23 Feb
2012
23 Feb
'12
4:02 p.m.
Right now on an empty wiki you have all the rights except "delete"
(and register).
So this means that you have "admin" right but you don't have
"delete" rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
--
Thomas Mortagne
23 Feb
23 Feb
4:18 p.m.
On Feb 23, 2012, at 4:02 PM, Thomas Mortagne wrote:
Right now on an empty wiki you have all the rights
except "delete"
(and register).
So this means that you have "admin" right but you don't have
"delete" rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
I don't know if there was any good reason but I can't see it.
So +1 to have delete rights in an empty wiki when not logged in.
I've created http://jira.xwiki.org/jira/browse/XWIKI-7581
Thanks
-Vincent
4:31 p.m.
+1
Thanks,
Eduard
On Thu, Feb 23, 2012 at 5:18 PM, Vincent Massol <vincent(a)massol.net> wrote:
On Feb 23, 2012, at 4:02 PM, Thomas Mortagne wrote:
Right now on an empty wiki you have all the
rights except "delete"
(and register).
So this means that you have "admin" right but you don't have
"delete"
rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
I don't know if there was any good reason but I can't see it.
So +1 to have delete rights in an empty wiki when not logged in.
I've created http://jira.xwiki.org/jira/browse/XWIKI-7581
Thanks
-Vincent
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
4:46 p.m.
On Thu, Feb 23, 2012 at 16:18, Vincent Massol <vincent(a)massol.net> wrote:
-1 to change that since it will open hole in many existing wikis.
On Feb 23, 2012, at 4:02 PM, Thomas Mortagne wrote:
Because defaulting allow for delete on the initial template of XE will
allow anyone to delete anything.
We had never set right on delete explicitly.
Right now on an empty wiki you have all the
rights except "delete"
(and register).
So this means that you have "admin" right but you don't have
"delete"
rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
I don't know if there was any good reason but I
can't see it.
There is probably no good reason before it was implemented this way.
So +1 to have delete rights in an empty wiki when not
logged in.
I've created http://jira.xwiki.org/jira/browse/XWIKI-7581
+0 for this, simply because it would be difficult and tricky to do in the
current implementation.
After we agree on merging the new experimental security module and I got
some time to document it, I will surely open a discussion on how to evolve
the security rights, and why the empty wiki state cause other not so
pleasant issue. It is to early for now.
Thanks
-Vincent
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
--
Denis Gervalle
SOFTEC sa - CEO
eGuilde sarl - CTO
4:49 p.m.
On Feb 23, 2012, at 4:46 PM, Denis Gervalle wrote:
On Thu, Feb 23, 2012 at 16:18, Vincent Massol
<vincent(a)massol.net> wrote:
-1 to change that since it will open hole in many existing wikis.
Can you explain that?
The guest user has admin permissions so I don't see what could be worse than that.
Am I missing something?
Thanks
-Vincent
On Feb 23, 2012, at 4:02 PM, Thomas Mortagne wrote:
Because defaulting allow for delete on the initial template of XE will
allow anyone to delete anything.
We had never set right on delete explicitly.
Right now on an empty wiki you have all the
rights except "delete"
(and register).
So this means that you have "admin" right but you don't have
"delete"
rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
I don't
know if there was any good reason but I can't see it.
There is probably no good reason before it was implemented this way.
So +1 to have delete rights in an empty wiki when
not logged in.
I've created http://jira.xwiki.org/jira/browse/XWIKI-7581
+0 for this, simply because it would be difficult and tricky to do in the
current implementation.
After we agree on merging the new experimental security module and I got
some time to document it, I will surely open a discussion on how to evolve
the security rights, and why the empty wiki state cause other not so
pleasant issue. It is to early for now.
Thanks
-Vincent
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
--
Denis Gervalle
SOFTEC sa - CEO
eGuilde sarl - CTO
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
4:51 p.m.
On Thu, Feb 23, 2012 at 4:49 PM, Vincent Massol <vincent(a)massol.net> wrote:
On Feb 23, 2012, at 4:46 PM, Denis Gervalle wrote:
Denis just mean that a lot of wikis don't set the delete right
expecting it to be false by default (that's the case in standard XE
for example).
