Hi,
I'm planning to do the following:
Each document based on a certain template autmatically gets it's own standard poll. (No customisation.) Each user visiting the page can vote.
Having looked at the polls application and played around with templates a bit, I think I know all the ingredients I will need.
I have one problem though: Anyone who votes needs write permissions on the document that saves the votes (whereever that may be). If I'm not mistaken that means anyone who can vote theoretically can manipulate voting data by accessing these objects directly.
Is there any way to secure this against manipulation
a) from users who can vote?
b) from the user who created the page?
Probably that question is equivalent to: Is there a way to let users save changes on an object only via a script while hindering that very same user from editing it directly?
Any hints are greatly appreciated!
----- "Scott Serr" <serrs(a)theserrs.net> wrote:
> In the dev mailing list, I saw years ago that $datetool was changed to
> point to ComparisonDateTool. This gave it added functionality. Also,
> the documentation on
> http://platform.xwiki.org/xwiki/bin/view/DevGuide/Scripting says it is
> a ComparisonDateTool.
>
> My problem is, it doesn't act like a ComparisonDateTool, it acts like
> DateTool.
>
> Works:
> $datetool.get('dd.MM.yyyy HH:mm')
>
> Does not work:
> $datetool.difference('2005-07-04','2007-02-15')
Apparently I can't pass String as Object, I have to pass Date?
Anyway, sorry for the traffic.
I ran into an interesting side effect of having a form in my Class Sheet.
<input type="hidden" name="parent" value="${doc.fullName}" />
The above line is in a form which posts to the current page, but then redirects to a sub-page. The process is exactly like the FAQ Example. The trouble is, when doing Inline Editing on a page with the class object. No matter what you put in as the parent in the UI for the parent property, it gets reset to itself on save. The wiki and WYSYWIG editors don't do this of course.
I think this is a problem because...
1. Should this form (and form element) really be evaluated? No one hit the submit button.
2. It doesn't seem very safe for variable spaces to mix so easily. Unless this is a feature.
In the dev mailing list, I saw years ago that $datetool was changed to point to ComparisonDateTool. This gave it added functionality. Also, the documentation on http://platform.xwiki.org/xwiki/bin/view/DevGuide/Scripting says it is a ComparisonDateTool.
My problem is, it doesn't act like a ComparisonDateTool, it acts like DateTool.
Works:
$datetool.get('dd.MM.yyyy HH:mm')
Does not work:
$datetool.difference('2005-07-04','2007-02-15')
Is there a way to get a ComparisonDateTool object? And is it known that it's simply a DateTool again, or am I wrong?
Hi,
I'm trying some basic functionality on a multilanguage Wiki (3.1)
I create a class
I create the default Class sheet and add a object on it (like suggested in the default)
I create the default Class template and add a object on it (like suggested in the default)
Then I create a object;
It creates a page containing the object, I use the inline form editor to enter some data and save.
Now I want to create a translation in another language?
How should I do that?
The inline form editor does not have a "translate option", when I create a translation with the wiki editor i'm probably
create a new wiki document with a different language, but it seems to point to the SAME object. when I change the content of the object in the other language, these changes also show when I navigate back to the english page
It looks like I should instantiate a new object of the class, but then the page language is still 'en'
And how do we manage then that these objects still relate to each other? If I change the english version of a record this should be related to the content of the translations!
Gerritjan
Hi All,
I have successfully implemented XWiki 3.1 with LDAP authentication. Since
user name and password managment is addressed by the LDAP provider it doesnt
make sense to have these enabled on the LOGIN page.
What is the best way to remove these links/options from that page.
Thank you!
Chris
I have a data model that follow this page structure:
Detectors
-> Detector1
-> Detector1History1
-> Detector1History2
-> Detector2
(Implemented with my DetectorClass and DetectorHistoryClass)
The Detectors is like a dashboard for Detectors and their history. It's mostly working. My issue is that my Velocity code on that top dashboard page is looking pretty ugly. It has nested loops and I don't know how to do any encapsulation. If I could do things like detector1.getNewestHistory() that would be very helpful. But my Detector Object Class is limited to what I can define in XWiki. To my knowledge, XWiki's "user defined" classes aren't able to encapsulate code. Am I wrong?
