Re: [dspace-tech] XMLUI/Mirage 2: Community/Collection description as security issue

2020-05-27 Thread Pascal-Nicolas Becker
Hi Paul, this issue was discussed several times. Community/Collection descriptions can be edited by repository administrators and Community/Collection administrators only. We always said that those are trusted. Of course you can argue, that they could make mistakes even if they don’t want to,

[dspace-tech] Mystery "edit item metadata" feature in DSpace Demo XMLUI

2020-05-27 Thread Alan Orth
Hi, I was looking at the DSpace Demo XMLUI (version 6) and I noticed this cool feature where the metadata values for certain fields are using controlled lists instead of free text when editing an existing item's metadata. See dc.type in the attached screenshot. What is this feature? Is it

Re: [dspace-tech] XMLUI/Mirage 2: Community/Collection description as security issue

2020-05-27 Thread Bram Luyten
Hi Paul, I definitely agree that it is a potential security risk and that people editing community and collection pages have to watch out what they are doing. However, the ability to get script tags executed on those pages makes some integrations relatively light weight. One example are the

[dspace-tech] Re: datacite mds test no longer available

2020-05-27 Thread Paul Warner
Hi, I got a further info email from DataCite to say that, in fact, they had technical problems with mds.test.datacite.org, and these have been fixed. It wasn't shut down. I tested it and indeed it is working! So please ignore my initial message. Sorry for the confusion. Best regards, Paul

Re: [dspace-tech] XMLUI/Mirage 2: Community/Collection description as security issue

2020-05-27 Thread Paul Münch
Hello Mark, thanks for the reply. I checked the SimpleHTMLFragment.java, but it isn't used in the community or collection UI. I guess that it's a XSLT problem. HTML-code snippets in the community or collection description fields are interpreted, but not on the item page. The only difference I

[dspace-tech] errror on collection sorting

2020-05-27 Thread 'Massimiliano CILURZO' via DSpace Technical Support
Dear All, When I select a collection and try to sort by year of publication, an error message appears. Internal Server Error The server encountered an internal error or misconfiguration and was unable to complete your request. In the cocoon.log we hae this 2020-05-27 09:25:40,521 WARN