On Thu, Feb 23, 2012 at 16:18, Vincent Massol
<vincent(a)massol.net> wrote:
-1 to change that since it will open hole in many existing wikis.
Can you explain that?
The guest user has admin permissions so I don't see what could be worse than that.
Am I missing something?
On Feb 23, 2012, at 4:02 PM, Thomas Mortagne wrote:
Because defaulting allow for delete on the initial template of XE will
allow anyone to delete anything.
We had never set right on delete explicitly.
Right now on an empty wiki you have all the
rights except "delete"
(and register).
So this means that you have "admin" right but you don't have
"delete"
rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
Thanks
-Vincent
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
--
Thomas Mortagne
I
don't know if there was any good reason but I can't see it.
There is probably no good reason before it was implemented this way.
So +1 to have delete rights in an empty wiki when
not logged in.
I've created http://jira.xwiki.org/jira/browse/XWIKI-7581
+0 for this, simply because it would be difficult and tricky to do in the
current implementation.
After we agree on merging the new experimental security module and I got
some time to document it, I will surely open a discussion on how to evolve
the security rights, and why the empty wiki state cause other not so
pleasant issue. It is to early for now.
Thanks
-Vincent
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
--
Denis Gervalle
SOFTEC sa - CEO
eGuilde sarl - CTO
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
4:50 p.m.
On Thu, Feb 23, 2012 at 4:46 PM, Denis Gervalle <dgl(a)softec.lu> wrote:
-1 to change that since it will open hole in many existing wikis.
--
Thomas Mortagne
On Thu, Feb 23, 2012 at 16:18, Vincent Massol
<vincent(a)massol.net> wrote:
That's not a reason, that's just a way to setup the right depending of
the behavior.
On Feb 23, 2012, at 4:02 PM, Thomas Mortagne wrote:
Because defaulting allow for delete on the initial template of XE will
allow anyone to delete anything.
We had never set right on delete explicitly. Right now on an empty wiki you have all the
rights except "delete"
(and register).
So this means that you have "admin" right but you don't have
"delete"
rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
I don't know if there was any good reason but
I can't see it.
There is probably no good reason before it was implemented this way.
So +1 to have delete rights in an empty wiki when
not logged in.
I've created http://jira.xwiki.org/jira/browse/XWIKI-7581
+0 for this, simply because it would be difficult and tricky to do in the
current implementation.
After we agree on merging the new experimental security module and I got
some time to document it, I will surely open a discussion on how to evolve
the security rights, and why the empty wiki state cause other not so
pleasant issue. It is to early for now.
Thanks
-Vincent
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
--
Denis Gervalle
SOFTEC sa - CEO
eGuilde sarl - CTO
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs 
6:13 p.m.
-1
As I see it, it is the fact that admin right is allowed by default that
is an irregularity. Currently, the initial import relies on these
default admin rights, and it is expected that the imported contents
configure the admin right appropriately.
In a standard wiki-setting, I would expect that "delete", "admin",
and
"programming" are denied to most users and it seems to me natural that
the default is "deny" for these. So if this is a matter of consistency,
I would rather see a new mechanism (e.g., a special "uninitialized"
state of the wiki) to make it possible to change the default to "deny"
also for admin rights.
Best Regards,
Andreas
2012-02-23 16:02, Thomas Mortagne skrev:
Right now on an empty wiki you have all the rights
except "delete"
(and register).
So this means that you have "admin" right but you don't have
"delete" rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
6:24 p.m.
I'd also prefer to force using the superadmin user in an empty wiki and don't give
any rights by default to the guest user.
What Thomas raised was only for consistency indeed.
I personally needed to write a test in an empty wiki where I needed to delete a page.
Here's what I tried:
* Deleting the page with guest lead to the Login page
* Registering a user and trying to delete the page with it leads to a permission error
("you don't have the permission blah blah")
What I'm doing now is log with the superadmin user which I guess is the best in the
end.
The alternative is to register a user and explicitly give it the delete right or make it
admin.
Back to the VOTE, I agree that it's not good to implement and I'm also -1 now
since it would cause changes to existing wikis as Denis and Thomas explained.
