Ad-Hoc Notification Limitations
Summary
To improve security JEMH now (SINCE JEMH 6.0.6) restricts the use of Custom Override Templating features in the Ad-Hoc Notification pop-up to Jira Admins. This means that whilst non Jira Admins can write and send Ad-Hoc notifications via the pop-up, they will not be able to write complex notifications using the Velocity engine. Instead any notification using custom content will be rendered using the Wiki Renderer.
Templates, and custom content already stored and saved by a Jira Admin will still be rendered via the Velocity Engine regardless of user access, as the template has to be created by a Jira Admin
What Changed
JEMH will now enforce Wiki Rendering on Users granted access to Ad-Hoc, and Project Admins if they customise the content of the notification in the editor before sending. Jira Admins will also be given the option to grant Project Admins the right to use Velocity for Custom Templates (the same as previous behaviour). By default this option is disabled.
Impact
If a non Jira Admin modifies or adds velocity content to an Ad-Hoc Notification it will not render correctly. JEMH will use the Wiki renderer for most users which will not support Velocity syntax. For example the following template content would render differently depending on the Permissions of the User creating the notification:
Content
<h3>Ad-Hoc Notification</h3>
#set($customContent = "This is a custom notification!")
#set($userSender = $actionUser.getName())
$customContent
Sent by: $userSenderSent by Jira Admin | Sent by User with Ad-Hoc Access |
|---|---|
|
|
How to work with these changes
Rich Text Editor
A simple workaround is to modify JEMH’s Ad-hoc feature to use the ‘Rich Text’ Editor, which pre-renders content already approved by the Jira Admin (Ad-Hoc Template Sets) and adds the post rendered content to a “What you see is what you get” editor. Users can then further customise this content, which has always been rendered by the Wiki renderer.
The Rich Text Editor is the default editor in JEMH Ad-Hoc Notification, however if you do not have this editor set you can select this editor at:
Ad-Hoc Pop-up > Settings > Content Editor
Ad-Hoc Templates and Scriptlets
In addition to the Rich text Editor, providing a range of Ad-Hoc Notification Templates can allow users to send notifications without the need to customize the notification further. Ad-Hoc templates can also be scoped to a specific Project. For more information please see:
If using the Rich Text Editor, Users can also inject Scriptlets which are reusable velocity templates into a notification. They are written by Jira Admins and can provide some Velocity functionality to users without granting access to the Velocity engine. For more information please see: