AFAIK we allow holes so it shouldn’t be a problem. Thanks -Vincent On 10 Apr 2014 at 11:31:54, Caleb James DeLisle ([email protected](mailto:[email protected])) wrote:

IMO this should return an http error (and set errno to EINVAL ;) ) if there are holes in the number set. It's up to the caller to send sane inputs.

+1 to the overall idea.

Thanks, Caleb

On 04/10/2014 10:59 AM, Marius Dumitru Florea wrote:

...

So if I put XWiki.XWikiRights_56_users on the request and there's no rights object what do you do? Create an object with number 0? Create an object with number 56? And if you want to add a new object how would you know the object number to put on the request so that you don't update existing objects instead?

The current behaviour is this:

1) You ask the system to add a new object (i.e. allocate an object number) using the object add action, possibly passing property values like this

XWiki.XWikiRights_users = XWiki.Me

2) You use the allocated number to update the object, passing property values like this

XWiki.XWikiRights_N_users = XWiki.Me

where N is the allocated object number.

What you want is to do this in a single step, but you won't know/control if the object is added or updated.

Thanks, Marius

On Thu, Apr 10, 2014 at 11:36 AM, Jean SIMARD wrote:

...

Hi devs,

In XWiki, if you send a POST request at the following URL ('MySpace.MyPage' is a document that doesn't exist at the moment)

/bin/save/MySpace/MyPage

with the following HTTP parameters:

* template=MySpace.MyTemplate * XWiki.XWikiRights_0_users=XWiki.Me *

with 'MySpace.MyTemplate' a template document and 'XWiki.Me' a user of the wiki.

2 cases:

1. If 'MySpace.MyTemplate' contains a 'XWiki.XWikiRights' object, then the resulting document 'MySpace.MyPage' will have this object with its property 'users' initialize with the value 'XWiki.Me' (see HTTP parameters) 2. If 'MySpace.MyTemplate' does not contain a 'XWiki.XWikiRights' object, the resulting document 'MySpace.MyPage' will not contain it either

### PROPOSAL Create automatically the objects if they don't exist in the template document. ###

To make it possible, it seems that we would need to refactor the method 'readObjectsFromForm(EditForm, XWikiContext)' in the 'com.xpn.xwiki.doc.XWikiDocument' class. And probably modify also the 'getObject(String)' from 'com.xpn.xwiki.web.EditForm' class.

2 things to take care: * It seems there is no unit test for these methods. * May this proposal be a security problem?

