RE: [xwiki-users] Private Space

I think that I agree with Vincent. First, because searching a document requires reading its content, rights to search a document should be congruent to viewing it, so that a distinct "search" right would be superfluous and confusing. Unfortunately, XWiki.search() and searchDocuments() return documents not viewable by the requestor, which amounts to a security hole, to my mind. Of course, searching the document name is a distinct issue from searching its content, and I don't know whether there's universal agreement on the idea that lack of permission to read a document implies a lack of permission to know of its existence. Second, most of the XWiki default document templates do a pretty good job of not presenting links to actions that are forbidden to the user, such as Main.AllDocs, for example (if it's still in the latest version - it's generally not mentioned anywhere), checks that the requestor has the "view" right on a document before listing it. I think that, in the absence of a search method that honors view permissions, this is the only way to do it anyway. So, in addition to - or instead of - Vincent's suggestion, you should call the appropriate method to check the user's "view" rights on each document returned by a search before listing it. brain[sic] ________________________________ From: Vincent Massol [mailto:vincent@massol.net] Sent: Sunday, April 22, 2007 1:37 PM To: xwiki-users(a)objectweb.org Subject: Re: [xwiki-users] Private Space On Apr 22, 2007, at 8:12 PM, Antonio Goncalves wrote: Thanks, it works fine. I don't know the amount of work that could be involved, but why not having a 'search' level in the Global Rights ? The nice thing about xwiki is that all xwiki applications are unknown to the core. Search is just one type of applications. You could say the same thing for any other applications like Blog, Photo Album, etc. It makes sense to use the Global Rights to allow or deny search action for a group or user. You could even have that on a space or a page (a type of user is not allowed to view and search this particular page). I don't think it makes sense as it would tie the Search feature to the core. I'd rather we have something more generic and I think the existing rights are enough for this. Thanks -Vincent 2007/4/22, Vincent Massol &lt;vincent(a)massol.net&gt;et>: Hi Antonio, On Apr 22, 2007, at 3:15 PM, Antonio Goncalves wrote: Hi, I need to have a private space on my wiki. A space where all pages would be completly hidden from everybody else except Admins. I did it easily with Space Rights (XWikiGuest and XWikiAllGroup / view /deny). But the pages can still be searched. How can I hide their content from the search ? This is an interesting problem. Ideally we should check that the user has view rights on any query done on a document in the database. In practice it might not be so easy to do. Anyone has an idea? