Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui

@@ -336,7 +336,12 @@
   #set ($query = $query.setLimit($limit).setOffset($offset).bindValues($sqlParams))
   #set($items = $query.execute())
   #set($discard = $map.put('totalrows', $query.count()))
-  #set($discard = $map.put('returnedrows', $mathtool.min($items.size(), $limit)))
+  #if ($limit > 0)
+    #set($discard = $map.put('returnedrows', $mathtool.min($items.size(), $limit)))
+  #else
+    ## When the limit is 0, it's equivalent to no limit at all and the actual number of returned results can be used.
+    #set($discard = $map.put('returnedrows', $items.size()))
+  #end
   #set($discard = $map.put('offset', $mathtool.add($offset, 1)))
   #set($rows = [])
   #foreach($item in $items)

@@ -47,6 +47,7 @@
 import com.xpn.xwiki.objects.classes.StaticListClass;
 import com.xpn.xwiki.plugin.tag.TagPluginApi;
 
+import static java.util.Collections.emptyList;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -470,6 +471,35 @@ void removeObfuscatedResultsWhenTotalrowsLowerThanLimit() throws Exception
         assertEquals("XWiki.Viewable", viewable.get("doc_fullName"));
     }
 
+    @Test
+    void removeObfuscatedResultsWhenLimitIs0() throws Exception
+    {
+        when(this.queryService.hql(anyString())).thenReturn(this.query);
+        when(this.query.setLimit(anyInt())).thenReturn(this.query);
+        when(this.query.setOffset(anyInt())).thenReturn(this.query);
+        when(this.query.bindValues(any(Map.class))).thenReturn(this.query);
+        when(this.query.count()).thenReturn(1L);
+        when(this.query.execute()).thenReturn(Arrays.asList("XWiki.NotViewable"));
+
+        when(this.oldcore.getMockContextualAuthorizationManager()
+            .hasAccess(same(Right.VIEW), eq(new DocumentReference("xwiki", "XWiki", "NotViewable")))).thenReturn(false);
+
+        this.request.put("limit", "0");
+        this.request.put("classname", "");
+        this.request.put("collist", "doc.title,doc.location,doc.content");
+        this.request.put("doc.title", "Sandbo");
+        this.request.put("doc.location", "Sandbox.TestPage3");
+        this.request.put("doc.content", "dummy");
+        this.request.put("limit", "0");
+
+        renderPage();
+
+        assertEquals(0, getTotalRowCount());
+        assertEquals(0, getRowCount());
+        assertEquals(1, getOffset());
+        assertEquals(emptyList(), getRows());
+    }
+
     //
     // Helper methods
     //