Security enhancements for Velocity templates and allowlists - warning should not be shown if Batch notifications are disabled

XMLWordPrintable

    • Type: Bug
    • Resolution: Not a bug
    • Priority: Low
    • None
    • Affects Version/s: 10.0.0
    • Component/s: Email notifications
    • None
    • 10
    • 1
    • Severity 3 - Minor

      Issue Summary

      Steps to Reproduce

      1. Login to Jira 
      2. Make sure Batch notifications are disabled.
      3. Navigate to Email Templates. 
      4. Observed below mentioned warning which is related to batch email notification.
        Warning shown

        Starting with Jira 10.0, we've introduced security enhancements for Velocity templates and allowlists. These updates prevent the use of any Velocity templates that aren?t explicitly included in the allowlist. This restriction also applies to admin-provided batched email notification templates.
        To enable this feature, add the following lines to your (JIRA-INSTALL-DIR)/atlassian-jira/WEB-INF/classes/velocity-default.properties file. Start at line 1000:
        templates/email-batch/html/template.vm, \
        templates/email-batch/html/footer.vm, \
        templates/email-batch/html/hr-bottom.vm, \
        templates/email-batch/html/IssueUpdateBatcher-content.vm, \
        templates/email-batch/html/IssueUpdateBatcher-header.vm, \
        templates/email-batch/html/IssueUpdateBatcher-history.vm, \
        templates/email-batch/html/IssueUpdateBatcher-subject.vm, \
        templates/email-batch/html/IssueUpdateBatcher.vm, \
        templates/email-batch/html/spacer.vm, \
        templates/email-batch/html/template.vm, \
        templates/email-batch/shared/mention-text.vm, \
        templates/email-batch/text/IssueUpdateBatcher-subject.vm, \
        templates/email-batch/text/IssueUpdateBatcher.vm, \

      Expected Results

      Warning message should not be shown.

      Actual Results

      Warning message appears

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

              Assignee:
              Unassigned
              Reporter:
              Vedika Tambolkar
              Votes:
              1 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: