Allow to handle the security issues properly.

Description

The main job of this extension is to simplify the process of handling security issues as defined by the XWiki Security Policy. So this extension is currently highly linked to our current internal policy and relies on the release note applications to compute some data.

The extensions provides following features:

• creation of advisories 
• automatic computation of embargo date based on release date provided by release notes
• notification when embargo date is computed and when an advisory is ready to be disclosed
• an assignee for each advisory (since 2.3.0): advisories created in the wiki are assigned to their creator, and advisories imported from GitHub to the XWiki user mapped to the first GitHub user involved in them that has a mapping (author, then publisher, then collaborators); an import never replaces an existing assignee, and an imported advisory without assignee shows a warning letting administrators link or ignore its unmapped GitHub users
• publication of disclosed advisories (since 2.3.0): advisories are stored in the security entries space, which should be restricted, and clicking "Mark disclosed" on a disclosable advisory copies it, without its history, comments or attachments, to a public space; the original page then redirects to the copy
• listing of the advisories on the application home page in a Live Data table that shows only the disclosed advisories by default, with a CVE column linking to the CVE record and a Patched versions column that can be filtered (since 2.3.0)

Administration

The "Security Advisory" administration section provides, since 2.3.0:

• Disclosed entries space location: the public space disclosed advisories are published to (default SecurityAdvisoryApplication.DisclosedEntries); it must not be inside the restricted security entries space
• GitHub users mapping: the GitHub users found in imported advisories, each to link to an XWiki user or to ignore; linking a user assigns the advisories without assignee it is involved in, and the Assign advisories button does the same for all of them
• Publish disclosed advisories: publishes the disclosed advisories that aren't published yet, i.e. the ones disclosed before 2.3.0 or imported from GitHub as already published

Prerequisites & Installation Instructions

We recommend using the Extension Manager to install this extension (Make sure that the text "Installable with the Extension Manager" is displayed at the top right location on this page to know if this extension can be installed with the Extension Manager). Note that installing Extensions when being offline is currently not supported and you'd need to use some complex manual method.

You can also use the following manual method, which is useful if this extension cannot be installed with the Extension Manager or if you're using an old version of XWiki that doesn't have the Extension Manager:

1. Log in the wiki with a user having Administration rights
2. Go to the Administration page and select the Import category
3. Follow the on-screen instructions to upload the downloaded XAR
4. Click on the uploaded XAR and follow the instructions
5. You'll also need to install all dependent Extensions that are not already installed in your wiki

Versions

Dependencies

Dependencies for this extension (org.xwiki.contrib.security-advisory:application-security-advisory-ui 2.3.0):

• org.xwiki.contrib.security-advisory:application-security-advisory-default 2.3.0
• org.xwiki.contrib.security-advisory:application-security-advisory-github 2.3.0
• org.xwiki.contrib.releasenotes:application-releasenotes-ui 2.3
• org.xwiki.platform:xwiki-platform-appwithinminutes-ui 17.10.0
• org.xwiki.platform:xwiki-platform-livedata-macro 17.10.0