[xwiki-devs] [Proposal] Object addition/removal/update shouldn't change content author
Hi, According to the javadoc in XWikiDocument: /** * The last user that has changed the document's content (ie not object, attachments). The Content author is only * changed when the document content changes. Note that Content Author is used to check programming rights on a * document and this is the reason we need to know the last author who's modified the content since programming * rights depend on this. */ private DocumentReference contentAuthorReference; This means that objectadd or objectremove actions shouldn't change the content author as they do now. I'm proposing that we fix this. Do you see any issue? Thanks -Vincent
Hi Vincent, On 06/13/2013 11:08 AM, Vincent Massol wrote:
Hi,
According to the javadoc in XWikiDocument:
/** * The last user that has changed the document's content (ie not object, attachments). The Content author is only * changed when the document content changes. Note that Content Author is used to check programming rights on a * document and this is the reason we need to know the last author who's modified the content since programming * rights depend on this. */ private DocumentReference contentAuthorReference;
This means that objectadd or objectremove actions shouldn't change the content author as they do now.
this would mean add and remove object, but not update. Still, the subject of the mail mentions object update as well. Which one is it?
I'm proposing that we fix this.
Do you see any issue?
I can think of some documents that need programming rights and for which the code that needs the programming rights is in objects: Wiki Macros, Scheduler Jobs, JSX/SSX with use "always". This would sort of mean that one can edit a wiki macro script and the macro would still have PR, no? Also, it could be a bit hard to understand why you need to edit the object and then go edit the document in wiki mode and save it with no change (btw, does that still change document author? I think there was a change recently...) so that the script you wrote when editing the document in inline mode still works. Anca
Thanks -Vincent
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
On Thu, Jun 13, 2013 at 5:26 PM, Anca Luca <[email protected]> wrote:
Hi Vincent,
On 06/13/2013 11:08 AM, Vincent Massol wrote:
Hi,
According to the javadoc in XWikiDocument:
/** * The last user that has changed the document's content (ie not object, attachments). The Content author is only * changed when the document content changes. Note that Content Author is used to check programming rights on a * document and this is the reason we need to know the last author who's modified the content since programming * rights depend on this. */ private DocumentReference contentAuthorReference;
This means that objectadd or objectremove actions shouldn't change the content author as they do now.
this would mean add and remove object, but not update. Still, the subject of the mail mentions object update as well. Which one is it?
It is because updating an object is already not changing the content author.
I'm proposing that we fix this.
Do you see any issue?
I can think of some documents that need programming rights and for which the code that needs the programming rights is in objects: Wiki Macros, Scheduler Jobs, JSX/SSX with use "always". This would sort of mean that one can edit a wiki macro script and the macro would still have PR, no? Also, it could be a bit hard to understand why you need to edit the object and then go edit the document in wiki mode and save it with no change (btw, does that still change document author? I think there was a change recently...) so that the script you wrote when editing the document in inline mode still works.
That's why I think we should separate the content author from the metadata author. Thus, if a user with PR add/update/remove some objects, he won't give PR to the content of the page. All the same it could be dangerous if editing a document content could give PR to some objects you're not aware of. Thomas
On Thu, Jun 13, 2013 at 5:26 PM, Anca Luca <[email protected]> wrote:
Hi Vincent,
On 06/13/2013 11:08 AM, Vincent Massol wrote:
Hi,
According to the javadoc in XWikiDocument:
/** * The last user that has changed the document's content (ie not object, attachments). The Content author is only * changed when the document content changes. Note that Content Author is used to check programming rights on a * document and this is the reason we need to know the last author who's modified the content since programming * rights depend on this. */ private DocumentReference contentAuthorReference;
This means that objectadd or objectremove actions shouldn't change the content author as they do now.
this would mean add and remove object, but not update. Still, the subject of the mail mentions object update as well. Which one is it?
I'm proposing that we fix this.
Do you see any issue?
I can think of some documents that need programming rights and for which the code that needs the programming rights is in objects: Wiki Macros, Scheduler Jobs, JSX/SSX with use "always". This would sort of mean that one can edit a wiki macro script and the macro would still have PR, no? Also, it could be a bit hard to understand why you need to edit the object and then go edit the document in wiki mode and save it with no change (btw, does that still change document author? I think there was a change recently...) so that the script you wrote when editing the document in inline mode still works.
Actually this is not true for wiki macros since we use the author for those and not the content author. We could fix the other places too. Having the content author modified when you add an object does not make any kind of sense, the fact that some features badly use it does not make it right. Also since modifying an object does not touch the content author it makes it totally inconsistent.
Anca
Thanks -Vincent
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne
In other words +1 to fix it :) On Thu, Apr 30, 2015 at 5:02 PM, Thomas Mortagne <[email protected]> wrote:
On Thu, Jun 13, 2013 at 5:26 PM, Anca Luca <[email protected]> wrote:
Hi Vincent,
On 06/13/2013 11:08 AM, Vincent Massol wrote:
Hi,
According to the javadoc in XWikiDocument:
/** * The last user that has changed the document's content (ie not object, attachments). The Content author is only * changed when the document content changes. Note that Content Author is used to check programming rights on a * document and this is the reason we need to know the last author who's modified the content since programming * rights depend on this. */ private DocumentReference contentAuthorReference;
This means that objectadd or objectremove actions shouldn't change the content author as they do now.
this would mean add and remove object, but not update. Still, the subject of the mail mentions object update as well. Which one is it?