It seems like defining my Velocity macros would help, but my understanding is a macro can't return anything, just evaluates to output.
If I'm wrong-headed, please correct me.
Thanks,
Scott
The XWiki development team is proud to announce the availability of
XWiki Enterprise 3.2 Milestone 3, the last milestone of the XWiki
Enterprise 3.2 version (see the roadmap at
http://enterprise.xwiki.org/xwiki/bin/Main/Roadmap ). Main new features
include:
* improved Lucene scoring
* new implementation of the sheet system
* support for OpenOffice 3.3 as the backend of the office importer
* better support for IE9 in the WYSIWYG editor
* many improvements in the extension manager and extension repository
* the removal of the Albatross skin from the distribution
* ... and quite a lot of dependency upgrades and bug fixes
See the full release notes at
http://www.xwiki.org/xwiki/bin/ReleaseNotes/ReleaseNotesXWikiEnterprise32M3
for more details.
--
Sergiu Dumitriu
http://purl.org/net/sergiu/
----- "Vincent Massol" <vincent(a)massol.net> wrote:
> Hi Scott,
>
> On Sep 27, 2011, at 12:34 AM, Scott Serr wrote:
>
> >
> > Can I limit livetable to display only the objects/pages under a
> certain parent page?
> >
> > Looks like this:
> >
> > Detectors (space)
> > Detectors.Detector1 (page)
> > Detectors.Detector2 (page)
> > Detectors.Detector1History1 (page with parent set to Detector1)
> > Detectors.Detector1History2 (page with parent set to Detector1)
> >
> > I have livetable on both pages Detector1 and Detector2, trying to
> display only their children history. But livetable displays all
> DetectorHistoryClass objects. (The Detector2 page shows Detector1's
> history objects) Is there a way to limit the results to only children
> of the calling page?
> >
> > I know you can do all this manually with foreach and filtering them
> out one at a time, but I'd like to use livetable.
>
> See the example at
> http://extensions.xwiki.org/xwiki/bin/view/Extension/Livetable+Macro#HFilte…
>
> Hope it helps,
> -Vincent
Thanks Vincent, I'll give it a try.
Those in charge of the xwiki web sites:
If I am not logged in, just looking at the pages the code macro can't execute!
Failed to execute the [code] macro
Thanks,
Scott
Hi all,
While gathering information on the simplify my wiki subject, I stumbled upon
the RSS makro and tried it out, works great.
But is there a way to have the RSS Links that the RSS Makro displays open in
a new window?
I know there are discussions on the sensibility of opening links in a new
window, but in this project I will have to do so.
I tried putting rel="blank" in somewhere, but nothing worked.
I tried putting a java class objekt in, but I guess since the rss feed is in
a makro, this did not work either.
Is it possible, and if yes, how?
Thanx in advance,
Wouter
Can I limit livetable to display only the objects/pages under a certain parent page?
Looks like this:
Detectors (space)
Detectors.Detector1 (page)
Detectors.Detector2 (page)
Detectors.Detector1History1 (page with parent set to Detector1)
Detectors.Detector1History2 (page with parent set to Detector1)
I have livetable on both pages Detector1 and Detector2, trying to display only their children history. But livetable displays all DetectorHistoryClass objects. (The Detector2 page shows Detector1's history objects) Is there a way to limit the results to only children of the calling page?
I know you can do all this manually with foreach and filtering them out one at a time, but I'd like to use livetable.
Thanks,
Scott
On Sep 23, 2011, at 3:20 PM, Laurence Caraccio wrote:
>
> Yes its a good 5 or 6 years old now I think but it loads and thats all that
> matters, the point of me looking into it is so that I can update everything
> to the latest versions and remove old content, cheers.
ok, good to know! :)
Thanks
-Vincent
> Regards,
>
>
>
> Laurence Caraccio
Hi guys, I'm new to using xwiki, my department has an existing wiki but
it's a mess and theres no documentation so I was wondering if there's
anyway to get a list of all the pages so I can see what's there.
