CVE-2024-37899: Insufficient Information (NVD-CWE-noinfo)
value: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable the user account. To reproduce, as a user without script nor programming rights, edit the about section of your user profile and add `{{groovy}}services.logging.getLogger("attacker").error("Hello from Groovy!"){{/groovy}}`.
As an admin, go to the user profile and click the "Disable this account" button. Then, reload the page. If the logs show `attacker - Hello from Groovy!` then the instance is vulnerable. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

### Workarounds
We're not aware of any workaround except upgrading.

### References
* https://jira.xwiki.org/browse/XWIKI-21611
* https://github.com/xwiki/xwiki-platform/commit/f89c8f47fad6e5cc7e68c69a7e0acde07f5eed5a

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-20T23:15Z
Repository: https://github.com/xwiki/xwiki-platform
Language: Java
Files changed: xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/api/XWikiUser.java, xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/api/XWikiUserTest.java, xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/getusers.vm
Commit date: 2024-01-24 15:22:09 +0100
Commit message: XWIKI-21611: Set right author when disabling/enabling an account

* Set only the original metadata author in XWikiUser.setDisabled
* Use the same disable/enable action everywhere
* Remove no longer needed request parameters

Diff: diff --git a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/api/XWikiUser.java b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/api/XWikiUser.java
index 3dca7c8da2c5a..4013faff9e55b 100644
--- a/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/api/XWikiUser.java
+++ b/xwiki-platform-core/xwiki-platform-oldcore/src/main/java/com/xpn/xwiki/user/api/XWikiUser.java
@@ -29,10 +29,12 @@
 import org.xwiki.model.reference.DocumentReference;
 import org.xwiki.model.reference.DocumentReferenceResolver;
 import org.xwiki.model.reference.EntityReferenceSerializer;
 import org.xwiki.model.reference.LocalDocumentReference;
 import org.xwiki.model.reference.WikiReference;
+import org.xwiki.user.UserReference;
+import org.xwiki.user.UserReferenceResolver;
 
 import com.xpn.xwiki.XWiki;
 import com.xpn.xwiki.XWikiContext;
 import com.xpn.xwiki.XWikiException;
 import com.xpn.xwiki.doc.XWikiDocument;
@@ -69,10 +71,12 @@
 
     private EntityReferenceSerializer<String> localEntityReferenceSerializer;
 
     private ContextualLocalizationManager localization;
 
+    private UserReferenceResolver<DocumentReference> documentReferenceUserReferenceResolver;
+
     private Logger logger = LoggerFactory.getLogger(XWikiUser.class);
 
     private String fullName;
 
     private boolean fullNameNull;
@@ -202,10 +206,19 @@ private EntityReferenceSerializer<String> getLocalEntityReferenceSerializer()
             localEntityReferenceSerializer = Utils.getComponent(EntityReferenceSerializer.TYPE_STRING, "local");
         }
         return localEntityReferenceSerializer;
     }
 
