You can extend/override the
com.xpn.xwiki.user.impl.xwiki.XWikiRightServiceImpl class and register
it in xwiki.cfg, so that you can add the upload right. Now, if you
extend XWikiRightsServiceImpl, you won't need to separate the
attachments from the targeted documents.
I have extended the com.xpn.xwiki.user.impl.xwiki.XWikiRightServiceImpl
class to support an 'attachment' level and used the
xwiki.authentication.rightsclass parameter in xwiki.cfg. That works,
thank you!
The only /ugly/ part remaining is my patched
com.xpn.xwiki.render.macro.ImageMacro. Is there another way to prevent
users from using external image urls?