Any help would be appreciated cheers.
Regards,
Laurence Caraccio
PTC software developer
Phone: 01962 81 6137 | Mobile: 077 896 202 46 (Embedded image moved to file:
E-mail: LAURCACI(a)uk.ibm.com pic03233.gif)IBM
IBM United Kingdom Limited
Registered in England and Wales with number 741598
Registered office: PO Box 41, North Harbour, Portsmouth, Hants. PO6 3AU
Hi!
So, this "feature" makes absolutely useless delete rights, for example, if each and every user with edit rights can easily skip Delete and Admin Prohibition. Actually edit right behaves like admin in the allowed space. As for me it looks a little bit wierd.
All users by default are simple, but as you mentioned, nothing stops the intruder with edit rights if he knows magic of URLs.
For me it looks logical, that if I PROHIBITED right to delete or Admin rights - it means prohibited, but not "don't pay attention'.
For security it means VERY big black whole. And actually we don't have any instrument to track or stop it (besides watching pages). For semi-open projects, or even open, like Wikipedia it creates paradise for vandals, even if you open edit rights only for registered users. Once you can find couple of hundreds pages in Recycle bin even if nobody but Admin has ability to delete pages. :-)
And actually rights management contradicts wit 6 user types concept http://dev.xwiki.org/xwiki/bin/view/Design/6TypesOfXWikiUsers
So, my proposal is: discuss and implement more precise rights management system in the neares future. Let's make XWiki more safe :-)
Thnks a lot for help,
Dmitry
21 сентября 2011, 17:39 от Guillaume Lerouge <guillaume(a)xwiki.com>:
> Hi Dmitry,
>
> unfortunately for your use case this is a feature of XWiki. When a user is
> granted edit right on a page, he is allowed to edit any object attached to
> that page (this is used through the "edit inline" mode as well, when editing
> in inline mode the user is actually updating the values of object properties
> in the page.
>
> One way to work around this is by making all users "simple users" by default
> so that the menus do not display the advanced edit options. However, users
> that know the right URLs will still be able to access the object edition
> mode.
>
> In short: sorry but no, not "safe" the way you mean it :-(
>
> Guillaume
>
> On Sat, Sep 17, 2011 at 6:57 AM, Haru Mamburu <haru_mamburu(a)mail.ru> wrote:
>
> >
> > Dear Users,
> >
> > XE 3.1. Playing with rights I found very unpleasant and IMO dangerous
> > behaviour.
> >
> > Two Default groups: XWikiAllGroup and XWikiAdminGroup
> >
> > Admin gives rigths to XWikiAllGroup to view pages - no problem.
> > Admin gives rigths to XWikiAllGroup to EDIT pages. From my point of view -
> > EDIT means only page EDIT in edit/inline mode,
> > but not:
> > - managing page access rights
> > - editing in editor object mode.
> >
> > I even tried to prohibit to XWikiAllGroup users Administration rights,
> > nothing changed. As for my project - it is a disaster.
> > I must separate four categories of users:
> > 1. All users - have View access to definite spaces.
> > 2. SOME registered users - have edit rights for spaces/pages (edit/inline),
> > create rights. BUT NO Access rights management, NO object mode editing)
> > 3. Admin Users with Admin rights on several spaces to delete/undelete pages
> > AND access rights management.
> > 4. XWiki Admin
> >
> > As I discovered, I can't get split second and third group. :-(
> >
> > It would be wise to avoid rights management and object editing mode
> > availability to "smart" users, that can bring a mess into the system in
> > couple of seconds. For example, "smart user" with edit rights will easily
> > prohibit access to pages to whole XWikiAllGroup OR he even can grant VIEW
> > rights ONLY to XWikiAdminGroup with the same results - page becomes
> > inaccessible to non-admin users. I checked everything with a Test user in
> > XWikiAllGroup.
