This is the release notes for XWiki Platform, XWiki Enterprise and XWiki Enterprise Manager. They share the same release notes as they are released together and have the same version.
This version contain some very important changes like the new security module by default, XWiki is now always in virtual mode, JQuery is embedded by default, xwiki/1.0 syntax is now disabled and it's WYSIWYG has been retired.

New and Noteworthy (since XWiki 5.0 Milestone 1)

Full list of issues fixed and Dashboard for 5.0.

New security authorization module replace the old RightService

With this new module, we bring the following improvements:

  • More efficient and performant authorization management thanks to a smart access rules and decision cache.
  • More generic and consistant right policy based on declarative definition of rights.
  • Extensible solution, allowing registration of new rights.
  • Customizable thanks to pluggable authentication settlers using configuration.

Read the full documentation of this module for complete details.

With this new module, the access policies also evolve and this introduce some major changes that you should consider if you are migrating an existing installation. Please read those changes in the migration chapter below.

Automatic Paste Cleaning in WYSIWYG Editor

Starting with this version, whenever you paste some content into the rich text area of the WYSIWYG Editor that content is (by default) automatically cleaned before being inserted into the rest of the content.

You can disable the automatic cleaning from the WYSIWYG Editor administration section if you wish:


Virtual mode is always enabled

Virtual mode and multiwiki is now part of XWiki's model and can no longer be disabled. What this means is that the difference between the 2 main products (XE and XEM) is getting smaller and smaller.

In the past, XEM differed from XE by the fact that it allowed the creation of multiple wikis (called subwikis) because it had the property xwiki.virtual=1 by default in xwiki.cfg, where as XE had xwiki.virtual=0 by default. Coupled with the Wiki Manager Application and the Workspace Application which were bundled by default, this allowed XEM to create and manage subwikis, while XE could not. This was causing confusion to users that had installed one product and later on, found out that they needed the other.

To avoid confusion and to simplify our development as well, we have defaulted to a virtual mode enabled by default, allowing you to create and manage subwikis/workspaces no matter what product you have downloaded. For instance, if you have downloaded XE, you now only have to install one or two extensions (Wiki Manager Application and/or Workspace Application) using the extension manager and you are all set. Most likely we will also switch to a single product scheme in the future.

Replace "xwiki.virtual.redirect" with an error template(or page)

This xwiki.cfg setting allowed the admin to redirect to a specified URL an user that tried to access an nonexistent wiki. However, it was enabled by default and the default value was  which was definitely wrong and was causing more problems than it solved. See for an example.

We have decided to drop this feature and replace it with an error template wikidoesnotexist.vm that can be overridden by a document in the main wiki named XWiki.WikiDoesNotExist, to be consistent with what we are doing for other XWiki entities (documents, attachments, etc).

However, to avoid hitting problems with accessing your main wiki, this feature is disabled by default and can be enabled by uncommenting xwiki.virtual.failOnWikiDoesNotExist in xwiki.cfg and setting its value to 1. Otherwise, by default, the user will always get server the content of the main wiki if the wiki he requested is not found.

For those that want to achieve the same behavior as before (by redirecting to a fixed URL every time), they have to enable xwiki.virtual.failOnWikiDoesNotExist in xwiki.cfg and then redirect to the desired URL either in wikidoesnotexist.vm or in the main wiki's XWiki.WikiDoesNotExist.


<insert misc user stuff and important bug fix descriptions here in a list, when they are too small to warrant a section by themselves - Change the version in the URL below!>

- autowww is not enabled by default and mandatory (can not be disabled), since with virtual mode enabled by default if could prove problematic to access your main wiki without a proper wiki descriptor set up. The main reason why you could have needed to disable it was if you actually had subwiki named www and you wanted to access it instead of the main wiki. Now the autowww feature checks for this case and serves the right content.

See the full list of JIRA issues fixed in this release.

For Developers

Translate log

It's possible to provide a translation key with any log to let log displayer use some localization framework to find proper translation for it.

See Logging Module for more details.

JQuery in XWiki using AMD/Require.js

Now with require.js you can pull in jQuery and use it when you need it without incurring the performance penalty when you don't need it.
To use jquery, use the script below:

require(['jquery'], function($) {
    $('#document-title>h1').text('JQuery in action');

You can learn more about the power of AMD javascript modules by reading require.js documentation.

Back to JUnit

XWiki Commons used to force using junit-dep instead of junit at build time because of embedded libraries in junit jar. Since it's not the case anymore the enforcer rule and everything about junit-dep has been removed from our pom.xml files.

The main change for external projects if that if you depends on junit-dep and don't specify the version your project won't build anymore and you should change for junit

XWikiDocument authors and public access

The document reference used to indicate that a document has been created/modified by a public access user (or guest user) is now null. It's following what is already the XWikiContext behavior which means that you can now safely compare context user reference and document authors reference since both of these APIs have the same behavior regarding unauthenticated users.

