Velocity allowlist does not include batched email notification templates

XMLWordPrintable

    • 10
    • 90
    • Severity 3 - Minor
    • 816
    • Warranty

      Issue Summary

      Modifications to the batched email notification templates in Jira 10 will not be reflected because the batched email templates are not in the velocity allowlist

      Steps to Reproduce

      1. Install Jira 10.3.2
      2. Customize batched email notification templates

      Expected Results

      Modifications are reflected in batched email notifications

      Actual Results

      Modifications are not reflected and the following error is thrown in atlassian-jira.log:

      Caesium-1-4 ERROR ServiceRunner     [c.atlassian.velocity.DefaultVelocityManager] Exception getting message body from Velocity: org.apache.velocity.exception.ResourceNotFoundException: Unable to find resource 'templates/email-batch/html/template.vm'
org.apache.velocity.exception.ResourceNotFoundException: Unable to find resource 'templates/email-batch/html/template.vm'

      Workaround

      This workaround will re-enable templates uploaded by administrators. Administrators must take care to only provide valid and secure templates.

      Add the batched email notification templates to the velocity allowlist located at (JIRA-INSTALL-DIR)/atlassian-jira/WEB-INF/classes/velocity-default.properties:

      # starts at line number 1001
templates/email-batch/html/template.vm, \
templates/email-batch/html/footer.vm, \
templates/email-batch/html/hr-bottom.vm, \
templates/email-batch/html/IssueUpdateBatcher-content.vm, \
templates/email-batch/html/IssueUpdateBatcher-header.vm, \
templates/email-batch/html/IssueUpdateBatcher-history.vm, \
templates/email-batch/html/IssueUpdateBatcher-subject.vm, \
templates/email-batch/html/IssueUpdateBatcher.vm, \
templates/email-batch/html/spacer.vm, \
templates/email-batch/html/template.vm, \
templates/email-batch/shared/mention-text.vm, \
templates/email-batch/text/IssueUpdateBatcher-subject.vm, \
templates/email-batch/text/IssueUpdateBatcher.vm

      Note:
      In addition to the above, you also need to add ", \" to the end of line number 1000, changing it from:

      com/atlassian/jira/template/velocity/text/existing-parameterized-template.vm

      to:

      com/atlassian/jira/template/velocity/text/existing-parameterized-template.vm, \

            Assignee:
            Sergii Sinelnychenko
            Reporter:
            Jeff Curry
            Votes:
            84 Vote for this issue
            Watchers:
            97 Start watching this issue

              Created:
              Updated:
              Resolved: