[maven-release-plugin][skip ci] prepare release 23.7.0.1

MNT-25359 Validating and Sanitizing the comment before posting (#3615 )
MNT-25359 Validating and Sanitizing the comment before posting to prevent any XSS attack
2025-10-22 15:12:38 +00:00 · 2025-10-19 04:45:22 +00:00 · 2025-10-17 21:00:11 +05:30 · 2025-10-10 11:19:17 +02:00 · 2025-10-09 16:41:21 +00:00 · 2025-10-09 16:41:20 +00:00
30 changed files with 118 additions and 92 deletions
--- a/amps/ags/pom.xml
+++ b/amps/ags/pom.xml
@@ -7,7 +7,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-community-repo-amps</artifactId>
-      <version>23.6.0.24</version>
+      <version>23.7.0.1</version>
   </parent>

   <modules>
--- a/amps/ags/rm-automation/pom.xml
+++ b/amps/ags/rm-automation/pom.xml
@@ -7,7 +7,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>23.6.0.24</version>
+      <version>23.7.0.1</version>
   </parent>

   <modules>
--- a/amps/ags/rm-automation/rm-automation-community-rest-api/pom.xml
+++ b/amps/ags/rm-automation/rm-automation-community-rest-api/pom.xml
@@ -7,7 +7,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-governance-services-automation-community-repo</artifactId>
-      <version>23.6.0.24</version>
+      <version>23.7.0.1</version>
   </parent>

   <build>
--- a/amps/ags/rm-community/pom.xml
+++ b/amps/ags/rm-community/pom.xml
@@ -7,7 +7,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-governance-services-community-parent</artifactId>
-      <version>23.6.0.24</version>
+      <version>23.7.0.1</version>
   </parent>

   <modules>
--- a/amps/ags/rm-community/rm-community-repo/.env
+++ b/amps/ags/rm-community/rm-community-repo/.env
@@ -1,3 +1,3 @@
-SOLR6_TAG=2.0.13
+SOLR6_TAG=2.0.17
 POSTGRES_TAG=15.4
 ACTIVEMQ_TAG=5.18.3-jre17-rockylinux8
--- a/amps/ags/rm-community/rm-community-repo/pom.xml
+++ b/amps/ags/rm-community/rm-community-repo/pom.xml
@@ -8,7 +8,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-      <version>23.6.0.24</version>
+      <version>23.7.0.1</version>
   </parent>

   <properties>
--- a/amps/ags/rm-community/rm-community-repo/test/resources/alfresco/version.properties
+++ b/amps/ags/rm-community/rm-community-repo/test/resources/alfresco/version.properties
@@ -4,7 +4,7 @@

 # Version label
 version.major=23
-version.minor=6
+version.minor=7
 version.revision=0
 version.label=

--- a/amps/ags/rm-community/rm-community-rest-api-explorer/pom.xml
+++ b/amps/ags/rm-community/rm-community-rest-api-explorer/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-governance-services-community-repo-parent</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <build>
--- a/amps/pom.xml
+++ b/amps/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <modules>
--- a/amps/share-services/pom.xml
+++ b/amps/share-services/pom.xml
@@ -8,7 +8,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-amps</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <properties>
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -7,7 +7,7 @@
   <parent>
      <groupId>org.alfresco</groupId>
      <artifactId>alfresco-community-repo</artifactId>
-      <version>23.6.0.24</version>
+      <version>23.7.0.1</version>
   </parent>