Thanks
-Vincent
On Feb 23, 2012, at 6:13 PM, Andreas Jonsson wrote:
-1
As I see it, it is the fact that admin right is allowed by default that
is an irregularity. Currently, the initial import relies on these
default admin rights, and it is expected that the imported contents
configure the admin right appropriately.
In a standard wiki-setting, I would expect that "delete", "admin",
and
"programming" are denied to most users and it seems to me natural that
the default is "deny" for these. So if this is a matter of consistency,
I would rather see a new mechanism (e.g., a special "uninitialized"
state of the wiki) to make it possible to change the default to "deny"
also for admin rights.
Best Regards,
Andreas
2012-02-23 16:02, Thomas Mortagne skrev:
Right now on an empty wiki you have all the
rights except "delete"
(and register).
So this means that you have "admin" right but you don't have
"delete" rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs 
7:13 p.m.
On 02/23/2012 12:24 PM, Vincent Massol wrote:
I'd also prefer to force using the superadmin user
in an empty wiki and don't give any rights by default to the guest user.
What Thomas raised was only for consistency indeed.
I personally needed to write a test in an empty wiki where I needed to delete a page.
Here's what I tried:
* Deleting the page with guest lead to the Login page
* Registering a user and trying to delete the page with it leads to a permission error
("you don't have the permission blah blah")
You should be able to delete the document if you used the same user to
create it.
What I'm doing now is log with the superadmin user
which I guess is the best in the end.
The alternative is to register a user and explicitly give it the delete right or make it
admin.
Back to the VOTE, I agree that it's not good to implement and I'm also -1 now
since it would cause changes to existing wikis as Denis and Thomas explained.
Thanks
-Vincent
On Feb 23, 2012, at 6:13 PM, Andreas Jonsson wrote:
> -1
>
> As I see it, it is the fact that admin right is allowed by default that
> is an irregularity. Currently, the initial import relies on these
> default admin rights, and it is expected that the imported contents
> configure the admin right appropriately.
>
> In a standard wiki-setting, I would expect that "delete",
"admin", and
> "programming" are denied to most users and it seems to me natural that
> the default is "deny" for these. So if this is a matter of consistency,
> I would rather see a new mechanism (e.g., a special "uninitialized"
> state of the wiki) to make it possible to change the default to "deny"
> also for admin rights.
>
> Best Regards,
>
> Andreas
>
> 2012-02-23 16:02, Thomas Mortagne skrev:
>> Right now on an empty wiki you have all the rights except "delete"
>> (and register).
>>
>> So this means that you have "admin" right but you don't have
"delete" rights...
>>
>> This does not make much sense and I anyway I don't see why delete has
>> this special rule.
>>
>> Any idea ?
>>
>> Here is my +1 to remove the special handling of "delete" default
right.
>>
--
Sergiu Dumitriu
http://purl.org/net/sergiu/
24 Feb
24 Feb
10:53 a.m.
On Thu, Feb 23, 2012 at 18:24, Vincent Massol <vincent(a)massol.net> wrote:
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
--
Denis Gervalle
SOFTEC sa - CEO
eGuilde sarl - CTO
I'd also prefer to force using the superadmin user
in an empty wiki and
don't give any rights by default to the guest user.
Great to hear that, since this is exactly what the new implementation I
propose do !
By the way, you miss the fact that this is not the guest user, but a null
user when the wiki is empty, something even worse IMO.
The new implementation does not give any right to anyone called null.
What Thomas raised was only for consistency indeed.
I personally needed to write a test in an empty wiki where I needed to
delete a page. Here's what I tried:
* Deleting the page with guest lead to the Login page
* Registering a user and trying to delete the page with it leads to a
permission error ("you don't have the permission blah blah")
What I'm doing now is log with the superadmin user which I guess is the
best in the end.
The alternative is to register a user and explicitly give it the delete
right or make it admin.
Back to the VOTE, I agree that it's not good to implement and I'm also -1
now since it would cause changes to existing wikis as Denis and Thomas
explained.
Thanks
-Vincent
On Feb 23, 2012, at 6:13 PM, Andreas Jonsson wrote:
I fully agree with Andreas, this open the wiki to risks for just an initial
special case.
