CVE-2021-43446: XSS in macros

[strawp]

Any questions around CVE-2021-43446

[ShockwaveNN]

We able to reproduce this situation via

bash ./pwnlyoffice.py -d 1234 -u https://theonlyofficesiteurl macro macros/nextcloud_addadmin.js

I've created an issue 54642 in our private issue tracker to discuss possible solution, probably disabling macros by default or something like this