[xwiki-users] View rights and Edit rights... and some weird stuff

9 Dec 2010

      Hi again,

I wanted to protect my "Website Admin" from any non-admins,
So I edited the Rights to that space, and clicked the 'View' button on
'XWikiAllGroup' until it was a red cross.
Then I checked in the other webbrowser (logged in as a regular user), and
sure enough, I couldn't view the page.

However, I then went to this address:
http://domain.com/xwiki/edit/Website+Admin/
and the regular user was able to edit the page!  which also includes a
'Preview' button, which shows them a View!

not good.

then it gets weirder, in a different way.

So far, as regular user, I've gone to Edit, then clicked Preview, and now I
clicked the back button, and I notice the status bar is going to my
redirect.com website...
I have set up my webserver (lighttpd), so that if anyone tries to go to
http://domain.com/ then it'll redirect to http://redirect.com - that way
noone can see the site until I am ready to make it live.  The site currently
lives at http://domain.com/xwiki

So for some reason, going to Preview and back again has generated URLs that
are missing the xwiki part of the URL.

So anyway, I watch the page, and the usual Edit page reappears correctly,
but the CONTENT in the Edit window is wrong.
I am able to do this over and over again in Chrome, but not in Firefox.

If I go to Preview, then clear the Cache, and then hit the back button (on
browser, in Chrome), then I get a lot more rubbish in the Edit window:

&lt;p&gt;&lt;!<del>startwikilink:false|-|doc|-|Timeline</del>&gt;&lt;span
class="wikilink"&gt;&lt;a
href="/xwiki/Website+Admin/Timeline"&gt;&lt;span
class="wikigeneratedlinkcontent"&gt;Timeline&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;&lt;!<del>stopwikilink</del>&gt;&lt;/p&gt;&lt;p&gt;&lt;br
class="spacer"&gt;&lt;/p&gt;&lt;p&gt;&lt;!<del>startwikilink:false|-|url|-|<!<del>startwikilink:false|-|url|-|<!
startwikilink:false|-|url|-|http://yahoo.com-\><a class="wikimodel-freestanding" href="
http://yahoo.com-">http://yahoo.com-
</a><!stopwikilink>\-\</del>><a class="wikimodel-freestanding" href="<!
startwikilink:false|-|url|-|http://yahoo.com-\-\><a class="wikimodel-freestanding" href="
http://yahoo.com--">
http://yahoo.com--</a><!stopwikilink>"><!startwikilink:false|-|url|-|
http://yahoo.com-\-\><a
class="wikimodel-freestanding" href="http://yahoo.com--">http://yahoo.com--</a><!
stopwikilink></a><!<del>stopwikilink</del>>&gt;&lt;span
class="wikiexternallink"&gt;&lt;a
href="<!<del>startwikilink:false|-|url|-|<!startwikilink:false|-|url|-|
http://yahoo.com-\-\><a
class="wikimodel-freestanding" href="http://yahoo.com--">http://yahoo.com--</a><!
stopwikilink>><a
class="wikimodel-freestanding" href="<!startwikilink:false|-|url|-|
http://yahoo.com--><a
class="wikimodel-freestanding" href="http://yahoo.com">http://yahoo.com</a><!
stopwikilink>"><!
startwikilink:false|-|url|-|http://yahoo.com--><a class="wikimodel-freestanding" href="
http://yahoo.com">http://yahoo.com
</a><!stopwikilink></a><!

Note the yahoo links, I have one yahoo.com link on that short page (its just
a test page at the moment).

The only unusual thing I can see in Chrome's developer tools is in the
Console, this error:

   1. Uncaught TypeError: Cannot call method 'removeEventListener' of null
   1. u1b6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:4711<http://www.ms-rap.com/xwiki/resources/js/xwiki/wysiwyg/xwe/6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html>
      2. Mmb6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:4770<http://www.ms-rap.com/xwiki/resources/js/xwiki/wysiwyg/xwe/6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html>
      3. Tmb6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:1101<http://www.ms-rap.com/xwiki/resources/js/xwiki/wysiwyg/xwe/6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html>
      4. a.contentWindow.onunload
      6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:4965<http://www.ms-rap.com/xwiki/resources/js/xwiki/wysiwyg/xwe/6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html>
      5. qYb6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:5102<http://www.ms-rap.com/xwiki/resources/js/xwiki/wysiwyg/xwe/6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html>
      6. iG6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:4630<http://www.ms-rap.com/xwiki/resources/js/xwiki/wysiwyg/xwe/6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html>
      7. NG6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:3547<http://www.ms-rap.com/xwiki/resources/js/xwiki/wysiwyg/xwe/6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html>
      8. (anonymous function)
      6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:3838<http://www.ms-rap.com/xwiki/resources/js/xwiki/wysiwyg/xwe/6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html>
      9. fq6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:4111<http://www.ms-rap.com/xwiki/resources/js/xwiki/wysiwyg/xwe/6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html>
      10. (anonymous function)
      6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:3566<http://www.ms-rap.com/xwiki/resources/js/xwiki/wysiwyg/xwe/6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html>

Any ideas?
Oh, and: why is there .cache.html pages included in the static content?  Why
isn't it using normal javascript file names?

thanks
Paul

ps are html emails to the list ok?

[xwiki-users] View rights and Edit rights... and some weird stuff

Paul Harris