   <dependencies>
--- a/data-model/pom.xml
+++ b/data-model/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <properties>
--- a/mmt/pom.xml
+++ b/mmt/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <dependencies>
--- a/packaging/distribution/pom.xml
+++ b/packaging/distribution/pom.xml
@@ -9,6 +9,6 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>
 </project>
--- a/packaging/docker-alfresco/pom.xml
+++ b/packaging/docker-alfresco/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <properties>
--- a/packaging/pom.xml
+++ b/packaging/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <modules>
--- a/packaging/tests/environment/.env
+++ b/packaging/tests/environment/.env
@@ -1,3 +1,3 @@
-SOLR6_TAG=2.0.13
+SOLR6_TAG=2.0.17
 POSTGRES_TAG=15.4
 ACTIVEMQ_TAG=5.18.3-jre17-rockylinux8
--- a/packaging/tests/pom.xml
+++ b/packaging/tests/pom.xml
@@ -6,7 +6,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <modules>
--- a/packaging/tests/tas-cmis/pom.xml
+++ b/packaging/tests/tas-cmis/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <organization>
--- a/packaging/tests/tas-email/pom.xml
+++ b/packaging/tests/tas-email/pom.xml
@@ -9,7 +9,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <developers>
--- a/packaging/tests/tas-integration/pom.xml
+++ b/packaging/tests/tas-integration/pom.xml
@@ -9,7 +9,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <developers>
--- a/packaging/tests/tas-restapi/pom.xml
+++ b/packaging/tests/tas-restapi/pom.xml
@@ -8,7 +8,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <properties>
--- a/packaging/tests/tas-webdav/pom.xml
+++ b/packaging/tests/tas-webdav/pom.xml
@@ -9,7 +9,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-tests</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <developers>
--- a/packaging/war/pom.xml
+++ b/packaging/war/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo-packaging</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <properties>
--- a/pom.xml
+++ b/pom.xml
@@ -2,7 +2,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <artifactId>alfresco-community-repo</artifactId>
-    <version>23.6.0.24</version>
+    <version>23.7.0.1</version>
    <packaging>pom</packaging>
    <name>Alfresco Community Repo Parent</name>

@@ -24,7 +24,7 @@

    <properties>
        <acs.version.major>23</acs.version.major>
-        <acs.version.minor>6</acs.version.minor>
+        <acs.version.minor>7</acs.version.minor>
        <acs.version.revision>0</acs.version.revision>
        <acs.version.label />
        <amp.min.version>${acs.version.major}.0.0</amp.min.version>
@@ -51,14 +51,14 @@
        <dependency.alfresco-server-root.version>7.0.1</dependency.alfresco-server-root.version>
        <dependency.activiti-engine.version>5.23.0</dependency.activiti-engine.version>
        <dependency.activiti.version>5.23.0</dependency.activiti.version>
-        <dependency.alfresco-transform-core.version>5.2.2-A.4</dependency.alfresco-transform-core.version>
-        <dependency.alfresco-transform-service.version>4.2.2-A.2</dependency.alfresco-transform-service.version>
+        <dependency.alfresco-transform-core.version>5.2.2</dependency.alfresco-transform-core.version>
+        <dependency.alfresco-transform-service.version>4.2.2</dependency.alfresco-transform-service.version>
        <dependency.alfresco-greenmail.version>7.0</dependency.alfresco-greenmail.version>
        <dependency.acs-event-model.version>0.0.33</dependency.acs-event-model.version>

        <dependency.aspectj.version>1.9.22.1</dependency.aspectj.version>
-        <dependency.spring.version>6.2.8</dependency.spring.version>
-        <dependency.spring-security.version>6.3.9</dependency.spring-security.version>
+        <dependency.spring.version>6.2.11</dependency.spring.version>
+        <dependency.spring-security.version>6.4.11</dependency.spring-security.version>
        <dependency.antlr.version>3.5.3</dependency.antlr.version>
        <dependency.jackson.version>2.17.2</dependency.jackson.version>
        <dependency.cxf.version>4.1.2</dependency.cxf.version>
@@ -113,7 +113,7 @@
        <dependency.jakarta-json-path.version>2.9.0</dependency.jakarta-json-path.version>
        <dependency.json-smart.version>2.5.2</dependency.json-smart.version>
        <alfresco.googledrive.version>4.1.0</alfresco.googledrive.version>
-        <alfresco.aos-module.version>3.3.0</alfresco.aos-module.version>
+        <alfresco.aos-module.version>3.4.0</alfresco.aos-module.version>
        <alfresco.api-explorer.version>23.4.0</alfresco.api-explorer.version> <!-- Also in alfresco-enterprise-share -->

