Hi all,
I want to create a form element to allow members of the general public
to enter information into a form and then have it stored in objects
within the wiki.
So far, fairly straightforwards.
My problem is that I don't expect random members of the public
to have accounts on the wiki. As such the objects are created
using the XWikiGuest account. Which is where I hit my problem.
Guest needs edit privs on the page in order to add the object.
This means that they can also view the objects created.
Given that we'll be storing potentially sensetive information
in there (telephone, email address etc) I really don't want
people browsing through it.
I tried using $xwiki.getURLContent(url, username, password) but
xwiki auth isn't "simple"!
My next plan was to temporarily authenticate with a dummy user
account via a plugin. It looks like I can provide credentials
with $xwiki.checkAuth(). But I can't see how to remove them
again at the end of the transaction.
My short term fix has just been to email the details to the
relevant people and get them to enter the data in by hand, but
this is far from ideal.
Anyone have any ideas how I can approach this?
Cheers,
Adam