> >
> > I don't know if it is a bug or a feature, but for me it's a disaster :-(
> >
> > Is there any way to make XWiki project safe?
> >
> > Best Regards
> >
> > Dmitry Bakbardin
> > _______________________________________________
> > users mailing list
> > users(a)xwiki.org
> > http://lists.xwiki.org/mailman/listinfo/users
> _______________________________________________
> users mailing list
> users(a)xwiki.org
> http://lists.xwiki.org/mailman/listinfo/users
>
[I'm hoping that scripting belongs here an not in the dev list]
I'm trying to tie an attachment to an object. Say, I want to create several TrackingClass objects on a page. But one of the properties I'd like to be a PDF and link. (Or fake it to look like it) I know the properties of a class are primitives plus a few like DbList etc.
The table would have these headings:
Tracking Date | Description | PDF Link
At the bottom of the page I'd have an Add object form:
Tracking Date:
Description:
Attach PDF:
[Add Button]
This is like the "Creating a FAQ Application" example, but with an attached file in the same form submit.
I'm wondering how one might solve this problem?
Thanks,
Scott
Hi,
As an adept of freemind I was very happy to see that a freemind macro
exist for xwiki.
Unfotunately I have a ClassNotFoundException when tha applet is invoked
by the macro, it seems that the FreeMind java library can not be found
by the downloaded applet.
Here is the Stack Trace of the exception :
/Java Plug-in 1.6.0_15
Utilisation de la version JRE 1.6.0_15-b03 Java HotSpot(TM) Client VM
charger : classe freemind.main.FreeMindApplet.class introuvable.
java.lang.ClassNotFoundException: freemind.main.FreeMindApplet.class
at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader.loadCode(Unknown Source)
at sun.plugin2.applet.Plugin2Manager.createApplet(Unknown Source)
at
sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown
Source)
at java.lang.Thread.run(Unknown Source)
Caused by: java.io.IOException: open HTTP connection
failed:http://code.xwiki.org/xwiki/bin/view/Macros/freemind/main/FreeMindAp…
at sun.plugin2.applet.Applet2ClassLoader.getBytes(Unknown Source)
at sun.plugin2.applet.Applet2ClassLoader.access$000(Unknown Source)
at sun.plugin2.applet.Applet2ClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
... 7 more
Exception : java.lang.ClassNotFoundException:
freemind.main.FreeMindApplet.class/
The exception occurs on my instance of xwiki and on the xwiki web site
at this example address :
http://code.xwiki.org/xwiki/bin/view/Macros/MindMapMacro
My instance of xwiki is XWiki Enterprise 1.9.3.22597 on Windows XP SP3
and as you see in the stack trace I have the last 1.6.0_15 java plugin.
Can you give me an advice to resolve this problem.
Thanks in advance,
Julien
Dear Users,
XE 3.1. Playing with rights I found very unpleasant and IMO dangerous behaviour.
Two Default groups: XWikiAllGroup and XWikiAdminGroup
Admin gives rigths to XWikiAllGroup to view pages - no problem.
Admin gives rigths to XWikiAllGroup to EDIT pages. From my point of view - EDIT means only page EDIT in edit/inline mode,
but not:
- managing page access rights
- editing in editor object mode.
I even tried to prohibit to XWikiAllGroup users Administration rights, nothing changed. As for my project - it is a disaster.
I must separate four categories of users:
1. All users - have View access to definite spaces.
2. SOME registered users - have edit rights for spaces/pages (edit/inline), create rights. BUT NO Access rights management, NO object mode editing)
3. Admin Users with Admin rights on several spaces to delete/undelete pages AND access rights management.
4. XWiki Admin
As I discovered, I can't get split second and third group. :-(
It would be wise to avoid rights management and object editing mode availability to "smart" users, that can bring a mess into the system in couple of seconds. For example, "smart user" with edit rights will easily prohibit access to pages to whole XWikiAllGroup OR he even can grant VIEW rights ONLY to XWikiAdminGroup with the same results - page becomes inaccessible to non-admin users. I checked everything with a Test user in XWikiAllGroup.
