31 Oct
2011
31 Oct
'11
10:06 p.m.
Hi,
I would like to close XWIKI-6987. The simplest fix is to stop
considering delete rights at document level. There was only one
response to this vote when Sergiu proposed it so if it is ok I would
like to propose it again:
Should the rights service ignore delete rights set at document level?
Here is my +1.
Best regards,
/Andreas
2011-09-30 17:46, Sergiu Dumitriu skrev:
On 09/30/2011 11:18 AM, Guillaume Lerouge wrote:
Hi,
I agree with this, especially given the use case described by Dimitry a
couple weeks ago where an user with edit rights on a page were able to give
himself the right to delete it. In addition to this, it's quite rare to have
to assign this right at page level. "Delete" is a clean-up right that
usually makes sense at the space level (at least), less so at the page
level.
Side question: does this have an impact on the right to rename a page? Is
the "rename" right mapped to the edit or the delete action?
Renaming implies deleting the old document, so yes, currently one can't
rename a document if they can't delete it as well. Still, this is just a
technical link, given by the fact that we don't have a real rename
method, it's just copy+delete.
So I'm +1 to remove the "delete"
right at document level.
Guillaume
On Fri, Sep 30, 2011 at 4:32 PM, Sergiu Dumitriu<sergiu(a)xwiki.com> wrote:
> Rights have different scopes in XWiki. Administration rights can only be
> set on a space or wiki level, and any "admin" right set on a document
> alone will be silently ignored. Programming rights are only considered
> when set on the xwiki:XWiki.XWikiPreferences document, being ignored in
> any other virtual wiki and at the space or document level.
>
> Delete rights are a bit special as well. By default, the creator of a
> document has delete rights on that document. Unlike the other rights
> which default to true when no right is set, this one defaults to false.
>
> So, by default, when no "delete" rights are set on the
> document/space/wiki, only the creator of a document and administrators
> are allowed to delete it.
>
> Should we allow setting the delete right at the document level?
>
> Personally, I'd say no, since it's a rare requirement for a non-creator
> to be able to delete just one document. Space-level rights should be
> enough, IMO.