A console warning has appeared in our current XWiki (17.10.10):
jquery.min.js?r=1:2 [Violation] Permissions policy violation: unload is not allowed in this document.
Following the stack trace I find InplaceEditing:609 with this code:
// Make sure we unlock the document when the user navigates to another page.
$(window).on('unload pagehide', () => {
unlock(getCurrentXWikiDocument());
});
Copilots states:
Chromium-based browsers, in particular, are placing unloadunder increasingly strict restrictions because:
unload prevents the Back/Forward cache (bfcache)
its execution cannot be reliably guaranteed
modern alternatives are preferred (pagehide, visibilitychange)
It says that it shouldn’t be a problem too. But I do like my console clean.
Thanks for the report. I checked and there’s no JIRA issue for this yet.
Analysis from CC:
There are exactly two places in XWiki Platform that register an unload listener, and both would trigger that violation:
xwiki-platform-edit/xwiki-platform-edit-ui/src/main/resources/XWiki/InplaceEditing.xml — the one your stack trace points to: $(window).on('unload pagehide', ...), used to unlock the document when the user navigates away. Since pagehide is already registered right next to it, the unload half looks redundant on any browser that fires pagehide, so it may simply be removable.
xwiki-platform-captcha/xwiki-platform-captcha-jcaptcha/xwiki-platform-captcha-jcaptcha-webjar/src/main/webjar/captcha.js — a deliberately empty $(window).on('unload', function() {}) whose only purpose is to break Firefox’s bfcache so that pressing Back doesn’t show a stale CAPTCHA. That one can’t just be deleted, it would need a different approach (e.g. reloading the CAPTCHA from a pageshow handler when event.persisted is true).
I can’t comment about the CAPTCHA code, but for the InplaceEditing we should stop registering the event listener for unload and keep only pagehide. I’ll handle this.