This is an automated email from the ASF dual-hosted git repository.
solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git
The following commit(s) were added to refs/heads/master by this push:
new 3a9dd6845 Documentation: security model is published
3a9dd6845 is described below
commit 3a9dd68454e7126aa83be6e6a6250938ce4e365d
Author: Maxim Solodovnik <[email protected]>
AuthorDate: Tue Oct 6 10:45:23 2026 +0700
Documentation: security model is published
---
openmeetings-server/src/site/xdoc/security.xml | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/openmeetings-server/src/site/xdoc/security.xml
b/openmeetings-server/src/site/xdoc/security.xml
index fab90468b..0c87c2afe 100644
--- a/openmeetings-server/src/site/xdoc/security.xml
+++ b/openmeetings-server/src/site/xdoc/security.xml
@@ -21,6 +21,17 @@
</properties>
<body>
+ <section name="Security Model">
+ <ul>
+ <li>All WYSIWYG fields in OM are being
sanitized at <code><a
href="https://github.com/wicketstuff/core/blob/master/wicketstuff-jquery-ui-parent/wicketstuff-jquery-ui-plugins/src/main/java/org/wicketstuff/jquery/ui/plugins/wysiwyg/WysiwygEditor.java#L122";>WysiwygEditor.java</a></code></li>
+ <li>Users with roles <code>ADMIN</code>,
+ <code>ADMIN_CONFIG</code>,
+ <code>ADMIN_CONNECTIONS</code>,
+ <code>ADMIN_BACKUP</code>,
+ <code>SOAP</code> are considered trusted
+ </li>
+ </ul>
+ </section>
<section name="Security Vulnerabilities">
<p>Please note that binary patches are not produced for
individual vulnerabilities. To obtain the
binary fix for a particular vulnerability you
should upgrade to an Apache OpenMeetings version
