Niels Mayer wrote:

Lets say you delete a spam user, e.g. /xwiki/bin/view/XWiki/xanax via the administration tools. You then log out as admin.

Now, as an unregistered user, browse /xwiki/bin/view/XWiki/xanax

You'll be given a link to 'Restore' the deleted file e.g. /xwiki/bin/undelete/XWiki/xanax?id=47

When an unregistered user clicks 'Restore' the file is restored (!! bug !!).

Fortunately if the "restored" account is used for login, the user can't view or edit any files. IMHO there ought to be an additional option on deleting users which will also remove the account from the recyclebin or not recycle accounts.

Unfortunately, if there's a file you wanted deleted, apparently an unregistered user will be able to find out it was there (say, through a search engine), and restore it if they want to.

This is on 1.8RC2.

This was fixed in the next administration XAR (a global rights object in XWiki.XWikiPreferences). To fix this in existing wikis, you must edit the global rights using the object editor (since the undelete right does not appear in the GUI version), and also select the 'undelete' right on the rule that grants AdminGroup or AllGroup edit rights. -- Sergiu Dumitriu http://purl.org/net/sergiu/