[xwiki-devs] [VOTE] Allow anyone to use org.xwiki.query.Query#setWiki
Hi devs, When Query Manager as been introduced by Artem I suggested to add a setWiki to make easier to execute request on another wiki. For me it was supposed to be usable by anyone and I discovered recently that it was allowed only when the user has programming right. Since I really don't see the point I propose to remove this check. * all the users without programming right can do is to list documents names so it's not very dangerous * api;XWiki#searchDocumentsNames(String wikiName, String parameterizedWhereClause, int maxResults, int startOffset, List< ? > parameterValues) does not have any check so what the query manager prevent is doable anyway WDYT ? Here is my +1. -- Thomas Mortagne
+1 Thanks, Marius On Mon, Apr 23, 2012 at 12:10 PM, Thomas Mortagne <[email protected]> wrote:
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a setWiki to make easier to execute request on another wiki. For me it was supposed to be usable by anyone and I discovered recently that it was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents names so it's not very dangerous * api;XWiki#searchDocumentsNames(String wikiName, String parameterizedWhereClause, int maxResults, int startOffset, List< ? > parameterValues) does not have any check so what the query manager prevent is doable anyway
WDYT ?
Here is my +1.
-- Thomas Mortagne _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
+1 On Mon, Apr 23, 2012 at 11:10 AM, Thomas Mortagne <[email protected]> wrote:
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a setWiki to make easier to execute request on another wiki. For me it was supposed to be usable by anyone and I discovered recently that it was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents names so it's not very dangerous * api;XWiki#searchDocumentsNames(String wikiName, String parameterizedWhereClause, int maxResults, int startOffset, List< ? > parameterValues) does not have any check so what the query manager prevent is doable anyway
WDYT ?
Here is my +1.
-- Thomas Mortagne _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Jean-Vincent Drean, XWiki.
3 +1, done. On Mon, Apr 23, 2012 at 11:10 AM, Thomas Mortagne <[email protected]> wrote:
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a setWiki to make easier to execute request on another wiki. For me it was supposed to be usable by anyone and I discovered recently that it was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents names so it's not very dangerous * api;XWiki#searchDocumentsNames(String wikiName, String parameterizedWhereClause, int maxResults, int startOffset, List< ? > parameterValues) does not have any check so what the query manager prevent is doable anyway
WDYT ?
Here is my +1.
-- Thomas Mortagne
-- Thomas Mortagne
On Apr 23, 2012, at 11:10 AM, Thomas Mortagne wrote:
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a setWiki to make easier to execute request on another wiki. For me it was supposed to be usable by anyone and I discovered recently that it was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents names so it's not very dangerous
* api;XWiki#searchDocumentsNames(String wikiName, String parameterizedWhereClause, int maxResults, int startOffset, List< ? > parameterValues) does not have any check so what the query manager prevent is doable anyway
Yes and that's not very good. I'm pretty sure I've seen some JIRA issues opened to prevent this. So while I'm ok to have consistent APIs we also need to think how to fix this in the future. We would need an extra fast way to check if a user is allowed to view a given document name. And then if not, return a special ForbiddenDocument document so that we always return the number of items asked by execute(). Thanks -Vincent
On Thu, May 3, 2012 at 4:13 PM, Vincent Massol <[email protected]> wrote:
On Apr 23, 2012, at 11:10 AM, Thomas Mortagne wrote:
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a setWiki to make easier to execute request on another wiki. For me it was supposed to be usable by anyone and I discovered recently that it was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents names so it's not very dangerous
* api;XWiki#searchDocumentsNames(String wikiName, String parameterizedWhereClause, int maxResults, int startOffset, List< ? > parameterValues) does not have any check so what the query manager prevent is doable anyway
Yes and that's not very good. I'm pretty sure I've seen some JIRA issues opened to prevent this.
So while I'm ok to have consistent APIs we also need to think how to fix this in the future. We would need an extra fast way to check if a user is allowed to view a given document name. And then if not, return a special ForbiddenDocument document so that we always return the number of items asked by execute().
Probably but that's another subject. You have the same issue in the current wiki so it does not really have anything to do with multiwiki.
Thanks -Vincent
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne
On May 3, 2012, at 4:37 PM, Thomas Mortagne wrote:
On Thu, May 3, 2012 at 4:13 PM, Vincent Massol <[email protected]> wrote:
On Apr 23, 2012, at 11:10 AM, Thomas Mortagne wrote:
Hi devs,
When Query Manager as been introduced by Artem I suggested to add a setWiki to make easier to execute request on another wiki. For me it was supposed to be usable by anyone and I discovered recently that it was allowed only when the user has programming right.
Since I really don't see the point I propose to remove this check.
* all the users without programming right can do is to list documents names so it's not very dangerous
* api;XWiki#searchDocumentsNames(String wikiName, String parameterizedWhereClause, int maxResults, int startOffset, List< ? > parameterValues) does not have any check so what the query manager prevent is doable anyway
Yes and that's not very good. I'm pretty sure I've seen some JIRA issues opened to prevent this.
So while I'm ok to have consistent APIs we also need to think how to fix this in the future. We would need an extra fast way to check if a user is allowed to view a given document name. And then if not, return a special ForbiddenDocument document so that we always return the number of items asked by execute().
Probably but that's another subject. You have the same issue in the current wiki so it does not really have anything to do with multiwiki.
It's worse since multiwiki can be used in a farm which each wiki belonging to a different company for example (possibly competitors) and they shouldn't see each other's documents. Thanks -Vincent
participants (4)
-
Jean-Vincent Drean -
Marius Dumitru Florea -
Thomas Mortagne -
Vincent Massol