Hi, I am working on an application that relies heavily on custom search to get the data to client. I have looked at the xwiki api and it seems that seerch method needs programming rights. Now every user would not have programming rights. So could you please let me know how can I execute such search methods from within my velocity code. One way would be to use my custom search plugin to bypass the xwiki programming rights. I have also see the xwiki reference page for search queries and there are some where no result is displayed, and this is probably because when we access the page there is no access for guest user or logged in user to execute those queries. http://platform.xwiki.org/xwiki/bin/view/DevGuide/velocityHqlExamplesMacro So again can't the search apis move out of programming rights? Thanks Sachin ----- http://www.assembla.com/wiki/show/sachin_mittal about me: -- View this message in context: http://www.nabble.com/Using-search-apis-tp17315167p17315167.html Sent from the XWiki- Dev mailing list archive at Nabble.com.
Hi Sachin, The programming rights work a bit different. The check is not if the current logged user has programming rights, but if the person that saved the page(document) last time has them. For example, if the page that executes the search is created/saved by an admin that has programming rights, inside it you can execute scripts that require programming rights even though the current user doesn't have them. Hope this helps, Cristian
Hi, I am working on an application that relies heavily on custom search to get the data to client. I have looked at the xwiki api and it seems that seerch method needs programming rights.
Now every user would not have programming rights.
So could you please let me know how can I execute such search methods from within my velocity code.
One way would be to use my custom search plugin to bypass the xwiki programming rights.
I have also see the xwiki reference page for search queries and there are some where no result is displayed, and this is probably because when we access the page there is no access for guest user or logged in user to execute those queries. http://platform.xwiki.org/xwiki/bin/view/DevGuide/velocityHqlExamplesMacro
So again can't the search apis move out of programming rights?
Thanks Sachin
----- http://www.assembla.com/wiki/show/sachin_mittal about me: -- View this message in context: http://www.nabble.com/Using-search-apis-tp17315167p17315167.html Sent from the XWiki- Dev mailing list archive at Nabble.com.
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
Hi Cristian, This information does help me understand things better. Probably I can use this feature as a workaround to always execute search. However I would still like to know the rationale of why search is restricted to programming rights only. I think if any user has view rights then he should be able to use the search apis. What do others say? Thanks Sachin cristian.vrabie wrote:
Hi Sachin, The programming rights work a bit different. The check is not if the current logged user has programming rights, but if the person that saved the page(document) last time has them. For example, if the page that executes the search is created/saved by an admin that has programming rights, inside it you can execute scripts that require programming rights even though the current user doesn't have them.
Hope this helps, Cristian
----- http://www.assembla.com/wiki/show/sachin_mittal about me: -- View this message in context: http://www.nabble.com/Using-search-apis-tp17315167p17323452.html Sent from the XWiki- Dev mailing list archive at Nabble.com.
I am not sure of why the search requires programming rights but I'm putting a wild guess on the fact that if you would use normal rights check, you might need to check if the user that performs the search has view rights on each page that might result in the search, which of course it's almost impossible. However, what I want you to understand is that using the programming rights from a page saved by an admin is not a "workaround", but an intended feature of xwiki. Many applications use this. If you still want to use the search from wherever you want, you might need to write your own plugin. However, i suggest you have a good look at the lucene plugin first. Cristian
Hi Cristian, This information does help me understand things better. Probably I can use this feature as a workaround to always execute search. However I would still like to know the rationale of why search is restricted to programming rights only. I think if any user has view rights then he should be able to use the search apis.
What do others say?
Thanks Sachin
cristian.vrabie wrote:
Hi Sachin, The programming rights work a bit different. The check is not if the current logged user has programming rights, but if the person that saved the page(document) last time has them. For example, if the page that executes the search is created/saved by an admin that has programming rights, inside it you can execute scripts that require programming rights even though the current user doesn't have them.
Hope this helps, Cristian
----- http://www.assembla.com/wiki/show/sachin_mittal about me: -- View this message in context: http://www.nabble.com/Using-search-apis-tp17315167p17323452.html Sent from the XWiki- Dev mailing list archive at Nabble.com.
_______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
See http://platform.xwiki.org/xwiki/bin/view/DevGuide/velocityHqlExamples Thanks -Vincent On May 19, 2008, at 7:32 PM, [email protected] wrote:
I am not sure of why the search requires programming rights but I'm putting a wild guess on the fact that if you would use normal rights check, you might need to check if the user that performs the search has view rights on each page that might result in the search, which of course it's almost impossible.
However, what I want you to understand is that using the programming rights from a page saved by an admin is not a "workaround", but an intended feature of xwiki. Many applications use this.
If you still want to use the search from wherever you want, you might need to write your own plugin. However, i suggest you have a good look at the lucene plugin first.
Cristian
Hi Cristian, This information does help me understand things better. Probably I can use this feature as a workaround to always execute search. However I would still like to know the rationale of why search is restricted to programming rights only. I think if any user has view rights then he should be able to use the search apis.
What do others say?
Thanks Sachin
cristian.vrabie wrote:
Hi Sachin, The programming rights work a bit different. The check is not if the current logged user has programming rights, but if the person that saved the page(document) last time has them. For example, if the page that executes the search is created/saved by an admin that has programming rights, inside it you can execute scripts that require programming rights even though the current user doesn't have them.
Hope this helps, Cristian
participants (3)
-
cristian.vrabie＠xwiki.com -
Sachin Mittal -
Vincent Massol