This is an automated email from the ASF dual-hosted git repository.
solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings-site.git
The following commit(s) were added to refs/heads/master by this push:
new dc75bba8 Documentation: security model is published
dc75bba8 is described below
commit dc75bba8a51c7fbeb27faf4164f2e111c7aa3d66
Author: Maxim Solodovnik <[email protected]>
AuthorDate: Tue Oct 6 11:15:27 2026 +0700
Documentation: security model is published
---
security.html | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/security.html b/security.html
index 67dfbfdb..bcdda8a3 100644
--- a/security.html
+++ b/security.html
@@ -168,6 +168,14 @@ Generated by Apache Maven Doxia 2.0.0-M19 2026-07-07
<li class="publish-date">Last Published: 2026-07-07</li>
</ol>
</nav>
+<section>
+ <a id="Security_Model"></a>
+ <h1 id="security-model">Security Model</h1>
+ <ul>
+ <li>All WYSIWYG fields in OM are being sanitized at <code><a
href="https://github.com/wicketstuff/core/blob/master/wicketstuff-jquery-ui-parent/wicketstuff-jquery-ui-plugins/src/main/java/org/wicketstuff/jquery/ui/plugins/wysiwyg/WysiwygEditor.java#L122";
class="externalLink">WysiwygEditor.java</a></code></li>
+ <li>Users with roles <code>ADMIN</code>, <code>ADMIN_CONFIG</code>,
<code>ADMIN_CONNECTIONS</code>, <code>ADMIN_BACKUP</code>, <code>SOAP</code>
are considered trusted</li>
+ </ul>
+</section>
<section>
<a id="Security_Vulnerabilities"></a>
<h1 id="security-vulnerabilities">Security Vulnerabilities</h1>
@@ -659,6 +667,7 @@ Generated by Apache Maven Doxia 2.0.0-M19 2026-07-07
<div id="m_toc_sidebar" class="d-print-none toc-sidebar-enabled
toc-sidebar-expanded toc-sidebar-autoexpandable toc-sidebar-fixed">
<nav id="m_toc_sidebar_nav" class="flex-column">
<ul class="nav--sidebar nav flex-column flex-nowrap">
+ <li class="h1"><a class="nav-link" href="#security-model" title="Security
Model">Security Model</a></li>
<li class="h1"><a class="nav-link" href="#security-vulnerabilities"
title="Security Vulnerabilities">Security Vulnerabilities</a></li>
<li class="h1"><a class="nav-link" href="#reporting-new-security-problems"
title="Reporting New Security Problems">Reporting New Security Problems</a></li>
<li class="h1"><a class="nav-link"
href="#cve-2026-49488-apache-openmeetings-arbitrary-file-"
title="CVE-2026-49488: Apache OpenMeetings: Arbitrary File
Read">CVE-2026-49488: Apache OpenMeetings: Arbitrary File Read</a></li>