-1
As I see it, it is the fact that admin right is allowed by default that
is an irregularity. Currently, the initial import relies on these
default admin rights, and it is expected that the imported contents
configure the admin right appropriately.
In a standard wiki-setting, I would expect that "delete", "admin",
and
"programming" are denied to most users and it seems to me natural that
the default is "deny" for these. So if this is a matter of consistency,
I would rather see a new mechanism (e.g., a special "uninitialized"
state of the wiki) to make it possible to change the default to "deny"
also for admin rights.
Best Regards,
Andreas
2012-02-23 16:02, Thomas Mortagne skrev:
> Right now on an empty wiki you have all the rights except "delete"
> (and register).
>
> So this means that you have "admin" right but you don't have
"delete"
rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
23 Feb
23 Feb
7:15 p.m.
On 02/23/2012 12:13 PM, Andreas Jonsson wrote:
-1
As I see it, it is the fact that admin right is allowed by default that
is an irregularity. Currently, the initial import relies on these
default admin rights, and it is expected that the imported contents
configure the admin right appropriately.
In a standard wiki-setting, I would expect that "delete", "admin",
and
"programming" are denied to most users and it seems to me natural that
the default is "deny" for these. So if this is a matter of consistency,
I would rather see a new mechanism (e.g., a special "uninitialized"
state of the wiki) to make it possible to change the default to "deny"
also for admin rights.
Best Regards,
I agree with Andreas, so I'm -1 as well.
It's strange that the "admin" right doesn't grant delete... I'd
investigate that instead.
Andreas
2012-02-23 16:02, Thomas Mortagne skrev:
> Right now on an empty wiki you have all the rights except "delete"
> (and register).
>
> So this means that you have "admin" right but you don't have
"delete" rights...
>
> This does not make much sense and I anyway I don't see why delete has
> this special rule.
>
> Any idea ?
>
> Here is my +1 to remove the special handling of "delete" default right.
>
--
Sergiu Dumitriu
http://purl.org/net/sergiu/
7:20 p.m.
On Thu, Feb 23, 2012 at 7:15 PM, Sergiu Dumitriu <sergiu(a)xwiki.com> wrote:
--
Thomas Mortagne
On 02/23/2012 12:13 PM, Andreas Jonsson wrote:
I gives it only when you explicitly have it.
-1
As I see it, it is the fact that admin right is allowed by default that
is an irregularity. Currently, the initial import relies on these
default admin rights, and it is expected that the imported contents
configure the admin right appropriately.
In a standard wiki-setting, I would expect that "delete", "admin",
and
"programming" are denied to most users and it seems to me natural that
the default is "deny" for these. So if this is a matter of consistency,
I would rather see a new mechanism (e.g., a special "uninitialized"
state of the wiki) to make it possible to change the default to "deny"
also for admin rights.
Best Regards,
I agree with Andreas, so I'm -1 as well.
It's strange that the "admin" right doesn't grant delete... I'd
investigate
that instead. Andreas
2012-02-23 16:02, Thomas Mortagne skrev:
>
> Right now on an empty wiki you have all the rights except "delete"
> (and register).
>
> So this means that you have "admin" right but you don't have
"delete"
> rights...
>
> This does not make much sense and I anyway I don't see why delete has
> this special rule.
>
> Any idea ?
>
> Here is my +1 to remove the special handling of "delete" default right.
>
--
Sergiu Dumitriu
http://purl.org/net/sergiu/
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
7:31 p.m.
On 02/23/2012 01:20 PM, Thomas Mortagne wrote:
On Thu, Feb 23, 2012 at 7:15 PM, Sergiu
Dumitriu<sergiu(a)xwiki.com> wrote:
I'd be +1 for changing that instead, WDYT?
On 02/23/2012 12:13 PM, Andreas Jonsson wrote:
I gives it only when you explicitly have it.
-1
As I see it, it is the fact that admin right is allowed by default that
is an irregularity. Currently, the initial import relies on these
default admin rights, and it is expected that the imported contents
configure the admin right appropriately.
In a standard wiki-setting, I would expect that "delete", "admin",
and
"programming" are denied to most users and it seems to me natural that
the default is "deny" for these. So if this is a matter of consistency,
I would rather see a new mechanism (e.g., a special "uninitialized"
state of the wiki) to make it possible to change the default to "deny"
also for admin rights.