+    private UserReferenceResolver<DocumentReference> getDocumentReferenceUserReferenceResolver()
+    {
+        if (this.documentReferenceUserReferenceResolver == null) {
+            this.documentReferenceUserReferenceResolver =
+                Utils.getComponent(UserReferenceResolver.TYPE_DOCUMENT_REFERENCE, "document");
+        }
+        return this.documentReferenceUserReferenceResolver;
+    }
+
     private ContextualLocalizationManager getLocalization()
     {
         if (this.localization == null) {
             this.localization = Utils.getComponent(ContextualLocalizationManager.class);
         }
@@ -335,11 +348,13 @@ public void setDisabled(boolean disable, XWikiContext context)
             int activeFlag = (disable) ? 0 : 1;
             try {
                 XWikiDocument userdoc = getUserDocument(context);
                 userdoc.setIntValue(getUserClassReference(userdoc.getDocumentReference().getWikiReference()),
                     ACTIVE_PROPERTY, activeFlag);
-                userdoc.setAuthorReference(context.getUserReference());
+                UserReference userReference =
+                    getDocumentReferenceUserReferenceResolver().resolve(context.getUserReference());
+                userdoc.getAuthors().setOriginalMetadataAuthor(userReference);
                 context.getWiki().saveDocument(userdoc,
                     localizePlainOrKey("core.users." + (disable ? "disable" : "enable") + ".saveComment"), context);
             } catch (XWikiException e) {
                 this.logger.error("Error while setting active status of user [{}]", getUser(), e);
             }
diff --git a/xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/api/XWikiUserTest.java b/xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/api/XWikiUserTest.java
index e9b48b0bf9caa..48cc43ef4eca4 100644
--- a/xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/api/XWikiUserTest.java
+++ b/xwiki-platform-core/xwiki-platform-oldcore/src/test/java/com/xpn/xwiki/user/api/XWikiUserTest.java
@@ -17,16 +17,21 @@
  * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
  * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
  */
 package com.xpn.xwiki.user.api;
 
+import javax.inject.Named;
+
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.Mock;
 import org.xwiki.localization.ContextualLocalizationManager;
+import org.xwiki.model.document.DocumentAuthors;
 import org.xwiki.model.reference.DocumentReference;
+import org.xwiki.test.junit5.mockito.MockComponent;
 import org.xwiki.test.mockito.MockitoComponentManager;
+import org.xwiki.user.UserReferenceResolver;
 
 import com.xpn.xwiki.XWikiException;
 import com.xpn.xwiki.doc.XWikiDocument;
 import com.xpn.xwiki.test.MockitoOldcore;
 import com.xpn.xwiki.test.junit5.mockito.InjectMockitoOldcore;
@@ -54,25 +59,33 @@
 public class XWikiUserTest
 {
     @InjectMockitoOldcore
     private MockitoOldcore mockitoOldcore;
 
+    @MockComponent
+    @Named("document")
+    private UserReferenceResolver<DocumentReference> documentReferenceUserReferenceResolver;
+
     @Mock
     private XWikiDocument userDocument;
 
-    private DocumentReference userClassReference = new DocumentReference("xwiki", "XWiki", "XWikiUsers");
+    @Mock
+    private DocumentAuthors authors;
+
+    private final DocumentReference userClassReference = new DocumentReference("xwiki", "XWiki", "XWikiUsers");
 
-    private DocumentReference userReference = new DocumentReference("xwiki", "XWiki", "Foo");
+    private final DocumentReference userReference = new DocumentReference("xwiki", "XWiki", "Foo");
 
     @BeforeEach
     public void setup(MockitoComponentManager componentManager) throws Exception
     {
-        when(mockitoOldcore.getSpyXWiki().getDocument(userReference, mockitoOldcore.getXWikiContext()))
-            .thenReturn(userDocument);
-        when(userDocument.getDocumentReference()).thenReturn(userReference);
-        when(userDocument.getDocumentReferenceWithLocale()).thenReturn(userReference);
-        when(userDocument.clone()).thenReturn(userDocument);
+        when(this.mockitoOldcore.getSpyXWiki().getDocument(this.userReference, this.mockitoOldcore.getXWikiContext()))
+            .thenReturn(this.userDocument);
+        when(this.userDocument.getDocumentReference()).thenReturn(this.userReference);
+        when(this.userDocument.getDocumentReferenceWithLocale()).thenReturn(this.userReference);
+        when(this.userDocument.getAuthors()).thenReturn(this.authors);
+        when(this.userDocument.clone()).thenReturn(this.userDocument);
         componentManager.registerMockComponent(ContextualLocalizationManager.class, "default");
     }
 
     @Test
     public void createWithNullReference()
@@ -93,140 +106,144 @@ public void createWithNullFullName()
     }
 
