23 Apr
2012
23 Apr
'12
11:10 a.m.
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a
setWiki to make easier to execute request on another wiki. For me it
was supposed to be usable by anyone and I discovered recently that it
was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents
names so it's not very dangerous
* api;XWiki#searchDocumentsNames(String wikiName, String
parameterizedWhereClause, int maxResults, int startOffset, List< ? >
parameterValues) does not have any check so what the query manager
prevent is doable anyway
WDYT ?
Here is my +1.
--
Thomas Mortagne
23 Apr
23 Apr
11:46 a.m.
+1
Thanks,
Marius
On Mon, Apr 23, 2012 at 12:10 PM, Thomas Mortagne
<thomas.mortagne(a)xwiki.com> wrote:
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a
setWiki to make easier to execute request on another wiki. For me it
was supposed to be usable by anyone and I discovered recently that it
was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents
names so it's not very dangerous
* api;XWiki#searchDocumentsNames(String wikiName, String
parameterizedWhereClause, int maxResults, int startOffset, List< ? >
parameterValues) does not have any check so what the query manager
prevent is doable anyway
WDYT ?
Here is my +1.
--
Thomas Mortagne
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
24 Apr
24 Apr
11:55 a.m.
+1
On Mon, Apr 23, 2012 at 11:10 AM, Thomas Mortagne
<thomas.mortagne(a)xwiki.com> wrote:
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a
setWiki to make easier to execute request on another wiki. For me it
was supposed to be usable by anyone and I discovered recently that it
was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents
names so it's not very dangerous
* api;XWiki#searchDocumentsNames(String wikiName, String
parameterizedWhereClause, int maxResults, int startOffset, List< ? >
parameterValues) does not have any check so what the query manager
prevent is doable anyway
WDYT ?
Here is my +1.
--
Thomas Mortagne
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
--
Jean-Vincent Drean,
XWiki.
3 May
3 May
4:08 p.m.
3 +1, done.
On Mon, Apr 23, 2012 at 11:10 AM, Thomas Mortagne
<thomas.mortagne(a)xwiki.com> wrote:
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a
setWiki to make easier to execute request on another wiki. For me it
was supposed to be usable by anyone and I discovered recently that it
was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents
names so it's not very dangerous
* api;XWiki#searchDocumentsNames(String wikiName, String
parameterizedWhereClause, int maxResults, int startOffset, List< ? >
parameterValues) does not have any check so what the query manager
prevent is doable anyway
WDYT ?
Here is my +1.
--
Thomas Mortagne
--
Thomas Mortagne
4:13 p.m.
On Apr 23, 2012, at 11:10 AM, Thomas Mortagne wrote:
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a
setWiki to make easier to execute request on another wiki. For me it
was supposed to be usable by anyone and I discovered recently that it
was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents
names so it's not very dangerous
* api;XWiki#searchDocumentsNames(String wikiName,
String
parameterizedWhereClause, int maxResults, int startOffset, List< ? >
parameterValues) does not have any check so what the query manager
prevent is doable anyway
Yes and that's not very good. I'm pretty sure I've seen some JIRA issues
opened to prevent this.
So while I'm ok to have consistent APIs we also need to think how to fix this in the
future. We would need an extra fast way to check if a user is allowed to view a given
document name. And then if not, return a special ForbiddenDocument document so that we
always return the number of items asked by execute().
Thanks
-Vincent
4:37 p.m.
On Thu, May 3, 2012 at 4:13 PM, Vincent Massol <vincent(a)massol.net> wrote:
On Apr 23, 2012, at 11:10 AM, Thomas Mortagne wrote:
Probably but that's another subject. You have the same issue in the
current wiki so it does not really have anything to do with multiwiki.
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a
setWiki to make easier to execute request on another wiki. For me it
was supposed to be usable by anyone and I discovered recently that it
was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents
names so it's not very dangerous
* api;XWiki#searchDocumentsNames(String wikiName,
String
parameterizedWhereClause, int maxResults, int startOffset, List< ? >
parameterValues) does not have any check so what the query manager
prevent is doable anyway
Yes and that's not very good. I'm pretty sure I've seen some JIRA issues
opened to prevent this.
So while I'm ok to have consistent APIs we also need to think how to fix this in the
future. We would need an extra fast way to check if a user is allowed to view a given
document name. And then if not, return a special ForbiddenDocument document so that we
always return the number of items asked by execute().
Thanks
-Vincent
_______________________________________________
devs mailing list
devs(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/devs
--
Thomas Mortagne
6:16 p.m.
On May 3, 2012, at 4:37 PM, Thomas Mortagne wrote:
On Thu, May 3, 2012 at 4:13 PM, Vincent Massol
<vincent(a)massol.net> wrote:
It's worse since multiwiki can be used in a farm which each wiki belonging to a
different company for example (possibly competitors) and they shouldn't see each
other's documents.
Thanks
-Vincent
On Apr 23, 2012, at 11:10 AM, Thomas Mortagne wrote:
Probably but that's another subject. You have the same issue in the
current wiki so it does not really have anything to do with multiwiki. Hi devs,
When Query Manager as been introduced by Artem I suggested to add a
setWiki to make easier to execute request on another wiki. For me it
was supposed to be usable by anyone and I discovered recently that it
was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents
names so it's not very dangerous
* api;XWiki#searchDocumentsNames(String wikiName,
String
parameterizedWhereClause, int maxResults, int startOffset, List< ? >
parameterValues) does not have any check so what the query manager
prevent is doable anyway
Yes and that's not very good. I'm pretty sure I've seen some JIRA issues
opened to prevent this.
So while I'm ok to have consistent APIs we also need to think how to fix this in the
future. We would need an extra fast way to check if a user is allowed to view a given
document name. And then if not, return a special ForbiddenDocument document so that we
always return the number of items asked by execute().
4519
days inactive
4529
days old
6 comments
4 participants
participants (4)
-
Jean-Vincent Drean -
Marius Dumitru Florea -
Thomas Mortagne -
Vincent Massol