WDYT? -- Jean

_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs

---

devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs

_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs

Sometimes it's important to be able to decide if the user wants an existing object by number, an existing object by filter, always a new object, or an existing or new object. So the request needs to be more complex. New special request parameters proposal: withXObject=<identifier> <identifier>/<keyword>=<value> <identifier>_<propertyName>=<propertyValue> <identifier>_<propertyName>/parsed=<string with Velocity> An <identifier> is a transparent string, it can be either a randomly generated string, or a sequence number such as obj42. We define the accepted <keyword>s, for example: - <identifier>/action=find | create | findOrCreate | delete - <identifier>/match=<propName>/<value> (can appear multiple times to filter by multiple properties) - <identifier>/matchMode=exclusive | and | or (default exclusive) - <identifier>/select=first | all (default first) - <identifier>/type=<xclass name> - <identifier>/updateMode=replace | append (default replace) The new <identifier>_<propertyName>/parsed syntax allows to set properties based on the generated data, such as the number of a different object created in the same request. This requires a second pass through the parameters after the standard readObjectsFromForm completes. The Velocity context will be populated with the standard API objects ($xwiki, $xcontext, $services, $doc, $tdoc, $request, $response...), plus the objects / attachments named in the request. If /select=all, then a list with the matches is placed in the context. For example: /save/Some/Page?withXObject=xr1 &xr1/action=findOrCreate &xr1/type=XWiki.XWikiRights &xr1/match=users/XWiki.jdoe &xr1/match=allow/1 &xr1_levels=view &xr1_levels=comment &withXObject=xr2 &xr2/action=findOrCreate &xr2/type=XWiki.XWikiRights &xr2/match=users/XWiki.jdoe &xr2/match=allow/0 &xr2_levels=edit ^ This searches for a rights object that specifies allow rights for the user jdoe. If the object exists, it replaces the levels with "view and edit". If it doesn't exist, it creates a new one, fills in the "users" and "allow" properties to the values specified in the match filter, and sets "levels" to "view and edit". Then it searches for a rights object that specifies deny rights for the same user, and updates or creates... Another example: /save/Some/Page?withXObject=comments &comments/action=delete &comments/type=XWiki.XWikiComment &comments/match=author/XWiki.jdoe &comments/match=author/xwiki:XWiki.jdoe &comments/matchMode=or &comments/select=all ^ This searches for all comments posted by jdoe, wiki-prefixed or not, and deletes them. One more: /save/Some/Page?withAttachment=upload1 &upload1/input=file &withXObject=photo1 &photo1/action=create &photo1/type=Media.PhotoClass &photo1_file/parsed=${upload1.filename} &photo1_author=Yousuf Karsh &photo1_date=1957-03-21 &withXObject=meta1 &meta1/action=create &meta1/type=Media.AnnotationClass &meta1_target/parsed=Media.PhotoClass_${photo1.number}/rect(130,92,830,1232) &meta1_comment=The contrast here is fantastic! &meta1_author/parsed=${xcontext.userReference} In one request, this uploads an image, creates a PhotoClass holding information about the attachment, and an annotation for that PhotoClass with a comment. On 04/10/2014 06:00 AM, Jean SIMARD wrote:

Yes, I won't know if it's updated or created.

Now, using 'XWiki.XWikiRights_users = XWiki.Me' would not be sufficient for the use case; what happens if you want to create 2 objects 'XWiki.XWikiRights'?

Can we imagine to introduce a new notation to explicitly mean that you want to create a new object, like 'new_XWiki.XWikiRights_0_users' or 'XWiki.XWikiRights_new_0_users' or 'XWiki.XWikiRights_n0_users'?

This way, we can filter as following: * If you try to update an object with 'XWiki.XWikiRights_0_users' and the object #0 exists, the property is updated (use case already existing) * If you try to update an object with 'XWiki.XWikiRights_0_users' and the object #0 doesn't exist, the parameter has no effect (use case already existing) * If you try to create an object with 'new_XWiki.XWikiRights_0_users' and the object #0 exists, the parameter has no effect * If you try to create an object with 'new_XWiki.XWikiRights_0_users' and the object #0 doesn't exist, the object is created and the property initialized

Thanks -- Jean

On jeu., 2014-04-10 at 11:59 +0300, Marius Dumitru Florea wrote:

...

So if I put XWiki.XWikiRights_56_users on the request and there's no rights object what do you do? Create an object with number 0? Create an object with number 56? And if you want to add a new object how would you know the object number to put on the request so that you don't update existing objects instead?

The current behaviour is this:

1) You ask the system to add a new object (i.e. allocate an object number) using the object add action, possibly passing property values like this

XWiki.XWikiRights_users = XWiki.Me

2) You use the allocated number to update the object, passing property values like this

XWiki.XWikiRights_N_users = XWiki.Me

where N is the allocated object number.

What you want is to do this in a single step, but you won't know/control if the object is added or updated.

Thanks, Marius

On Thu, Apr 10, 2014 at 11:36 AM, Jean SIMARD <[email protected]> wrote:

...

Hi devs,

In XWiki, if you send a POST request at the following URL ('MySpace.MyPage' is a document that doesn't exist at the moment)

/bin/save/MySpace/MyPage

with the following HTTP parameters:

* template=MySpace.MyTemplate * XWiki.XWikiRights_0_users=XWiki.Me * <others parameters>

with 'MySpace.MyTemplate' a template document and 'XWiki.Me' a user of the wiki.