     @Test
     public void isDisabled()
     {
-        XWikiUser user = new XWikiUser(userReference);
-        when(userDocument.getIntValue(userClassReference, XWikiUser.ACTIVE_PROPERTY, 1)).thenReturn(1);
-        assertFalse(user.isDisabled(mockitoOldcore.getXWikiContext()));
+        XWikiUser user = new XWikiUser(this.userReference);
+        when(this.userDocument.getIntValue(this.userClassReference, XWikiUser.ACTIVE_PROPERTY, 1)).thenReturn(1);
+        assertFalse(user.isDisabled(this.mockitoOldcore.getXWikiContext()));
 
-        when(userDocument.getIntValue(userClassReference, XWikiUser.ACTIVE_PROPERTY, 1)).thenReturn(0);
-        assertTrue(user.isDisabled(mockitoOldcore.getXWikiContext()));
+        when(this.userDocument.getIntValue(this.userClassReference, XWikiUser.ACTIVE_PROPERTY, 1)).thenReturn(0);
+        assertTrue(user.isDisabled(this.mockitoOldcore.getXWikiContext()));
 
         user = new XWikiUser((DocumentReference) null);
-        assertFalse(user.isDisabled(mockitoOldcore.getXWikiContext()));
+        assertFalse(user.isDisabled(this.mockitoOldcore.getXWikiContext()));
 
         user = new XWikiUser(XWikiRightService.SUPERADMIN_USER_FULLNAME);
-        assertFalse(user.isDisabled(mockitoOldcore.getXWikiContext()));
+        assertFalse(user.isDisabled(this.mockitoOldcore.getXWikiContext()));
     }
 
     @Test
     public void setDisabledFalseNormalUser() throws XWikiException
     {
-        XWikiUser user = new XWikiUser(userReference);
-        user.setDisabled(false, mockitoOldcore.getXWikiContext());
-        verify(userDocument, times(1)).setIntValue(userClassReference, XWikiUser.ACTIVE_PROPERTY, 1);
-        verify(mockitoOldcore.getSpyXWiki(), times(1))
-            .saveDocument(same(userDocument), any(String.class), same(mockitoOldcore.getXWikiContext()));
+        XWikiUser user = new XWikiUser(this.userReference);
+        user.setDisabled(false, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, times(1)).setIntValue(this.userClassReference, XWikiUser.ACTIVE_PROPERTY, 1);
+        verify(this.mockitoOldcore.getSpyXWiki(), times(1))
+            .saveDocument(same(this.userDocument), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
+        verify(this.authors, times(1)).setOriginalMetadataAuthor(any());
+        verify(this.authors, never()).setEffectiveMetadataAuthor(any());
     }
 
     @Test
     public void setDisabledTrueNormalUser() throws XWikiException
     {
-        XWikiUser user = new XWikiUser(userReference);
-        user.setDisabled(true, mockitoOldcore.getXWikiContext());
-        verify(userDocument, times(1)).setIntValue(userClassReference, XWikiUser.ACTIVE_PROPERTY, 0);
-        verify(mockitoOldcore.getSpyXWiki(), times(1))
-            .saveDocument(same(userDocument), any(String.class), same(mockitoOldcore.getXWikiContext()));
+        XWikiUser user = new XWikiUser(this.userReference);
+        user.setDisabled(true, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, times(1)).setIntValue(this.userClassReference, XWikiUser.ACTIVE_PROPERTY, 0);
+        verify(this.mockitoOldcore.getSpyXWiki(), times(1))
+            .saveDocument(same(this.userDocument), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
+        verify(this.authors, times(1)).setOriginalMetadataAuthor(any());
+        verify(this.authors, never()).setEffectiveMetadataAuthor(any());
     }
 
