24 Aug
2009
24 Aug
'09
5:37 p.m.
Hi Trevor,
On Mon, Aug 24, 2009 at 5:06 PM, Trevor <tr.wiki(a)telus.net> wrote:
In setting up our XWiki farm, I came across a couple
of bugs.
In general, should we always bring up bugs on the mailing list first before
entry into jira?
I deleted the account named "Admin" after setting up other individuals as
administrators. A user with "admin" rights (or even "delete" rights)
could
no longer create or delete wikis from the "wikis" page of the XEM. However,
if I recreated an account named "Admin", then a user with "admin"
rights
*could* create/delete wikis from that page, even though they're not logged
in as user "Admin".
The rights checking on that page must be hardcoded to check if user "Admin"
has the rights, instead of checking the user who's actually logged in and
making the page request.
XEM 1.9.3
That's most probably due to a programming rights issue. In XWiki, certain
pieces of code (namely Groovy code) can be executed only if the last user to
have saved the document where such code is stored has programming rights.
This is to prevent arbitrary code execution and privilege escalation in the
wiki.
If I'm correct, all you need to do after deleting the "Admin" account is to
save the page where the Groovy code is stored with one of your other admins,
after making sure that admin has the programming right set as true at the
global level of your farm.
We're aware that the way this mechanism works is not ideal in cases such as
yours and we'll fix its logic at one point, but for the time being that's
how things work.
So it's not quite a bug but I agree there's room for improvement.
As for discussing issues on the mailing lists before posting on JIRA, well,
the discussion will take place in JIRA comments if it has to anyway ;-)
Thanks for your feedback,
Guillaume
Trevor
_______________________________________________
users mailing list
users(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/users
--
Guillaume Lerouge
Product Manager - XWiki
Skype: wikibc
Twitter: glerouge
http://guillaumelerouge.com/