| The Edit Macro dialog shows every parameter of a macro, including parameters, or parameter values, that require a right the current user does not have. The user fills them in, submits, and only gets an error when the macro is rendered. XWIKI-22289 covers the macro level: not showing macros the user does not have the rights to execute. This issue is about the same problem one level down, for the parameters of a macro the user is allowed to use. Expected A parameter that the current user is not allowed to use is hidden in the Edit Macro dialog, or shown as unavailable with the reason. Actual The parameter is shown and editable like any other, and using it leads to a rights error at rendering time. Proposal
- Let a macro parameter declare the minimum right it requires, in the same way XWIKI-22289 proposes for macros.
- Expose it through the macro descriptor used by the editor.
- Make the Edit Macro dialog hide, or disable with an explanation, the parameters the current user does not have the right to use.
Raised in https://forum.xwiki.org/t/brainstorming-usability-criteria-for-auditing-macros-in-the-wysiwyg-editor/18907/19 |