     @Test
     public void setDisabledGuestOrSuperadminUser() throws XWikiException
     {
         // With guest user we never save anything
         XWikiUser user = new XWikiUser((DocumentReference) null);
-        user.setDisabled(true, mockitoOldcore.getXWikiContext());
-        verify(userDocument, never())
-            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
-        verify(mockitoOldcore.getSpyXWiki(), never())
-            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
-
-        user.setDisabled(false, mockitoOldcore.getXWikiContext());
-        verify(userDocument, never())
-            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
-        verify(mockitoOldcore.getSpyXWiki(), never())
-            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
+        user.setDisabled(true, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, never())
+            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
+        verify(this.mockitoOldcore.getSpyXWiki(), never())
+            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
+
+        user.setDisabled(false, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, never())
+            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
+        verify(this.mockitoOldcore.getSpyXWiki(), never())
+            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
 
         // With superadmin user we never save anything
         user = new XWikiUser(XWikiRightService.SUPERADMIN_USER_FULLNAME);
-        user.setDisabled(true, mockitoOldcore.getXWikiContext());
-        verify(userDocument, never())
-            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
-        verify(mockitoOldcore.getSpyXWiki(), never())
-            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
-
-        user.setDisabled(false, mockitoOldcore.getXWikiContext());
-        verify(userDocument, never())
-            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
-        verify(mockitoOldcore.getSpyXWiki(), never())
-            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
+        user.setDisabled(true, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, never())
+            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
+        verify(this.mockitoOldcore.getSpyXWiki(), never())
+            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
+
+        user.setDisabled(false, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, never())
+            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
+        verify(this.mockitoOldcore.getSpyXWiki(), never())
+            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
     }
 
     @Test
     public void isEmailChecked()
     {
-        XWikiUser user = new XWikiUser(userReference);
-        when(userDocument.getIntValue(userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1)).thenReturn(1);
-        assertTrue(user.isEmailChecked(mockitoOldcore.getXWikiContext()));
+        XWikiUser user = new XWikiUser(this.userReference);
+        when(this.userDocument.getIntValue(this.userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1)).thenReturn(1);
+        assertTrue(user.isEmailChecked(this.mockitoOldcore.getXWikiContext()));
 
-        when(userDocument.getIntValue(userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1)).thenReturn(0);
-        assertFalse(user.isEmailChecked(mockitoOldcore.getXWikiContext()));
+        when(this.userDocument.getIntValue(this.userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1)).thenReturn(0);
+        assertFalse(user.isEmailChecked(this.mockitoOldcore.getXWikiContext()));
 
         user = new XWikiUser((DocumentReference) null);
-        assertTrue(user.isEmailChecked(mockitoOldcore.getXWikiContext()));
+        assertTrue(user.isEmailChecked(this.mockitoOldcore.getXWikiContext()));
 
         user = new XWikiUser(XWikiRightService.SUPERADMIN_USER_FULLNAME);
-        assertTrue(user.isEmailChecked(mockitoOldcore.getXWikiContext()));
+        assertTrue(user.isEmailChecked(this.mockitoOldcore.getXWikiContext()));
     }
 
     @Test
     public void setEmailCheckedFalseNormalUser() throws XWikiException
     {
-        XWikiUser user = new XWikiUser(userReference);
-        user.setEmailChecked(false, mockitoOldcore.getXWikiContext());
-        verify(userDocument, times(1)).setIntValue(userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 0);
-        verify(mockitoOldcore.getSpyXWiki(), times(1))
-            .saveDocument(same(userDocument), any(String.class), same(mockitoOldcore.getXWikiContext()));
+        XWikiUser user = new XWikiUser(this.userReference);
+        user.setEmailChecked(false, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, times(1)).setIntValue(this.userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 0);
+        verify(this.mockitoOldcore.getSpyXWiki(), times(1))
+            .saveDocument(same(this.userDocument), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
     }
 
     @Test
     public void setEmailCheckedTrueNormalUser() throws XWikiException
     {
-        XWikiUser user = new XWikiUser(userReference);
-        user.setEmailChecked(true, mockitoOldcore.getXWikiContext());
-        verify(userDocument, times(1)).setIntValue(userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1);
-        verify(mockitoOldcore.getSpyXWiki(), times(1))
-            .saveDocument(same(userDocument), any(String.class), same(mockitoOldcore.getXWikiContext()));
+        XWikiUser user = new XWikiUser(this.userReference);
+        user.setEmailChecked(true, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, times(1)).setIntValue(this.userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1);
+        verify(this.mockitoOldcore.getSpyXWiki(), times(1))
+            .saveDocument(same(this.userDocument), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
     }
 
     @Test
     public void setEmailCheckedGuestOrSuperadminUser() throws XWikiException
     {
         // With guest user we never save anything
         XWikiUser user = new XWikiUser((DocumentReference) null);
-        user.setEmailChecked(true, mockitoOldcore.getXWikiContext());
-        verify(userDocument, never())
-            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
-        verify(mockitoOldcore.getSpyXWiki(), never())
-            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
-
-        user.setEmailChecked(false, mockitoOldcore.getXWikiContext());
-        verify(userDocument, never())
-            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
-        verify(mockitoOldcore.getSpyXWiki(), never())
-            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
+        user.setEmailChecked(true, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, never())
+            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
+        verify(this.mockitoOldcore.getSpyXWiki(), never())
+            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
+
+        user.setEmailChecked(false, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, never())
+            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
+        verify(this.mockitoOldcore.getSpyXWiki(), never())
+            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
 
         // With superadmin user we never save anything
         user = new XWikiUser(XWikiRightService.SUPERADMIN_USER_FULLNAME);
-        user.setEmailChecked(true, mockitoOldcore.getXWikiContext());
-        verify(userDocument, never())
-            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
-        verify(mockitoOldcore.getSpyXWiki(), never())
-            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
-
-        user.setEmailChecked(false, mockitoOldcore.getXWikiContext());
-        verify(userDocument, never())
-            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
-        verify(mockitoOldcore.getSpyXWiki(), never())
-            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
+        user.setEmailChecked(true, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, never())
+            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
+        verify(this.mockitoOldcore.getSpyXWiki(), never())
+            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
+
+        user.setEmailChecked(false, this.mockitoOldcore.getXWikiContext());
+        verify(this.userDocument, never())
+            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
+        verify(this.mockitoOldcore.getSpyXWiki(), never())
+            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
     }
 }
diff --git a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/getusers.vm b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/getusers.vm
index 9fbfe0de81d09..62ecfb2416ead 100644
--- a/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/getusers.vm
+++ b/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/getusers.vm
@@ -126,20 +126,22 @@
       'doc_hasedit': $hasEdit,
       'doc_edit_url': $user.getURL('edit'),
       'doc_hasdelete': $hasDelete,
       'doc_delete_url': $user.getURL('delete'),
       'doc_hasdisable': $hasDisable,
-      'doc_disable_url': $user.getURL('save', $escapetool.url({
-        "${userClassName}_0_active": 0,
-        'comment': $services.localization.render('core.users.disable.saveComment'),
-        'form_token': $services.csrf.token
+      'doc_disable_url': $xwiki.getURL('XWiki.XWikiUserProfileSheet', 'get', $escapetool.url({
+        'outputSyntax': 'plain',
+        'action': 'disable',
+        'userId': $user.documentReference,
+        'csrf': $services.csrf.token
       })),
       'doc_hasenable': $hasEnable,
-      'doc_enable_url': $user.getURL('save', $escapetool.url({
-        "${userClassName}_0_active": 1,
-        'comment': $services.localization.render('core.users.enable.saveComment'),
-        'form_token': $services.csrf.token
+      'doc_enable_url': $xwiki.getURL('XWiki.XWikiUserProfileSheet', 'get', $escapetool.url({
+        'outputSyntax': 'plain',
+        'action': 'enable',
+        'userId': $user.documentReference,
+        'csrf': $services.csrf.token
       })),
       'name': "#displayUserAliasWithAvatar($user.documentReference $disabled)",
       'first_name': $userObject.getValue('first_name'),
       'last_name': $userObject.getValue('last_name'),
       'scope': $services.localization.render("xe.admin.groups.$scope")

Vulnerable code:                 userdoc.setAuthorReference(context.getUserReference());
    private DocumentReference userClassReference = new DocumentReference("xwiki", "XWiki", "XWikiUsers");
    private DocumentReference userReference = new DocumentReference("xwiki", "XWiki", "Foo");
        when(mockitoOldcore.getSpyXWiki().getDocument(userReference, mockitoOldcore.getXWikiContext()))
            .thenReturn(userDocument);
        when(userDocument.getDocumentReference()).thenReturn(userReference);
        when(userDocument.getDocumentReferenceWithLocale()).thenReturn(userReference);
        when(userDocument.clone()).thenReturn(userDocument);
        XWikiUser user = new XWikiUser(userReference);
        when(userDocument.getIntValue(userClassReference, XWikiUser.ACTIVE_PROPERTY, 1)).thenReturn(1);
        assertFalse(user.isDisabled(mockitoOldcore.getXWikiContext()));
        when(userDocument.getIntValue(userClassReference, XWikiUser.ACTIVE_PROPERTY, 1)).thenReturn(0);
        assertTrue(user.isDisabled(mockitoOldcore.getXWikiContext()));
        assertFalse(user.isDisabled(mockitoOldcore.getXWikiContext()));
        assertFalse(user.isDisabled(mockitoOldcore.getXWikiContext()));
        XWikiUser user = new XWikiUser(userReference);
        user.setDisabled(false, mockitoOldcore.getXWikiContext());
        verify(userDocument, times(1)).setIntValue(userClassReference, XWikiUser.ACTIVE_PROPERTY, 1);
        verify(mockitoOldcore.getSpyXWiki(), times(1))
            .saveDocument(same(userDocument), any(String.class), same(mockitoOldcore.getXWikiContext()));
        XWikiUser user = new XWikiUser(userReference);
        user.setDisabled(true, mockitoOldcore.getXWikiContext());
        verify(userDocument, times(1)).setIntValue(userClassReference, XWikiUser.ACTIVE_PROPERTY, 0);
        verify(mockitoOldcore.getSpyXWiki(), times(1))
            .saveDocument(same(userDocument), any(String.class), same(mockitoOldcore.getXWikiContext()));
        user.setDisabled(true, mockitoOldcore.getXWikiContext());
        verify(userDocument, never())
            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
        verify(mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));

        user.setDisabled(false, mockitoOldcore.getXWikiContext());
        verify(userDocument, never())
            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
        verify(mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
        user.setDisabled(true, mockitoOldcore.getXWikiContext());
        verify(userDocument, never())
            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
        verify(mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));

        user.setDisabled(false, mockitoOldcore.getXWikiContext());
        verify(userDocument, never())
            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
        verify(mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
        XWikiUser user = new XWikiUser(userReference);
        when(userDocument.getIntValue(userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1)).thenReturn(1);
        assertTrue(user.isEmailChecked(mockitoOldcore.getXWikiContext()));
        when(userDocument.getIntValue(userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1)).thenReturn(0);
        assertFalse(user.isEmailChecked(mockitoOldcore.getXWikiContext()));
        assertTrue(user.isEmailChecked(mockitoOldcore.getXWikiContext()));
        assertTrue(user.isEmailChecked(mockitoOldcore.getXWikiContext()));
        XWikiUser user = new XWikiUser(userReference);
        user.setEmailChecked(false, mockitoOldcore.getXWikiContext());
        verify(userDocument, times(1)).setIntValue(userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 0);
        verify(mockitoOldcore.getSpyXWiki(), times(1))
            .saveDocument(same(userDocument), any(String.class), same(mockitoOldcore.getXWikiContext()));
        XWikiUser user = new XWikiUser(userReference);
        user.setEmailChecked(true, mockitoOldcore.getXWikiContext());
        verify(userDocument, times(1)).setIntValue(userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1);
        verify(mockitoOldcore.getSpyXWiki(), times(1))
            .saveDocument(same(userDocument), any(String.class), same(mockitoOldcore.getXWikiContext()));
        user.setEmailChecked(true, mockitoOldcore.getXWikiContext());
        verify(userDocument, never())
            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
        verify(mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));

        user.setEmailChecked(false, mockitoOldcore.getXWikiContext());
        verify(userDocument, never())
            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
        verify(mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
        user.setEmailChecked(true, mockitoOldcore.getXWikiContext());
        verify(userDocument, never())
            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
        verify(mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));

        user.setEmailChecked(false, mockitoOldcore.getXWikiContext());
        verify(userDocument, never())
            .setIntValue(same(userClassReference), any(String.class), any(Integer.class));
        verify(mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(mockitoOldcore.getXWikiContext()));
      'doc_disable_url': $user.getURL('save', $escapetool.url({
        "${userClassName}_0_active": 0,
        'comment': $services.localization.render('core.users.disable.saveComment'),
        'form_token': $services.csrf.token
      'doc_enable_url': $user.getURL('save', $escapetool.url({
        "${userClassName}_0_active": 1,
        'comment': $services.localization.render('core.users.enable.saveComment'),
        'form_token': $services.csrf.token
Fixed code: import org.xwiki.user.UserReference;
import org.xwiki.user.UserReferenceResolver;
    private UserReferenceResolver<DocumentReference> documentReferenceUserReferenceResolver;

    private UserReferenceResolver<DocumentReference> getDocumentReferenceUserReferenceResolver()
    {
        if (this.documentReferenceUserReferenceResolver == null) {
            this.documentReferenceUserReferenceResolver =
                Utils.getComponent(UserReferenceResolver.TYPE_DOCUMENT_REFERENCE, "document");
        }
        return this.documentReferenceUserReferenceResolver;
    }

                UserReference userReference =
                    getDocumentReferenceUserReferenceResolver().resolve(context.getUserReference());
                userdoc.getAuthors().setOriginalMetadataAuthor(userReference);
import javax.inject.Named;

import org.xwiki.model.document.DocumentAuthors;
import org.xwiki.test.junit5.mockito.MockComponent;
import org.xwiki.user.UserReferenceResolver;
    @MockComponent
    @Named("document")
    private UserReferenceResolver<DocumentReference> documentReferenceUserReferenceResolver;

    @Mock
    private DocumentAuthors authors;

