[xwiki-devs] [VOTE] Add hasWikiAdminRights() method to XWikiRightService and api.Api to avoid confusion and security issues
Hi Devs, The current hasAdminRights(XWikiContext) method checks if the current user has admin rights on the current wiki or on the current space. However, the javadoc currently available (and also general knowledge) did not include the "or current space" part and the method ended up being used in places where admin right for the current space was not enough to allow performing certain actions (ex. wiki manager plugin, etc.) While it is still useful to check for admin right on wiki or space, it is more useful to have a method that checks admin right only for the wiki (stronger admin). Using the current api, it's cumbersome to have to specify "XWiki.XWikiPreferences" each time so I propose adding a new method to handle this: /** * Checks that the current user in the context (the currently authenticated user) has administration rights on the * current wiki, regardless of any space admin rights that might also be available. * * @param context the xwiki context of this request * @return {@code true} if the current user in the context has the {@code admin} right, {@code false} otherwise */ public boolean hasWikiAdminRights(XWikiContext context); And, obviously, the fixed javadoc for hasAdminRights(XWikiContext). You can check out the pull request at https://github.com/xwiki/xwiki-platform/pull/22 Here's my +1 Thanks, Eduard P.S.: Existing code using the hasAdminRights(XWikiContext) method will have to be adjusted accordingly.
On 09/02/2011 11:21 AM, Eduard Moraru wrote:
Hi Devs,
The current hasAdminRights(XWikiContext) method checks if the current user has admin rights on the current wiki or on the current space. However, the javadoc currently available (and also general knowledge) did not include the "or current space" part and the method ended up being used in places where admin right for the current space was not enough to allow performing certain actions (ex. wiki manager plugin, etc.)
While it is still useful to check for admin right on wiki or space, it is more useful to have a method that checks admin right only for the wiki (stronger admin). Using the current api, it's cumbersome to have to specify "XWiki.XWikiPreferences" each time so I propose adding a new method to handle this:
/** * Checks that the current user in the context (the currently authenticated user) has administration rights on the * current wiki, regardless of any space admin rights that might also be available. * * @param context the xwiki context of this request * @return {@code true} if the current user in the context has the {@code admin} right, {@code false} otherwise */ public boolean hasWikiAdminRights(XWikiContext context);
And, obviously, the fixed javadoc for hasAdminRights(XWikiContext).
You can check out the pull request at https://github.com/xwiki/xwiki-platform/pull/22
Here's my +1
+1. The pull request looks good, it can be applied after the vote passes.
Thanks, Eduard
P.S.: Existing code using the hasAdminRights(XWikiContext) method will have to be adjusted accordingly.
-- Sergiu Dumitriu http://purl.org/net/sergiu/
+1 On Fri, Sep 2, 2011 at 5:21 PM, Eduard Moraru <[email protected]> wrote:
Hi Devs,
The current hasAdminRights(XWikiContext) method checks if the current user has admin rights on the current wiki or on the current space. However, the javadoc currently available (and also general knowledge) did not include the "or current space" part and the method ended up being used in places where admin right for the current space was not enough to allow performing certain actions (ex. wiki manager plugin, etc.)
While it is still useful to check for admin right on wiki or space, it is more useful to have a method that checks admin right only for the wiki (stronger admin). Using the current api, it's cumbersome to have to specify "XWiki.XWikiPreferences" each time so I propose adding a new method to handle this:
/** * Checks that the current user in the context (the currently authenticated user) has administration rights on the * current wiki, regardless of any space admin rights that might also be available. * * @param context the xwiki context of this request * @return {@code true} if the current user in the context has the {@code admin} right, {@code false} otherwise */ public boolean hasWikiAdminRights(XWikiContext context);
And, obviously, the fixed javadoc for hasAdminRights(XWikiContext).
You can check out the pull request at https://github.com/xwiki/xwiki-platform/pull/22
Here's my +1
Thanks, Eduard
P.S.: Existing code using the hasAdminRights(XWikiContext) method will have to be adjusted accordingly. _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Jérôme Velociter Winesquare http://www.winesquare.net/
+1 On Fri, Sep 2, 2011 at 5:21 PM, Eduard Moraru <[email protected]> wrote:
Hi Devs,
The current hasAdminRights(XWikiContext) method checks if the current user has admin rights on the current wiki or on the current space. However, the javadoc currently available (and also general knowledge) did not include the "or current space" part and the method ended up being used in places where admin right for the current space was not enough to allow performing certain actions (ex. wiki manager plugin, etc.)
While it is still useful to check for admin right on wiki or space, it is more useful to have a method that checks admin right only for the wiki (stronger admin). Using the current api, it's cumbersome to have to specify "XWiki.XWikiPreferences" each time so I propose adding a new method to handle this:
/** * Checks that the current user in the context (the currently authenticated user) has administration rights on the * current wiki, regardless of any space admin rights that might also be available. * * @param context the xwiki context of this request * @return {@code true} if the current user in the context has the {@code admin} right, {@code false} otherwise */ public boolean hasWikiAdminRights(XWikiContext context);
And, obviously, the fixed javadoc for hasAdminRights(XWikiContext).
You can check out the pull request at https://github.com/xwiki/xwiki-platform/pull/22
Here's my +1
Thanks, Eduard
P.S.: Existing code using the hasAdminRights(XWikiContext) method will have to be adjusted accordingly. _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne
+1 Thanks, Marius On Sun, Sep 4, 2011 at 12:17 PM, Thomas Mortagne <[email protected]> wrote:
+1
On Fri, Sep 2, 2011 at 5:21 PM, Eduard Moraru <[email protected]> wrote:
Hi Devs,
The current hasAdminRights(XWikiContext) method checks if the current user has admin rights on the current wiki or on the current space. However, the javadoc currently available (and also general knowledge) did not include the "or current space" part and the method ended up being used in places where admin right for the current space was not enough to allow performing certain actions (ex. wiki manager plugin, etc.)
While it is still useful to check for admin right on wiki or space, it is more useful to have a method that checks admin right only for the wiki (stronger admin). Using the current api, it's cumbersome to have to specify "XWiki.XWikiPreferences" each time so I propose adding a new method to handle this:
/** * Checks that the current user in the context (the currently authenticated user) has administration rights on the * current wiki, regardless of any space admin rights that might also be available. * * @param context the xwiki context of this request * @return {@code true} if the current user in the context has the {@code admin} right, {@code false} otherwise */ public boolean hasWikiAdminRights(XWikiContext context);
And, obviously, the fixed javadoc for hasAdminRights(XWikiContext).
You can check out the pull request at https://github.com/xwiki/xwiki-platform/pull/22
Here's my +1
Thanks, Eduard
P.S.: Existing code using the hasAdminRights(XWikiContext) method will have to be adjusted accordingly. _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
-- Thomas Mortagne _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
participants (5)
-
Eduard Moraru -
Jerome Velociter -
Marius Dumitru Florea -
Sergiu Dumitriu -
Thomas Mortagne