Hi, On Feb 23, 2009, at 11:15 PM, Yishay Mor wrote:
This has happened a few times on
http://patternlanguagenetwork.myxwiki.org/, and I can't explain it. I set the access rights to allow view by all, but edit is restricted. I'm seeing documents rolled back to older versions by XWikiGuest. Example:
http://patternlanguagenetwork.myxwiki.org/xwiki/bin/view/Patterns/tabletopco...
On this document the guest has been granted edit rights. Look at the rights editing for it, and select Users, and you will see that Unregistered Users has set view, comment and edit.
I still see edit selected... And as a guest I can indeed edit the document. Just to make sure we're on the same page, I'm looking at
http://patternlanguagenetwork.myxwiki.org/xwiki/bin/edit/Patterns/tabletopco...
This is really puzzling. I don't understand how the guest user has obtained edit rights on some objects and not on others. Just to be on the safe side, I ran the script below:
#set ($hql = ", BaseObject as obj where obj.name=doc.fullName and obj.className='Patterns.PatternClass' and obj.name <>'Patterns.PatternClassTemplate'") #set ($items= $xwiki.searchDocuments($hql)) #foreach ($item in $items) * $item #set ($itemDoc = $xwiki.getDocument($item)) #set ($rights = $itemDoc.getObject("XWiki.XWikiRights", true)) #set ($result = $rights.set("levels", "edit")) #set ($result = $rights.set("users", "XWiki.XWikiGuest")) #set ($result = $rights.set("allow", 0)) #end
I don't think this is correct since you're not saving the modifications... They'll be in the cache when but they go out of the cache you'll have lost your changes. See http://code.xwiki.org/xwiki/bin/view/Snippets/SettingRightsSnippet -Vincent