On Wed, Aug 31, 2011 at 11:41 AM, Anca Luca <lucaa(a)xwiki.com> wrote: So rendering the Space2.SheetWithPR without programming rights when the target document doesn't have programming rights is acceptable in your opinion right? I suppose that when you create a sheet that requires programming rights you make sure all pages that use that sheet have also programming rights. Thanks, Marius

On Wed, Aug 31, 2011 at 2:39 PM, Denis Gervalle <dgl(a)softec.lu> wrote: Exactly. How common is this use case? Can it be implemented in a safe way? Thanks, Marius

On Wed, Aug 31, 2011 at 14:56, Marius Dumitru Florea < mariusdumitru.florea(a)xwiki.com&gt; wrote: If you ask me, I should say that most of the application I have written fall in this case, so it is IMHO really common. This is not a simple issue, and this is not only related to sheets, since it simply concern the include macro, and the way it works. IMHO, the previous behavior (before 2.x), which was to consider the content author of the included document for the PR of its content was safe, as far as the author of that document was aware of that. I have never understand the purpose of the change, which has introduced XWIKI-5027, which is IMO really more difficult to secure when you need to include some other documents (a frequent use case when structuring your code in more than one document for reuse purposes). There have been some discussions about signing scripts to provide PR rights, but this would require wide changes that have been postponed for now. The way PR rights are provided is the Achilles’ heel of XWiki :( If you have full control of the process (being able to choose carefully and you can really choose between the two options), reintroducing the old behavior is for me the way to go. This is what you do when you drop PR for a sheet without PR. So no reason for me to not acquire PR for a sheet with PR. This will be the responsibility of the sheet author to ensure its code is safe in the context of another document. Denis -- Denis Gervalle SOFTEC sa - CEO eGuilde sarl - CTO

On 08/31/2011 11:08 AM, Marius Dumitru Florea wrote: I tend to think the same as Jerome and Denis there, I can see usecases when the sheet needs PR and the document cannot have them. Also, yes, I think there might be some room for exploits there if we use the sheet rights and not the doc rights, _although_ we can consider this is the responsibility of the sheet author (e.g. if you execute stuff from the including doc, you need to make sure that the stuff that you execute is not dangerous). If we don't allow pr in the case of B, it would be interesting to see if there would be a workaround for these cases, I.e. if you need to write an app where the sheet needs programming rights but the doc cannot have them (since they are docs created by the users), do you have some other way of displaying a doc through a sheet, not using this param? So, to answer your question, I'm not that sure anymore that it's acceptable... Initially I had thought that it makes sense for this to have the same behaviour as the include macro (because that's what we use now), but actually it has nothing to do with the include macro. We used include macro for sheets because we didn't have a better way, but actually the include macro is not a sheet specific solution, it is just a generic macro to include a doc in another one, which happens to be applied for the sheets system. If this is for building a sheet specific system, we can define a new behaviour, where the rights of the sheet win. in a word, I have no idea, I am aware that there are usecases for using prog rights for B and I would like to not forbid them because we might not be able to do some things and use some API that we could before (i'm afraid that the general direction of preventing PR everywhere because bad things might happen takes us to a place where we cannot actually use them anywhere). Thanks, Anca