Problem The application ships 33 wiki pages, 19 of which carry script, and exactly one of them declares the
rights it requires: ReleaseNotes.Code.MigrationFrom1x, since RN-110. A page that does not enforce required rights offers no guarantee about what its script is allowed to
do, and — the part that matters here — nothing prevents a user who merely holds edit right on the
wiki from rewriting a code page. Any right check a page performs in its own content only lasts as
long as nobody rewrites that content. That was the reasoning behind RN-110; it is not specific to the
migration page. Two separate things are missing:
- the pages do not say what they need to run: no enforceRequiredRights flag, no
XWiki.RequiredRightClass object. XWiki's own required-rights analyzer computes this per page and
should be the source of truth for the level, rather than a hand-derived guess.
- the ReleaseNotes.Code space has no rights object, so editing the application's code is open to
any user holding edit right. Restricting edit on a *Code space to XWiki.XWikiAdminGroup
through a WebPreferences page is established practice in XWiki Platform (for instance
PanelsCode.WebPreferences, ReleaseCode.WebPreferences and
Image.Style.Code.ImageStyles.WebPreferences).
Fix Declare required rights on every page of the application, with the level XWiki's analyzer computes
for it, and ship a ReleaseNotes.Code.WebPreferences page restricting edit and delete on
the code space to wiki administrators. The -demo module is left alone on purpose: it is sample release-note content users are meant to
edit and delete, it carries no script, and enforcement there would only add friction. |