I'm proposing that we fix this.
Do you see any issue?
I can think of some documents that need programming rights and for which the code that needs the programming rights is in objects: Wiki Macros, Scheduler Jobs, JSX/SSX with use "always". This would sort of mean that one can edit a wiki macro script and the macro would still have PR, no? Also, it could be a bit hard to understand why you need to edit the object and then go edit the document in wiki mode and save it with no change (btw, does that still change document author? I think there was a change recently...) so that the script you wrote when editing the document in inline mode still works.
Actually this is not true for wiki macros since we use the author for those and not the content author. We could fix the other places too.
Having the content author modified when you add an object does not make any kind of sense, the fact that some features badly use it does not make it right. Also since modifying an object does not touch the content author it makes it totally inconsistent.
Anca
Thanks -Vincent
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne
-- Thomas Mortagne
By the way one consequence of this bug is that any user can break a page that need programming right just by tagging it for the first time, see http://jira.xwiki.org/browse/XWIKI-9292. On Thu, Apr 30, 2015 at 5:02 PM, Thomas Mortagne <[email protected]> wrote:
In other words +1 to fix it :)
On Thu, Apr 30, 2015 at 5:02 PM, Thomas Mortagne <[email protected]> wrote:
On Thu, Jun 13, 2013 at 5:26 PM, Anca Luca <[email protected]> wrote:
Hi Vincent,
On 06/13/2013 11:08 AM, Vincent Massol wrote:
Hi,
According to the javadoc in XWikiDocument:
/** * The last user that has changed the document's content (ie not object, attachments). The Content author is only * changed when the document content changes. Note that Content Author is used to check programming rights on a * document and this is the reason we need to know the last author who's modified the content since programming * rights depend on this. */ private DocumentReference contentAuthorReference;
This means that objectadd or objectremove actions shouldn't change the content author as they do now.
this would mean add and remove object, but not update. Still, the subject of the mail mentions object update as well. Which one is it?
I'm proposing that we fix this.
Do you see any issue?
I can think of some documents that need programming rights and for which the code that needs the programming rights is in objects: Wiki Macros, Scheduler Jobs, JSX/SSX with use "always". This would sort of mean that one can edit a wiki macro script and the macro would still have PR, no? Also, it could be a bit hard to understand why you need to edit the object and then go edit the document in wiki mode and save it with no change (btw, does that still change document author? I think there was a change recently...) so that the script you wrote when editing the document in inline mode still works.
Actually this is not true for wiki macros since we use the author for those and not the content author. We could fix the other places too.
Having the content author modified when you add an object does not make any kind of sense, the fact that some features badly use it does not make it right. Also since modifying an object does not touch the content author it makes it totally inconsistent.
Anca
Thanks -Vincent
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne
-- Thomas Mortagne
-- Thomas Mortagne
bump. Please see the discussion in the comments of http://jira.xwiki.org/browse/XWIKI-9292 WDYT? Thanks, Eduard On Thu, Apr 30, 2015 at 6:04 PM, Thomas Mortagne <[email protected]> wrote:
By the way one consequence of this bug is that any user can break a page that need programming right just by tagging it for the first time, see http://jira.xwiki.org/browse/XWIKI-9292.
On Thu, Apr 30, 2015 at 5:02 PM, Thomas Mortagne <[email protected]> wrote:
In other words +1 to fix it :)
On Thu, Apr 30, 2015 at 5:02 PM, Thomas Mortagne <[email protected]> wrote:
On Thu, Jun 13, 2013 at 5:26 PM, Anca Luca <[email protected]> wrote:
Hi Vincent,
On 06/13/2013 11:08 AM, Vincent Massol wrote:
Hi,
According to the javadoc in XWikiDocument:
/** * The last user that has changed the document's content (ie not object, attachments). The Content author is only * changed when the document content changes. Note that Content Author is used to check programming rights on a * document and this is the reason we need to know the last
author
who's modified the content since programming * rights depend on this. */ private DocumentReference contentAuthorReference;
This means that objectadd or objectremove actions shouldn't change the content author as they do now.
this would mean add and remove object, but not update. Still, the subject of the mail mentions object update as well. Which one is it?
I'm proposing that we fix this.
Do you see any issue?
I can think of some documents that need programming rights and for which the code that needs the programming rights is in objects: Wiki Macros, Scheduler Jobs, JSX/SSX with use "always". This would sort of mean that one can edit a wiki macro script and the macro would still have PR, no? Also, it could be a bit hard to understand why you need to edit the object and then go edit the document in wiki mode and save it with no change (btw, does that still change document author? I think there was a change recently...) so that the script you wrote when editing the document in inline mode still works.