Best Regards,
I agree with Andreas, so I'm -1 as well.
It's strange that the "admin" right doesn't grant delete... I'd
investigate
that instead. >
>
>> Andreas
>>
>> 2012-02-23 16:02, Thomas Mortagne skrev:
>>>
>>> Right now on an empty wiki you have all the rights except "delete"
>>> (and register).
>>>
>>> So this means that you have "admin" right but you don't have
"delete"
>>> rights...
>>>
>>> This does not make much sense and I anyway I don't see why delete has
>>> this special rule.
>>>
>>> Any idea ?
>>>
>>> Here is my +1 to remove the special handling of "delete" default
right.
>>>
--
Sergiu Dumitriu
http://purl.org/net/sergiu/
24 Feb
24 Feb
8:37 a.m.
2012-02-23 19:31, Sergiu Dumitriu skrev:
On 02/23/2012 01:20 PM, Thomas Mortagne wrote:
+1
How the admin rights was acquired should not influence what it means to
have admin rights.
/Andreas
On Thu, Feb 23, 2012 at 7:15 PM, Sergiu
Dumitriu<sergiu(a)xwiki.com>
wrote:
I'd be +1 for changing that instead, WDYT? On 02/23/2012 12:13 PM, Andreas Jonsson wrote:
I gives it only when you explicitly have it.
-1
As I see it, it is the fact that admin right is allowed by default that
is an irregularity. Currently, the initial import relies on these
default admin rights, and it is expected that the imported contents
configure the admin right appropriately.
In a standard wiki-setting, I would expect that "delete", "admin",
and
"programming" are denied to most users and it seems to me natural that
the default is "deny" for these. So if this is a matter of
consistency,
I would rather see a new mechanism (e.g., a special "uninitialized"
state of the wiki) to make it possible to change the default to "deny"
also for admin rights.
Best Regards,
I agree with Andreas, so I'm -1 as well.
It's strange that the "admin" right doesn't grant delete... I'd
investigate
that instead. >
>
>> Andreas
>>
>> 2012-02-23 16:02, Thomas Mortagne skrev:
>>>
>>> Right now on an empty wiki you have all the rights except "delete"
>>> (and register).
>>>
>>> So this means that you have "admin" right but you don't have
"delete"
>>> rights...
>>>
>>> This does not make much sense and I anyway I don't see why delete has
>>> this special rule.
>>>
>>> Any idea ?
>>>
>>> Here is my +1 to remove the special handling of "delete" default
>>> right.
>>>
10:06 a.m.
On Thu, Feb 23, 2012 at 7:31 PM, Sergiu Dumitriu <sergiu(a)xwiki.com> wrote:
--
Thomas Mortagne
On 02/23/2012 01:20 PM, Thomas Mortagne wrote:
Sure I doubt it's done on purpose, just explaining why it does not
behave like it should. Problem is that with the current implementation
it makes the delete right test a bit more expansive since it mean redo
a test for "admin" this time when nothing is set for "delete" at the
end.
On Thu, Feb 23, 2012 at 7:15 PM, Sergiu Dumitriu<sergiu(a)xwiki.com> wrote:
I'd be +1 for changing that instead, WDYT?
On 02/23/2012 12:13 PM, Andreas Jonsson wrote:
I gives it only when you explicitly have it.
-1
As I see it, it is the fact that admin right is allowed by default that
is an irregularity. Currently, the initial import relies on these
default admin rights, and it is expected that the imported contents
configure the admin right appropriately.
In a standard wiki-setting, I would expect that "delete", "admin",
and
"programming" are denied to most users and it seems to me natural that
the default is "deny" for these. So if this is a matter of consistency,
I would rather see a new mechanism (e.g., a special "uninitialized"
state of the wiki) to make it possible to change the default to "deny"
also for admin rights.
Best Regards,
I agree with Andreas, so I'm -1 as well.
It's strange that the "admin" right doesn't grant delete... I'd
investigate
that instead. >
>
>> Andreas
>>
>> 2012-02-23 16:02, Thomas Mortagne skrev:
>>>
>>>
>>> Right now on an empty wiki you have all the rights except "delete"
>>> (and register).