2 cases:

1. If 'MySpace.MyTemplate' contains a 'XWiki.XWikiRights' object, then the resulting document 'MySpace.MyPage' will have this object with its property 'users' initialize with the value 'XWiki.Me' (see HTTP parameters) 2. If 'MySpace.MyTemplate' does not contain a 'XWiki.XWikiRights' object, the resulting document 'MySpace.MyPage' will not contain it either

### PROPOSAL Create automatically the objects if they don't exist in the template document. ###

To make it possible, it seems that we would need to refactor the method 'readObjectsFromForm(EditForm, XWikiContext)' in the 'com.xpn.xwiki.doc.XWikiDocument' class. And probably modify also the 'getObject(String)' from 'com.xpn.xwiki.web.EditForm' class.

2 things to take care: * It seems there is no unit test for these methods. * May this proposal be a security problem?

WDYT? -- Jean

-- Sergiu Dumitriu http://purl.org/net/sergiu

IMO it's a very bad idea to rely more and more on our page locking system as it makes any effort of moving away from it more difficult. Also, what if the document to be saved is not opened in edit mode prior to the save, thus no locking ever occurs? There is no way for a client to determine the ID of the new object in a safe way, the most probable result in a busy wiki being data loss due to concurrency issues and users overriding each other's freshly created objects. I think we can find quite a few of these cases where some javascript calls the save action from view mode. Thanks, Eduard On Fri, Apr 11, 2014 at 11:32 AM, [email protected] <[email protected]> wrote:

Sounds nice and would solve http://jira.xwiki.org/browse/XWIKI-217 nicely :)

Thanks -Vincent

On 10 Apr 2014 at 22:37:36, Sergiu Dumitriu ([email protected](mailto: [email protected])) wrote:

...

Sometimes it's important to be able to decide if the user wants an existing object by number, an existing object by filter, always a new object, or an existing or new object. So the request needs to be more complex.

New special request parameters proposal:

withXObject= /= _= _/parsed=

An is a transparent string, it can be either a randomly generated string, or a sequence number such as obj42.

We define the accepted s, for example: - /action=find | create | findOrCreate | delete - /match=/ (can appear multiple times to filter by multiple properties) - /matchMode=exclusive | and | or (default exclusive) - /select=first | all (default first) - /type= - /updateMode=replace | append (default replace)

The new _/parsed syntax allows to set properties based on the generated data, such as the number of a different object created in the same request. This requires a second pass through the parameters after the standard readObjectsFromForm completes. The Velocity context will be populated with the standard API objects ($xwiki, $xcontext, $services, $doc, $tdoc, $request, $response...), plus the objects / attachments named in the request. If /select=all, then a list with the matches is placed in the context.

For example:

/save/Some/Page?withXObject=xr1 &xr1/action=findOrCreate &xr1/type=XWiki.XWikiRights &xr1/match=users/XWiki.jdoe &xr1/match=allow/1 &xr1_levels=view &xr1_levels=comment &withXObject=xr2 &xr2/action=findOrCreate &xr2/type=XWiki.XWikiRights &xr2/match=users/XWiki.jdoe &xr2/match=allow/0 &xr2_levels=edit

^ This searches for a rights object that specifies allow rights for the user jdoe. If the object exists, it replaces the levels with "view and edit". If it doesn't exist, it creates a new one, fills in the "users" and "allow" properties to the values specified in the match filter, and sets "levels" to "view and edit". Then it searches for a rights object that specifies deny rights for the same user, and updates or creates...

Another example:

/save/Some/Page?withXObject=comments &comments/action=delete &comments/type=XWiki.XWikiComment &comments/match=author/XWiki.jdoe &comments/match=author/xwiki:XWiki.jdoe &comments/matchMode=or &comments/select=all

^ This searches for all comments posted by jdoe, wiki-prefixed or not, and deletes them.

One more:

/save/Some/Page?withAttachment=upload1 &upload1/input=file &withXObject=photo1 &photo1/action=create &photo1/type=Media.PhotoClass &photo1_file/parsed=${upload1.filename} &photo1_author=Yousuf Karsh &photo1_date=1957-03-21 &withXObject=meta1 &meta1/action=create &meta1/type=Media.AnnotationClass

&meta1_target/parsed=Media.PhotoClass_${photo1.number}/rect(130,92,830,1232)

...

