Reviewing PR #51 (RN-111), Michael Hamann proposed a different destination for this issue than the "Fix" section above, and two concrete mechanisms. Recording them here so the choice is made when this is implemented rather than rediscovered.
His proposal
Enforce required rights on release notes with script right, rather than making a release note need no rights at all. The objection the description raises against that — that it makes script right a condition of editing a release note, contradicting RN-30 — he answers by fixing the check rather than lowering the level:
the "Add ... Change" button should check edit right on the parent space, not edit right on the release note itself. A user who may create entries under a release note is a user who may edit that space; testing the note document is what pulls the note's own required rights into a question that is not about them.
Second mechanism: who saves the page
He also asks whether Code.HomeReleaseNotes should keep saving the created page from Velocity at all, or hand the filled form to the user to save.
The reason this matters here: saving a page from Velocity without programming right makes the script's author the author of the saved page, not the current user. That is exactly the accident the description notes ("the release note's content author ends up being the author of the creating script rather than the user who filled the form") — it is what makes a release note usually work today, and it is also a mis-attribution. Letting the user save the page attributes it correctly, and then the note's required rights are decided by a real author.
Consequence for the two options
Option A (this issue's current Fix): a release note needs no rights, all four pages enforce with nothing, the template loses its Velocity. Costs the customisable template an upgrade path (see the last paragraph of the description).
Option B (Michael's): a release note enforces script, the template keeps its Velocity, and the "Add ... Change" right check moves to the parent space. Costs a script-right author per release note — acceptable only if nothing in the normal authoring flow needs the note's own author to hold it, which is what moving the check is meant to guarantee.
Either way the four pages RN-111 left not enforcing (ReleaseNotes.WebHome, ReleaseNotes.Data.WebHome, Code.HomeReleaseNotes, Code.ReleaseNoteTemplate) can then enforce.
One correction to the description
The description says enforcing required rights "caps the rights of everything a page include}}s". Michael pointed out that is not unconditional: the Include macro's {{author="target" parameter executes the included page's content with the target page's own author instead of the including page's. See https://extensions.xwiki.org/xwiki/bin/view/Extension/Include%20Macro#HAuthor. That does not change why the four pages were left alone in RN-111 — the binding constraint there was Document.checkRequiredRightsForSaving forcing enforcement onto the created note, plus the template's Velocity — but it is an option worth weighing for ReleaseNotes.Data.WebHome, whose content is three include}}s of {{ReleaseNotes.Code pages.
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.