Document rollback events

We introduced two new document events: DocumentRollingBackEvent and DocumentRolledBackEvent. The first one is triggered before the document is saved (before the DocumentUpdatingEvent) and the second is triggered after the document is saved (after the DocumentUpdatedEvent). Checkout the Observation Module documentation to see how you can listen to these events.

Deprecated and Retired projects

<description of deprecated and retired projects>


The following dependencies have been upgraded:

  • GWT 2.5.1
  • JUnit 4.11
  • slf4j 1.7.5
  • logback 1.0.11
  • Hamcrest 1.3
  • Groovy 2.1.2


<other dev stuff to add and link to JIRA for all issues fixed>

- Added methods to query existing wikis: api.XWiki.getWikiNames() and api.XWiki.hasSubWikis()
- Virtual mode is now enabled by default so development needs to consider the fact that the main wiki may not be the only wiki available.
- With the transition to virtual mode by default, the XWiki.XWikiServerClass is now a mandatory class to be used when creating a wiki descriptor. Its existence will be, like all mandatory classes, checked when XWiki starts, but only for the main wiki. It was formerly initialized by and part of the wiki-manager module but it's now part of the core. Also, the XWiki.XWikiServerClassSheet has been moved to the wiki-manager-ui module.
- The xwikilargestrings table was used to store both LargeStringProperty and StringListProperty values; now StringListPropertyes are stored in a new table, xwikistringlists. Existing data should be automatically migrated from one table to the other.


The following translations have been updated: 

Tested Browsers & Databases

Known issues

Backward Compatibility and Migration Notes

General Notes

You may also want to import the default wiki XAR in order to benefit from all the improvements listed above.

Always make sure you compare your xwiki.cfg and files with the newest version since some configuration parameters were added. Note that you should add so that XWiki will attempt to automatically migrate your current database to the new schema. Make sure you backup your Database before doing anything.

Issues specific to XWiki 5.0 Milestone 2

XWikiDocument authors and public access

The document reference used to indicate that a document has been created/modified by a public access user (or guest user) is now null. In practice in means that even if the database indicate that the document has been saved by "XWiki.XWikiGuest" document.getAuthorReference() will return null. See

Programming right imply Admin right and not the opposite

With the previous Right Service implementation some side effect used to give you Programming Right when you had main wiki admin right, it's not the case anymore. Programming right is stronger than admin right in new security module default implementation which means you can have admin right without programming right, even on main wiki.

In practice it means that most of the time you will have to give Programming Right to main wiki admin group which used to be granted only Admin right by default distribution.

Sub-wikis now inherit rights from their main wiki

With the previous Right Service implementation, only the admin and programming rights get inherited somehow on sub-wikis. The new implementation provide a more consistant behavior, all rights are inherited from the main wiki into sub-wikis in the same maner they are between wiki, space and document.

Public access on an empty wiki does not receive admin right anymore

With the previous Right Service implementation, until some right are sets, the public (previously XWikiGuest user, now null user) used to receive admin access and is able to import the default XAR. Since we now have a Distribution Wizard that kicks in to allow installing at least a minimal flavor to get you started, this is no more needed. This will improve security since the detection of an initial import situation was not so trivial.

If you do not have installed a minimal package using the new Distribution Wizard or you want to continue to import XAR manually, you may use the superadmin access to do so.

Note that public receive view, edit, comment, login, and register access to an empty wiki.

Edit right now imply view right

With the previous Right Service implementation, you were able to receive edit access to a document while you were not able to see or read that same document. This potential issue stay hidden since nobody notice until a edit URL is manually entered. Since we do not see any practical use case where a user would need to edit a document he cannot access, the edit right now imply the view right. Therefore, giving edit alone is now sufficient.

Edition of XWikiPreferences and WebPreferences

For increased security, edition of the XWikiPreferences and WebPreferences documents are now always restricted to admin users, whatever the right settings of these documents and their parents.

The xwiki/1.0 syntax is now hidden by default

The old xwiki/1.0 syntax is no longer available for selection when editing a document. The rendering engine will continue to be available, so existing documents using it will continue to work, and creating application documents based on a template in the xwiki/1.0 syntax will still work. Anyway, users are strongly encouraged to migrate away from this syntax.


  • The translations page for each workspace (xwiki:WorkspaceManager.TemplateTranslations) has been moved to the template (and implicitly locally, on each workspace) in XWiki.WorkspaceTranslations. Existing workspaces will still use any existing xwiki:WorkspaceManager.TemplateTranslations document (registered as translation bundle) that you may still have on the main wiki. New workspaces will use their local XWiki.WorkspaceTranslations document.
  • As stated above, a new table has been added to the schema, xwikistringlists. Make sure the DB user has the required privileges to create it automatically, or create it manually before starting the new version.
  • Links to attachment by default point to a specific version instead of a versionless "display the latest" link.
  • Several velocity templates have been removed, since they haven't been used in a very long time; this might break custom skins built on top of old skins like Dodo or Albatross. See the related issue for more details.
    • One important template that was removed is analytics.vm, the preferred way of enabling Google Analytics is through the dedicated administration section

API Breakages

The following APIs were modified since XWiki 4.5.2:

<clirr output here>

Get Connected