&meta1_comment=The contrast here is fantastic! &meta1_author/parsed=${xcontext.userReference}

In one request, this uploads an image, creates a PhotoClass holding information about the attachment, and an annotation for that PhotoClass with a comment.

On 04/10/2014 06:00 AM, Jean SIMARD wrote:

...

Yes, I won't know if it's updated or created.

Now, using 'XWiki.XWikiRights_users = XWiki.Me' would not be sufficient for the use case; what happens if you want to create 2 objects 'XWiki.XWikiRights'?

Can we imagine to introduce a new notation to explicitly mean that you want to create a new object, like 'new_XWiki.XWikiRights_0_users' or 'XWiki.XWikiRights_new_0_users' or 'XWiki.XWikiRights_n0_users'?

This way, we can filter as following: * If you try to update an object with 'XWiki.XWikiRights_0_users' and the object #0 exists, the property is updated (use case already existing) * If you try to update an object with 'XWiki.XWikiRights_0_users' and the object #0 doesn't exist, the parameter has no effect (use case already existing) * If you try to create an object with 'new_XWiki.XWikiRights_0_users' and the object #0 exists, the parameter has no effect * If you try to create an object with 'new_XWiki.XWikiRights_0_users' and the object #0 doesn't exist, the object is created and the property initialized

Thanks -- Jean

On jeu., 2014-04-10 at 11:59 +0300, Marius Dumitru Florea wrote:

...

So if I put XWiki.XWikiRights_56_users on the request and there's no rights object what do you do? Create an object with number 0? Create an object with number 56? And if you want to add a new object how would you know the object number to put on the request so that you don't update existing objects instead?

The current behaviour is this:

1) You ask the system to add a new object (i.e. allocate an object number) using the object add action, possibly passing property values like this

XWiki.XWikiRights_users = XWiki.Me

2) You use the allocated number to update the object, passing property values like this

XWiki.XWikiRights_N_users = XWiki.Me

where N is the allocated object number.

What you want is to do this in a single step, but you won't know/control if the object is added or updated.

Thanks, Marius

On Thu, Apr 10, 2014 at 11:36 AM, Jean SIMARD wrote:

...

Hi devs,

In XWiki, if you send a POST request at the following URL ('MySpace.MyPage' is a document that doesn't exist at the moment)

/bin/save/MySpace/MyPage

with the following HTTP parameters:

* template=MySpace.MyTemplate * XWiki.XWikiRights_0_users=XWiki.Me *

with 'MySpace.MyTemplate' a template document and 'XWiki.Me' a user of the wiki.

2 cases:

1. If 'MySpace.MyTemplate' contains a 'XWiki.XWikiRights' object, then the resulting document 'MySpace.MyPage' will have this object with its property 'users' initialize with the value 'XWiki.Me' (see HTTP parameters) 2. If 'MySpace.MyTemplate' does not contain a 'XWiki.XWikiRights' object, the resulting document 'MySpace.MyPage' will not contain it either

### PROPOSAL Create automatically the objects if they don't exist in the template document. ###

To make it possible, it seems that we would need to refactor the method 'readObjectsFromForm(EditForm, XWikiContext)' in the 'com.xpn.xwiki.doc.XWikiDocument' class. And probably modify also the 'getObject(String)' from 'com.xpn.xwiki.web.EditForm' class.

2 things to take care: * It seems there is no unit test for these methods. * May this proposal be a security problem?

WDYT? -- Jean

_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs

I like the idea of introducing an "objectCreationPolicy" parameter. This way, we can introduce any new strategy (like the nice one proposed by Sergiu for example) for update/create objects with a new keyword ('oldcore' [default strategy if 'objectCreationPolicy' is not given], 'updateOrCreate' or 'SergiuStrategy' ;-) ). Yesterday, I began to write unit tests for what already exists (what would be the default 'oldcore' strategy). Today, I will try to produce the small inputs I was proposing mixed with what Fabio proposed. Fabio and I need this functionality on our projects anyway. Thanks, -- Jean On ven., 2014-04-11 at 08:39 +0200, Fabio Mancinelli wrote:

Hi,

I was thinking that instead of introducing a new notation, we might add a parameter like "objectCreationPolicy=update|updateOrCreate|...".