        <alfresco.maven-plugin.version>2.2.0</alfresco.maven-plugin.version>
@@ -154,7 +154,7 @@
        <connection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</connection>
        <developerConnection>scm:git:https://github.com/Alfresco/alfresco-community-repo.git</developerConnection>
        <url>https://github.com/Alfresco/alfresco-community-repo</url>
-        <tag>23.6.0.24</tag>
+        <tag>23.7.0.1</tag>
    </scm>

    <distributionManagement>
--- a/remote-api/pom.xml
+++ b/remote-api/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <dependencies>
--- a/remote-api/src/main/java/org/alfresco/repo/web/scripts/comments/CommentsPost.java
+++ b/remote-api/src/main/java/org/alfresco/repo/web/scripts/comments/CommentsPost.java
@@ -2,7 +2,7 @@
 * #%L
 * Alfresco Remote API
 * %%
- * Copyright (C) 2005 - 2016 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
 * %%
 * This file is part of the Alfresco software. 
 * If the software was purchased under a paid Alfresco license, the terms of 
@@ -31,6 +31,14 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;

+import org.apache.commons.lang3.StringUtils;
+import org.json.simple.JSONObject;
+import org.owasp.html.PolicyFactory;
+import org.owasp.html.Sanitizers;
+import org.springframework.extensions.webscripts.Cache;
+import org.springframework.extensions.webscripts.Status;
+import org.springframework.extensions.webscripts.WebScriptRequest;
+
 import org.alfresco.model.ContentModel;
 import org.alfresco.model.ForumModel;
 import org.alfresco.repo.content.MimetypeMap;
@@ -44,10 +52,6 @@ import org.alfresco.service.cmr.security.PermissionService;
 import org.alfresco.service.namespace.NamespaceService;
 import org.alfresco.service.namespace.QName;
 import org.alfresco.service.namespace.RegexQNamePattern;
-import org.json.simple.JSONObject;
-import org.springframework.extensions.webscripts.Cache;
-import org.springframework.extensions.webscripts.Status;
-import org.springframework.extensions.webscripts.WebScriptRequest;

 /**
 * This class is the controller for the comments.post web script.
@@ -66,6 +70,19 @@ public class CommentsPost extends AbstractCommentsWebScript
        // get json object from request
        JSONObject json = parseJSON(req);

+        // Validating and Sanitizing comment content to prevent XSS
+        String commentContent = getOrNull(json, "content");
+        if (StringUtils.isBlank(commentContent))
+        {
+            throw new IllegalArgumentException("Comment content must not be empty");
+        }
+        else
+        {
+            PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
+            String safeContent = policy.sanitize(commentContent);
+            json.replace("content", safeContent);
+        }
+
        /* MNT-10231, MNT-9771 fix */
        this.behaviourFilter.disableBehaviour(nodeRef, ContentModel.ASPECT_AUDITABLE);

@@ -229,8 +246,7 @@ public class CommentsPost extends AbstractCommentsWebScript
     */
    private NodeRef createCommentsFolder(final NodeRef nodeRef)
    {
-        NodeRef commentsFolder = AuthenticationUtil.runAs(new AuthenticationUtil.RunAsWork<NodeRef>()
-        {
+        NodeRef commentsFolder = AuthenticationUtil.runAs(new AuthenticationUtil.RunAsWork<NodeRef>() {
            public NodeRef doWork() throws Exception
            {
                NodeRef commentsFolder = null;
--- a/repository/pom.xml
+++ b/repository/pom.xml
@@ -7,7 +7,7 @@
    <parent>
        <groupId>org.alfresco</groupId>
        <artifactId>alfresco-community-repo</artifactId>
-        <version>23.6.0.24</version>
+        <version>23.7.0.1</version>
    </parent>

    <dependencies>
--- a/repository/src/main/java/org/alfresco/repo/event2/EventConsolidator.java
+++ b/repository/src/main/java/org/alfresco/repo/event2/EventConsolidator.java
@@ -2,7 +2,7 @@
 * #%L
 * Alfresco Repository
 * %%
- * Copyright (C) 2005 - 2023 Alfresco Software Limited
+ * Copyright (C) 2005 - 2025 Alfresco Software Limited
 * %%
 * This file is part of the Alfresco software.
 * If the software was purchased under a paid Alfresco license, the terms of
@@ -39,8 +39,10 @@ import org.alfresco.service.namespace.QName;
 /**
 * Encapsulates events occurred in a single transaction.
 *
- * @param <REF> entity (e.g. node, child association, peer association) reference type
- * @param <RES> entity resource type
+ * @param <REF>
+ *            entity (e.g. node, child association, peer association) reference type
+ * @param <RES>
+ *            entity resource type
 */
 public abstract class EventConsolidator<REF extends EntityRef, RES extends Resource>
 {
@@ -90,23 +92,31 @@ public abstract class EventConsolidator<REF extends EntityRef, RES extends Resou
    /**
     * Builds and returns the {@link RepoEvent} instance.
     *
-     * @param eventInfo the object holding the event information
+     * @param eventInfo
+     *            the object holding the event information
     * @return the {@link RepoEvent} instance
     */
    public RepoEvent<DataAttributes<RES>> getRepoEvent(EventInfo eventInfo)
+    {
+        final RepoEvent.Builder<DataAttributes<RES>> builder = RepoEvent.builder();
+
+        configureRepoEventBuilder(builder, eventInfo);
+
+        return builder.build();
+    }
+
+    protected void configureRepoEventBuilder(RepoEvent.Builder<DataAttributes<RES>> builder, EventInfo eventInfo)
    {
        EventType eventType = getDerivedEvent();

        DataAttributes<RES> eventData = buildEventData(eventInfo, resource, eventType);

-        return RepoEvent.<DataAttributes<RES>>builder()
-            .setId(eventInfo.getId())
+        builder.setId(eventInfo.getId())
                .setSource(eventInfo.getSource())
                .setTime(eventInfo.getTimestamp())
                .setType(eventType.getType())
                .setData(eventData)
-            .setDataschema(EventJSONSchema.getSchemaV1(eventType))
-            .build();
+                .setDataschema(EventJSONSchema.getSchemaV1(eventType));
    }

    /**
--- a/repository/src/main/resources/alfresco/repository.properties
+++ b/repository/src/main/resources/alfresco/repository.properties
@@ -3,7 +3,7 @@
 repository.name=Main Repository

