LDAP user with ' in his name brakes blog application and some other features

We have a user with a ’ in his name (D’Egidio), it’s an LDAP user so I can’t control the tilde.
He was not able to create a new page.
We’ve changed the preferences so now the name does not have the ’ but the profile page still has it.

The blog application gives this error:

Failed to execute the [velocity] macro. Cause: [expecting ‘=’, found ‘’’ [select distinct doc.fullName, publishDate.value from com.xpn.xwiki.doc.XWikiDocument doc , com.xpn.xwiki.objects.BaseObject as obj, com.xpn.xwiki.objects.IntegerProperty isPublished, com.xpn.xwiki.objects.IntegerProperty hidden, com.xpn.xwiki.objects.DateProperty publishDate, com.xpn.xwiki.objects.DBStringListProperty as category left join category.list catList where doc.fullName <> ‘Blog.BlogPostTemplate’ and obj.name=doc.fullName and obj.className=‘Blog.BlogPostClass’ and isPublished.id.id = obj.id and isPublished.id.name = ‘published’ and hidden.id.id = obj.id and hidden.id.name=‘hidden’ and publishDate.id.id = obj.id and publishDate.id.name=‘publishDate’ and (doc.creator = ‘XWiki.AlejandroD’egidio’ or (isPublished.value = 1 and hidden.value = 0)) and obj.id=category.id.id and category.id.name=‘category’ and (doc.space = :space or catList like :catList escape ‘!’) order by publishDate.value desc]]. Click on this message for details.

The user reference is not properly escaped in the query. This looks like a bug in the Blog application. If you have the latest version of the Blog application then would be good to report the issue on https://jira.xwiki.org/browse/BLOG . It should be easy to reproduce and fix.

1 Like