Skip to Content
Last modified by Agnease on 2026/06/08 18:44
From version 3.7
edited by Agnease
on 2026/06/08 18:19
Change comment: There is no comment for this version
To version 3.9
edited by Agnease
on 2026/06/08 18:27
Change comment: There is no comment for this version

Summary

Details

Page properties
Content
... ... @@ -45,6 +45,11 @@
45 45   </p>
46 46  
47 47   <p>
48 + An XWiki security review is a practical audit of the platform configuration, access model,
49 + authentication setup, installed extensions, custom code, infrastructure and recovery procedures.
50 + </p>
51 +
52 + <p>
48 48   Security risks are often hidden in less visible areas: outdated versions, inherited permissions,
49 49   forgotten administrator accounts, overly powerful rights, old extensions, undocumented scripts,
50 50   weak fallback access or backup assumptions that were never tested.
... ... @@ -122,7 +122,7 @@
122 122   of small exceptions that nobody reviewed later.
123 123   </p>
124 124  
125 - <p>
130 + <p>
126 126   For a deeper look at this topic, see
127 127   <a href="$xwiki.getURL('resources.xwiki-access-rights-governance')">why XWiki access rights need a clear governance model</a>.
128 128   For a practical starting point, see
... ... @@ -176,7 +176,7 @@
176 176   A structured review can check versions, access rights, authentication,
177 177   extensions, custom code, infrastructure, backups and operational practices.
178 178   </p>
179 - <a class="btn btn-secondary" href="$xwiki.getURL('contact.WebHome')">Request a security review</a>
184 + <a class="btn btn-primary" href="$xwiki.getURL('contact.WebHome')">Request a security review</a>
180 180   </div>
181 181  
182 182   <h2 id="security-checklist">XWiki security review checklist</h2>
... ... @@ -239,53 +239,70 @@
239 239   permissions, extensions, customizations and recovery procedures were configured years earlier.
240 240   </p>
241 241  
242 - <div class="resource-note">
247 + <div class="resource-note related-resources">
248 + <p><strong>Security review series:</strong></p>
249 + <ul>
250 + <li>
251 + <a href="$xwiki.getURL('resources.xwiki-security-review')">What an XWiki security review should actually include</a>
252 + </li>
253 + <li>
254 + <a href="$xwiki.getURL('resources.xwiki-access-rights-governance')">Why XWiki access rights need a clear governance model</a>
255 + </li>
256 + <li>
257 + <a href="$xwiki.getURL('resources.xwiki-access-rights-review')">How to start an XWiki access-rights review</a>
258 + </li>
259 + </ul>
243 243   <p>
244 - <strong>Security review series:</strong>
245 - this article is the main overview. You can also read
246 - <a href="$xwiki.getURL('resources.xwiki-access-rights-governance')">why XWiki access rights need a clear governance model</a>
247 - and
248 - <a href="$xwiki.getURL('resources.xwiki-access-rights-review')">how to start an XWiki access-rights review</a>.
249 - Future topics will cover authentication and access control, script and programming rights, backup validation,
250 - extension review and operational practices.
261 + Future topics will cover authentication and access control, script and programming rights,
262 + backup validation, extension review and operational practices.
251 251   </p>
252 252   </div>
253 253  
254 254   <h2 id="security-review-faq">XWiki security review FAQ</h2>
255 255  
256 - <h3>What should an XWiki security review include?</h3>
257 - <p>
258 - An XWiki security review should include the installed XWiki version, upgrade path,
259 - access rights, groups, authentication setup, installed extensions, custom code,
260 - infrastructure, backups, restore expectations and operational procedures.
261 - </p>
268 + <details class="resource-faq-item" open>
269 + <summary>What should an XWiki security review include?</summary>
270 + <p>
271 + An XWiki security review should include the installed XWiki version, upgrade path,
272 + access rights, groups, authentication setup, installed extensions, custom code,
273 + infrastructure, backups, restore expectations and operational procedures.
274 + </p>
275 + </details>
262 262  
263 - <h3>Is an updated XWiki instance automatically secure?</h3>
264 - <p>
265 - No. Updating XWiki is important, but security also depends on permissions,
266 - authentication, extensions, custom code, infrastructure configuration, backups
267 - and how the instance is maintained.
268 - </p>
277 + <details class="resource-faq-item">
278 + <summary>Is an updated XWiki instance automatically secure?</summary>
279 + <p>
280 + No. Updating XWiki is important, but security also depends on permissions,
281 + authentication, extensions, custom code, infrastructure configuration, backups
282 + and how the instance is maintained.
283 + </p>
284 + </details>
269 269  
270 - <h3>Does SSO solve XWiki access control?</h3>
271 - <p>
272 - No. SSO helps authenticate users, but access control still depends on XWiki groups,
273 - inherited permissions, page-level rights and administrative privileges.
274 - </p>
286 + <details class="resource-faq-item">
287 + <summary>Does SSO solve XWiki access control?</summary>
288 + <p>
289 + No. SSO helps authenticate users, but access control still depends on XWiki groups,
290 + inherited permissions, page-level rights and administrative privileges.
291 + </p>
292 + </details>
275 275  
276 - <h3>Why should custom code be reviewed?</h3>
277 - <p>
278 - Custom scripts, templates, macros, UI extensions and Java components can affect
279 - permissions, workflows, rendering, integrations and upgrade behavior. They should
280 - be identified, documented and tested.
281 - </p>
294 + <details class="resource-faq-item">
295 + <summary>Why should custom code be reviewed?</summary>
296 + <p>
297 + Custom scripts, templates, macros, UI extensions and Java components can affect
298 + permissions, workflows, rendering, integrations and upgrade behavior. They should
299 + be identified, documented and tested.
300 + </p>
301 + </details>
282 282  
283 - <h3>When should an XWiki security review be done?</h3>
284 - <p>
285 - A review is useful before a major upgrade, after years of organic growth, after
286 - authentication changes, before exposing the wiki more broadly, or when the instance
287 - becomes business-critical.
288 - </p>
303 + <details class="resource-faq-item">
304 + <summary>When should an XWiki security review be done?</summary>
305 + <p>
306 + A review is useful before a major upgrade, after years of organic growth, after
307 + authentication changes, before exposing the wiki more broadly, or when the instance
308 + becomes business-critical.
309 + </p>
310 + </details>
289 289  
290 290   <div class="resource-note related-resources">
291 291   <p><strong>Related resources:</strong></p>