If you are not in a position to upgrade to Confluence 3.0.1, you can patch your existing Confluence 3.0.0 instance to fix this XSS issue using the attached zip file.

To apply the patch:

1. Shut down your Confluence server.
   
   
2. Copy the files to the following locations:

   File name	Location
   macros.vm	webapp/template/includes/macros.vm
   search-results.vmd	webapp/decorators/components/search-results.vmd
   UserProfileLink.class	WEB-INF/classes/com/atlassian/links/linktypes/UserProfileLink.class

   (Create the appropriate folder(s) if they do not exist.)
   

3. Restart the Confluence server.
   
   
4. If necessary, upgrade your version of the Advanced Macros plugin to at least 1.6.2.8, which can be done via the Administration Console.

Anatoli, the XSS hole in advanced macros was introduced in 3.0 (specifically via the 'social' theme) so current 2.10 users shouldn't have this problem.

Brian, is the new version of the plugin compatible with 2.10?

A new version of the advanced macros plugin has been added to 3.0.1

needs a review.

Fixed in branch as well.

Due to our lovely circular dependency with bundled plugins I can't update advanced macros until we release 3.0.1. So any testers will need to download the SNAPSHOT version.

Moving to 3.1 since I have to release advanced macros after the merge

Turns out this is still a problem in the recently-updated macro (social theme). Assigning to myself to fix.

This changeset really should have been split into two separate commits. The bug fix itself is fine.

In terms of the user helper, it all looks good. There are a few things that should be changed in the future though:

• addUserToGroup should use a user object. Makes it consistent with the rest of the helper
• rpcCreateTestSpace should be deleted too, again for consistency
• createUserViaHelper should be removed, it looks like we are moving to a delegation pattern so we should be doing userHelper.createUser() as well. The less stuff we have in ACAT the better.

Fixed by URL encoding the usernames.