I don't know if it is a bug or a feature, but for me it's a disaster :-(
Is there any way to make XWiki project safe?
Best Regards
Dmitry Bakbardin
Hi!
XEM 3.1. I turned on filesystem storage, attached file, then deleted it.
Due to http://jira.xwiki.org/browse/XWIKI-6918 and no acces via WebDAV yet (http://jira.xwiki.org/browse/XWIKI-6989) - there is no way to review deleted attachments in recycle bin and delete it. As far as I understand - manual delition via filesystem operations is wrong way to do this because of lost metadata.
Is there any way to delete deleted attachments correctly until XWIKI-6918 would be fixed and XE would upgraded to fixed one?
Kind regards
Dmitry Bakbardin
On the xwiki.org there is a feature on XWiki presented;
The WebDAV feature exposes wiki content (attachments, page content) through the well-known WebDAV protocol.
This allows using WebDAV clients like DAVExplorer, file browsers like the Windows Explorer (XP), the Finder (MAC) or
Nautilus (Linux) to directly browse and edit wiki content just as you would do for files in your local file system.
Does this feature require configuration of the server.
Do I understand that by dropping photo's in a folder I could add photo's the the XWiki photoalbum
although the XWiki stores all the attachments in a mySql database?
We have a server on version 2.7.1
Gerritjan
Hello!
after ?[xwiki-users] Attachment loss after restarting tomcat? I
managed to configure the paths and now the attachments seem to be
there permanently.
However I do encounter a new strange behavior with pictures now. When
I upload a PNG ? Image and embed it into the page it is there at first
when I reload the page the image is gone and the page won?t stop
loading. Any other attachment (e.g. a pdf) can be loaded.
Any Ideas what might be wrong?
Thanks again,
Stephanie
Hi all,
Some time ago we discussed [1] a proposal
http://incubator.myxwiki.org/xwiki/bin/view/Improvements/XWikiOrgProposal2
about changing the way our community website (www.xwiki.org) looks like
(improved homepage, improved navigation, new logo [2], new skin, community
wiki [3], etc.).
Since then there have been some small collaborative efforts to make this new
site come true and I want to thank for their help to Sergiu Dumitriu, Marta
Girdea, Jean-Vincent Drean, Raluca Stavro, Vincent Massol, Silvia Rusu,
Raluca Moisa, Stefan Orzu and all the people that gave feedback.
In order to speed up the process we also created a development wiki
http://newxwiki.xwiki.org/
where you can log in with your xwiki.org credentials and work on the
improvements you want to make. After the work is finished it will be ported
to xwiki.org. This way you can experiment the way your code looks like and
behaves without interfering with the live site.
Also me and Silvia created a planning for the development of the new site
http://incubator.myxwiki.org/xwiki/bin/view/Improvements/XWikiOrgPlanning
and we have split it into 4 stages. We are currently in Stage 1 of the
development.
Each entry has it own link with more information/mockups/code about the
feature. Also features that have been started have also a JIRA issue
attached to them.
We would be very happy if the community could get involved in helping us
making this happen. We still need work on deciding the content for some
sections, we need better design proposals for some elements and we need lots
of implementation work to make everything a reality.
If you want to participate you should pick something from the planning and
announce it on this thread so that we know what feature is taking care of.
Thank you,
Caty
References:
[1] [Proposal] XWiki.org horizontal navigation + home page
http://markmail.org/thread/tfmrludhw2yh5tcn
[2] [Proposal] XWiki.org Logo Challenge - Round 2
http://xwiki.markmail.org/thread/pkdd5kijpt2yqeph
[3] [Proposal] XWiki.org Community Page
http://markmail.org/thread/b3pctp2kepcprfaf
I am out of the office until 09/20/2011.
I need to attend to a personal issue; back on Tuesday, 9/20.
Note: This is an automated response to your message "users Digest, Vol 50,
Issue 22" sent on 9/18/2011 6:00:10.
This is the only notification you will receive while this person is away.