Actually this is not true for wiki macros since we use the author for those and not the content author. We could fix the other places too.
Having the content author modified when you add an object does not make any kind of sense, the fact that some features badly use it does not make it right. Also since modifying an object does not touch the content author it makes it totally inconsistent.
Anca
Thanks -Vincent
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne
-- Thomas Mortagne
-- Thomas Mortagne _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Also, TL;DR: The proposed changes are https://github.com/xwiki/xwiki-platform/pull/409/files Thanks, Eduard On Fri, Jun 19, 2015 at 5:05 PM, Eduard Moraru <[email protected]> wrote:
bump.
Please see the discussion in the comments of http://jira.xwiki.org/browse/XWIKI-9292
WDYT?
Thanks, Eduard
On Thu, Apr 30, 2015 at 6:04 PM, Thomas Mortagne < [email protected]> wrote:
By the way one consequence of this bug is that any user can break a page that need programming right just by tagging it for the first time, see http://jira.xwiki.org/browse/XWIKI-9292.
On Thu, Apr 30, 2015 at 5:02 PM, Thomas Mortagne <[email protected]> wrote:
In other words +1 to fix it :)
On Thu, Apr 30, 2015 at 5:02 PM, Thomas Mortagne <[email protected]> wrote:
On Thu, Jun 13, 2013 at 5:26 PM, Anca Luca <[email protected]> wrote:
Hi Vincent,
On 06/13/2013 11:08 AM, Vincent Massol wrote:
Hi,
According to the javadoc in XWikiDocument:
/** * The last user that has changed the document's content (ie not object, attachments). The Content author is only * changed when the document content changes. Note that Content Author is used to check programming rights on a * document and this is the reason we need to know the last
author
who's modified the content since programming * rights depend on this. */ private DocumentReference contentAuthorReference;
This means that objectadd or objectremove actions shouldn't change the content author as they do now.
this would mean add and remove object, but not update. Still, the subject of the mail mentions object update as well. Which one is it?
I'm proposing that we fix this.
Do you see any issue?
I can think of some documents that need programming rights and for which the code that needs the programming rights is in objects: Wiki Macros, Scheduler Jobs, JSX/SSX with use "always". This would sort of mean that one can edit a wiki macro script and the macro would still have PR, no? Also, it could be a bit hard to understand why you need to edit the object and then go edit the document in wiki mode and save it with no change (btw, does that still change document author? I think there was a change recently...) so that the script you wrote when editing the document in inline mode still works.
Actually this is not true for wiki macros since we use the author for those and not the content author. We could fix the other places too.
Having the content author modified when you add an object does not make any kind of sense, the fact that some features badly use it does not make it right. Also since modifying an object does not touch the content author it makes it totally inconsistent.
Anca
Thanks -Vincent
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne
-- Thomas Mortagne
-- Thomas Mortagne _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
+1 for fixing this. That said, it will never be really right, and you will surely found case when it is worse, but it may also oppose security and functionality. Actually, my feeling is that it will be better with your change most of the time in term of functionality, with a currently acceptable security risk. -- Denis Gervalle SOFTEC sa - CEO
+1 At least it will be more clear... On Fri, Jun 19, 2015 at 4:27 PM, Denis Gervalle <[email protected]> wrote:
+1 for fixing this.
That said, it will never be really right, and you will surely found case when it is worse, but it may also oppose security and functionality. Actually, my feeling is that it will be better with your change most of the time in term of functionality, with a currently acceptable security risk.
-- Denis Gervalle SOFTEC sa - CEO _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne
+1 Thanks, Marius On Fri, Jun 19, 2015 at 5:35 PM, Thomas Mortagne <[email protected]> wrote:
+1
At least it will be more clear...
On Fri, Jun 19, 2015 at 4:27 PM, Denis Gervalle <[email protected]> wrote:
+1 for fixing this.
That said, it will never be really right, and you will surely found case when it is worse, but it may also oppose security and functionality. Actually, my feeling is that it will be better with your change most of the time in term of functionality, with a currently acceptable security risk.
-- Denis Gervalle SOFTEC sa - CEO _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
5 +1s, 0 -1s. Merging the proposed PR. Thanks everybody! -Eduard On Tue, Jun 23, 2015 at 3:21 PM, Marius Dumitru Florea < [email protected]> wrote:
+1
Thanks, Marius
On Fri, Jun 19, 2015 at 5:35 PM, Thomas Mortagne <[email protected]> wrote:
+1
At least it will be more clear...
On Fri, Jun 19, 2015 at 4:27 PM, Denis Gervalle <[email protected]> wrote:
+1 for fixing this.
That said, it will never be really right, and you will surely found case when it is worse, but it may also oppose security and functionality. Actually, my feeling is that it will be better with your change most of the time in term of functionality, with a currently acceptable security risk.
-- Denis Gervalle SOFTEC sa - CEO _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
participants (7)
-
Anca Luca -
Denis Gervalle -
Eduard Moraru -
Marius Dumitru Florea -
Thomas Delafosse -
Thomas Mortagne -
Vincent Massol