    private final DocumentReference userClassReference = new DocumentReference("xwiki", "XWiki", "XWikiUsers");
    private final DocumentReference userReference = new DocumentReference("xwiki", "XWiki", "Foo");
        when(this.mockitoOldcore.getSpyXWiki().getDocument(this.userReference, this.mockitoOldcore.getXWikiContext()))
            .thenReturn(this.userDocument);
        when(this.userDocument.getDocumentReference()).thenReturn(this.userReference);
        when(this.userDocument.getDocumentReferenceWithLocale()).thenReturn(this.userReference);
        when(this.userDocument.getAuthors()).thenReturn(this.authors);
        when(this.userDocument.clone()).thenReturn(this.userDocument);
        XWikiUser user = new XWikiUser(this.userReference);
        when(this.userDocument.getIntValue(this.userClassReference, XWikiUser.ACTIVE_PROPERTY, 1)).thenReturn(1);
        assertFalse(user.isDisabled(this.mockitoOldcore.getXWikiContext()));
        when(this.userDocument.getIntValue(this.userClassReference, XWikiUser.ACTIVE_PROPERTY, 1)).thenReturn(0);
        assertTrue(user.isDisabled(this.mockitoOldcore.getXWikiContext()));
        assertFalse(user.isDisabled(this.mockitoOldcore.getXWikiContext()));
        assertFalse(user.isDisabled(this.mockitoOldcore.getXWikiContext()));
        XWikiUser user = new XWikiUser(this.userReference);
        user.setDisabled(false, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, times(1)).setIntValue(this.userClassReference, XWikiUser.ACTIVE_PROPERTY, 1);
        verify(this.mockitoOldcore.getSpyXWiki(), times(1))
            .saveDocument(same(this.userDocument), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
        verify(this.authors, times(1)).setOriginalMetadataAuthor(any());
        verify(this.authors, never()).setEffectiveMetadataAuthor(any());
        XWikiUser user = new XWikiUser(this.userReference);
        user.setDisabled(true, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, times(1)).setIntValue(this.userClassReference, XWikiUser.ACTIVE_PROPERTY, 0);
        verify(this.mockitoOldcore.getSpyXWiki(), times(1))
            .saveDocument(same(this.userDocument), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
        verify(this.authors, times(1)).setOriginalMetadataAuthor(any());
        verify(this.authors, never()).setEffectiveMetadataAuthor(any());
        user.setDisabled(true, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, never())
            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
        verify(this.mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));

        user.setDisabled(false, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, never())
            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
        verify(this.mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
        user.setDisabled(true, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, never())
            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
        verify(this.mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));

        user.setDisabled(false, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, never())
            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
        verify(this.mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
        XWikiUser user = new XWikiUser(this.userReference);
        when(this.userDocument.getIntValue(this.userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1)).thenReturn(1);
        assertTrue(user.isEmailChecked(this.mockitoOldcore.getXWikiContext()));
        when(this.userDocument.getIntValue(this.userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1)).thenReturn(0);
        assertFalse(user.isEmailChecked(this.mockitoOldcore.getXWikiContext()));
        assertTrue(user.isEmailChecked(this.mockitoOldcore.getXWikiContext()));
        assertTrue(user.isEmailChecked(this.mockitoOldcore.getXWikiContext()));
        XWikiUser user = new XWikiUser(this.userReference);
        user.setEmailChecked(false, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, times(1)).setIntValue(this.userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 0);
        verify(this.mockitoOldcore.getSpyXWiki(), times(1))
            .saveDocument(same(this.userDocument), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
        XWikiUser user = new XWikiUser(this.userReference);
        user.setEmailChecked(true, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, times(1)).setIntValue(this.userClassReference, XWikiUser.EMAIL_CHECKED_PROPERTY, 1);
        verify(this.mockitoOldcore.getSpyXWiki(), times(1))
            .saveDocument(same(this.userDocument), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
        user.setEmailChecked(true, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, never())
            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
        verify(this.mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));

        user.setEmailChecked(false, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, never())
            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
        verify(this.mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
        user.setEmailChecked(true, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, never())
            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
        verify(this.mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));

        user.setEmailChecked(false, this.mockitoOldcore.getXWikiContext());
        verify(this.userDocument, never())
            .setIntValue(same(this.userClassReference), any(String.class), any(Integer.class));
        verify(this.mockitoOldcore.getSpyXWiki(), never())
            .saveDocument(any(XWikiDocument.class), any(String.class), same(this.mockitoOldcore.getXWikiContext()));
      'doc_disable_url': $xwiki.getURL('XWiki.XWikiUserProfileSheet', 'get', $escapetool.url({
        'outputSyntax': 'plain',
        'action': 'disable',
        'userId': $user.documentReference,
        'csrf': $services.csrf.token
      'doc_enable_url': $xwiki.getURL('XWiki.XWikiUserProfileSheet', 'get', $escapetool.url({
        'outputSyntax': 'plain',
        'action': 'enable',
        'userId': $user.documentReference,
        'csrf': $services.csrf.token