>>>
>>> So this means that you have "admin" right but you don't have
"delete"
>>> rights...
>>>
>>> This does not make much sense and I anyway I don't see why delete has
>>> this special rule.
>>>
>>> Any idea ?
>>>
>>> Here is my +1 to remove the special handling of "delete" default
right.
>>>
--
Sergiu Dumitriu
http://purl.org/net/sergiu/
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs 
9:21 a.m.
-1 because allowing delete by default open as hole to guest and
crawlers in particular.
Very dangerous. We had the issue with "undelete" which does not follow
the same rule.
I'm +1 for changing undelete to forbidden by default
As for admin the only reason was to be able to fill the wiki in the
beginning. It's true that it's a hole too.
I'm +1 for changing admin to forbidden by default as our default wiki
has the right settings.
It would be great though to have a better solution to fill the wiki
than using superadmin.
Ludovic
2012/2/23 Andreas Jonsson <aj(a)member.fsf.org>rg>:
-1
As I see it, it is the fact that admin right is allowed by default that
is an irregularity. Currently, the initial import relies on these
default admin rights, and it is expected that the imported contents
configure the admin right appropriately.
In a standard wiki-setting, I would expect that "delete", "admin",
and
"programming" are denied to most users and it seems to me natural that
the default is "deny" for these. So if this is a matter of consistency,
I would rather see a new mechanism (e.g., a special "uninitialized"
state of the wiki) to make it possible to change the default to "deny"
also for admin rights.
Best Regards,
Andreas
2012-02-23 16:02, Thomas Mortagne skrev:
--
Ludovic Dubost
Founder and CEO
Blog: http://blog.ludovic.org/
XWiki: http://www.xwiki.com
Skype: ldubost GTalk: ldubost
Right now on an empty wiki you have all the
rights except "delete"
(and register).
So this means that you have "admin" right but you don't have
"delete" rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
11:21 a.m.
On Fri, Feb 24, 2012 at 09:21, Ludovic Dubost <ludovic(a)xwiki.com> wrote:
-1 because allowing delete by default open as hole to
guest and
crawlers in particular.
Very dangerous. We had the issue with "undelete" which does not follow
the same rule.
I'm +1 for changing undelete to forbidden by default
As for admin the only reason was to be able to fill the wiki in the
beginning. It's true that it's a hole too.
I'm +1 for changing admin to forbidden by default as our default wiki
has the right settings.
It would be great though to have a better solution to fill the wiki
than using superadmin.
If we found a good way to have null be the superadmin when the wiki need it
so, I am +1.
But we really need to be sure this solution is safe and could not be
triggered by trickery.
Ludovic
2012/2/23 Andreas Jonsson <aj(a)member.fsf.org>rg>:
--
Ludovic Dubost
Founder and CEO
Blog: http://blog.ludovic.org/
XWiki: http://www.xwiki.com
Skype: ldubost GTalk: ldubost
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
--
Denis Gervalle
SOFTEC sa - CEO
eGuilde sarl - CTO
-1
As I see it, it is the fact that admin right is allowed by default that
is an irregularity. Currently, the initial import relies on these
default admin rights, and it is expected that the imported contents
configure the admin right appropriately.
In a standard wiki-setting, I would expect that "delete", "admin",
and
"programming" are denied to most users and it seems to me natural that
the default is "deny" for these. So if this is a matter of consistency,
I would rather see a new mechanism (e.g., a special "uninitialized"
state of the wiki) to make it possible to change the default to "deny"
also for admin rights.
Best Regards,
Andreas
2012-02-23 16:02, Thomas Mortagne skrev:
> Right now on an empty wiki you have all the rights except "delete"
> (and register).
>
> So this means that you have "admin" right but you don't have
"delete"
rights...
This does not make much sense and I anyway I don't see why delete has
this special rule.
Any idea ?
Here is my +1 to remove the special handling of "delete" default right.
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
4588
days inactive
4589
days old
17 comments
7 participants
participants (7)
-
Andreas Jonsson -
Denis Gervalle -
Eduard Moraru -
Ludovic Dubost -
Sergiu Dumitriu -
Thomas Mortagne -
Vincent Massol