 # Schema number
-version.schema=19500
+version.schema=19600

 # Directory configuration
Author	SHA1	Message	Date
alfresco-build	dfa94fbe21	[maven-release-plugin][skip ci] prepare release 23.7.0.1	2025-10-19 04:45:22 +00:00
Somnath-Deshmukh	4a93aec66b	MNT-25359 Validating and Sanitizing the comment before posting (#3615 ) MNT-25359 Validating and Sanitizing the comment before posting to prevent any XSS attack	2025-10-17 21:00:11 +05:30
Jakub Kochman	3f0bbc9844	Updating release/23.N branch to 23.7.0 after 23.6.0 ACS release [skip ci]	2025-10-10 11:19:17 +02:00
alfresco-build	cb9ad42101	[maven-release-plugin][skip ci] prepare for next development iteration	2025-10-09 16:41:21 +00:00
alfresco-build	ca385b3bbc	[maven-release-plugin][skip ci] prepare release 23.6.0.33	2025-10-09 16:41:20 +00:00
Kacper Magdziarz	19c1582f1e	[ACS-10423] Bump IE/SS to 2.0.17 (#3612 )	2025-10-09 17:38:42 +02:00
alfresco-build	06a918b082	[maven-release-plugin][skip ci] prepare for next development iteration	2025-10-09 13:44:28 +00:00
alfresco-build	f543de9959	[maven-release-plugin][skip ci] prepare release 23.6.0.32	2025-10-09 13:44:26 +00:00
Debjit Chattopadhyay	8124279e6a	Merge pull request #3610 from Alfresco/fix/revert_MNT_24776 Revert "MNT-24776 adding if-else conditionals to avoid null values"	2025-10-09 18:27:59 +05:30
Debjit Chattopadhyay	4281fd5b2d	Revert "MNT-24776 adding if-else conditionals to avoid null values" This reverts commit `393b064918`.	2025-10-09 18:14:50 +05:30
alfresco-build	d10d88306b	[maven-release-plugin][skip ci] prepare for next development iteration	2025-10-09 10:12:06 +00:00
alfresco-build	1d7a37cd8c	[maven-release-plugin][skip ci] prepare release 23.6.0.31	2025-10-09 10:12:04 +00:00
Debjit Chattopadhyay	4bcb795452	Merge pull request #3609 from Alfresco/fix/MNT-24776_backport_to_23.N MNT-24776 backport to release/23.N	2025-10-09 14:34:25 +05:30
Debjit Chattopadhyay	393b064918	MNT-24776 adding if-else conditionals to avoid null values (cherry picked from commit `be02be5a8b`)	2025-10-09 13:29:30 +05:30
alfresco-build	f741f2ca45	[maven-release-plugin][skip ci] prepare for next development iteration	2025-10-08 15:59:31 +00:00
alfresco-build	ef676f11e4	[maven-release-plugin][skip ci] prepare release 23.6.0.30	2025-10-08 15:59:29 +00:00
cezary-witkowski	478c81fee3	[ACS-10454] Bump AOS to fix "Edit in Microsoft Office" error (#3606 )	2025-10-08 16:57:01 +02:00
alfresco-build	cf9cc8042d	[maven-release-plugin][skip ci] prepare for next development iteration	2025-10-06 13:25:18 +00:00
alfresco-build	8d790ed1cb	[maven-release-plugin][skip ci] prepare release 23.6.0.29	2025-10-06 13:25:16 +00:00
cezary-witkowski	87c7bd2877	[ACS-10454] Bump AOS to fix "Edit in Microsoft Office" error (#3602 )	2025-10-06 14:16:10 +02:00
alfresco-build	9125f889b0	[maven-release-plugin][skip ci] prepare for next development iteration	2025-10-03 11:40:58 +00:00
alfresco-build	2fb74d2691	[maven-release-plugin][skip ci] prepare release 23.6.0.28	2025-10-03 11:40:56 +00:00
Gerard Olenski	d671162dae	ACS-10427 Bump ATS 4.2.2 (#3601 )	2025-10-03 12:54:03 +02:00
alfresco-build	bfaa629da7	[maven-release-plugin][skip ci] prepare for next development iteration	2025-09-26 17:19:48 +00:00
alfresco-build	719d73a558	[maven-release-plugin][skip ci] prepare release 23.6.0.27	2025-09-26 17:19:46 +00:00
Piotr Żurek	a2aa867f3f	ACS-9665 Fix formatting	2025-09-26 18:34:04 +02:00
Piotr Żurek	8d745c536a	Cherry pick ACS-9665 add event generation extensions (#3593 ) `280a873cb6` Piotr Żurek <Piotr.Zurek@hyland.com> 26 Sep 2025 at 10:25	2025-09-26 18:25:10 +02:00
alfresco-build	b0f4c21ae3	[maven-release-plugin][skip ci] prepare for next development iteration	2025-09-26 12:31:24 +00:00
alfresco-build	72494e34fa	[maven-release-plugin][skip ci] prepare release 23.6.0.26	2025-09-26 12:31:22 +00:00
Tiago Salvado	792b7024ea	[ACS-9940] Bump spring security version to 6.4.11 (#3592 ) (#3594 )	2025-09-26 12:44:25 +01:00
alfresco-build	40a1371f0d	[maven-release-plugin][skip ci] prepare for next development iteration	2025-09-25 20:52:06 +00:00
alfresco-build	c22c47e63f	[maven-release-plugin][skip ci] prepare release 23.6.0.25	2025-09-25 20:52:03 +00:00
Tiago Salvado	232299d42d	[ACS-10155] Bump spring version to 6.2.11 (#3589 ) (#3591 )	2025-09-25 21:04:30 +01:00
alfresco-build	aca7969849	[maven-release-plugin][skip ci] prepare for next development iteration	2025-09-25 10:22:26 +00:00