If this parameter is not present everything works as today. If this parameter is present we might choose what to do.

So it's up to the user to decide what to put there.

The object editor, for example, would put objectCreationPolicy=updateOrCreate and use the standard notation to send POST data.

Objects will be updated or created according to the fact that they already exists or not.

The only problem I foresee are race conditions between create/update behaviour depending on multiple users editing the same page... Today we have locks that should prevent this. In the future I don't know - but I guess even the current behaviour is problematic from this point of view.

Thanks, Fabio

On Thu, Apr 10, 2014 at 12:00 PM, Jean SIMARD <[email protected]> wrote:

...

Yes, I won't know if it's updated or created.

Now, using 'XWiki.XWikiRights_users = XWiki.Me' would not be sufficient for the use case; what happens if you want to create 2 objects 'XWiki.XWikiRights'?

Can we imagine to introduce a new notation to explicitly mean that you want to create a new object, like 'new_XWiki.XWikiRights_0_users' or 'XWiki.XWikiRights_new_0_users' or 'XWiki.XWikiRights_n0_users'?

This way, we can filter as following: * If you try to update an object with 'XWiki.XWikiRights_0_users' and the object #0 exists, the property is updated (use case already existing) * If you try to update an object with 'XWiki.XWikiRights_0_users' and the object #0 doesn't exist, the parameter has no effect (use case already existing) * If you try to create an object with 'new_XWiki.XWikiRights_0_users' and the object #0 exists, the parameter has no effect * If you try to create an object with 'new_XWiki.XWikiRights_0_users' and the object #0 doesn't exist, the object is created and the property initialized

Thanks -- Jean

On jeu., 2014-04-10 at 11:59 +0300, Marius Dumitru Florea wrote:

...

So if I put XWiki.XWikiRights_56_users on the request and there's no rights object what do you do? Create an object with number 0? Create an object with number 56? And if you want to add a new object how would you know the object number to put on the request so that you don't update existing objects instead?

The current behaviour is this:

1) You ask the system to add a new object (i.e. allocate an object number) using the object add action, possibly passing property values like this

XWiki.XWikiRights_users = XWiki.Me

2) You use the allocated number to update the object, passing property values like this

XWiki.XWikiRights_N_users = XWiki.Me

where N is the allocated object number.

What you want is to do this in a single step, but you won't know/control if the object is added or updated.

Thanks, Marius

On Thu, Apr 10, 2014 at 11:36 AM, Jean SIMARD <[email protected]> wrote:

...

Hi devs,

In XWiki, if you send a POST request at the following URL ('MySpace.MyPage' is a document that doesn't exist at the moment)

/bin/save/MySpace/MyPage

with the following HTTP parameters:

* template=MySpace.MyTemplate * XWiki.XWikiRights_0_users=XWiki.Me * <others parameters>

with 'MySpace.MyTemplate' a template document and 'XWiki.Me' a user of the wiki.

2 cases:

1. If 'MySpace.MyTemplate' contains a 'XWiki.XWikiRights' object, then the resulting document 'MySpace.MyPage' will have this object with its property 'users' initialize with the value 'XWiki.Me' (see HTTP parameters) 2. If 'MySpace.MyTemplate' does not contain a 'XWiki.XWikiRights' object, the resulting document 'MySpace.MyPage' will not contain it either

### PROPOSAL Create automatically the objects if they don't exist in the template document. ###

To make it possible, it seems that we would need to refactor the method 'readObjectsFromForm(EditForm, XWikiContext)' in the 'com.xpn.xwiki.doc.XWikiDocument' class. And probably modify also the 'getObject(String)' from 'com.xpn.xwiki.web.EditForm' class.

2 things to take care: * It seems there is no unit test for these methods. * May this proposal be a security problem?

WDYT? -- Jean

_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs

---

devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs

_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs

---

devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs