment was deleted and re-uploaded several times, the platform will try to find the right version for the attachment, if it still exists in the attachment trash.

Experimental xwiki/2.1 wiki syntax

The xwiki wiki syntax sees further improvements as xwiki/2.1, still in an experimental stage. A new feature is an enhanced syntax for links, which is more generic and allows easier extensions with new link types, demonstrated in this release with support for interwiki links.

Basic syntax:

Document references are still the implicit default, with the explicit doc: reference type. The other standard reference types are url, mailto, attach, image, and the new interwiki.

Interwiki links

Basic syntax:

By default no sister wikis are defined. You can define some in xwiki.properties by adding rendering.interWikiDefinitions values:

Various Security improvements

Continuing a push for better security started this summer, 2.5M2 fixes some of the few remaining cross-site scripting and SQL injections holes, and tightens the scope of programming rights. Of particular concern:

• With a default skin, programming rights are no longer available after the main content of the page; this means that the panels and the bottom tabs can't use restricted APIs anymore.
• To explicitly drop programming rights, a new API method was introduced: $xcontext.dropPermissions()
• An experimental Cross-Site Request Forgery prevention mechanism is included, though not enabled by default. To enable it and test/upgrade your custom applications for compatibility, edit xwiki.properties and flip on the core.csrf.enabled setting.

Backward Compatibility and Migration Notes

General Notes

You may also want to import the default wiki XAR in order to benefit from the improvements listed above.

API Breakages

The following APIs were modified since XWiki Enterprise 2.4: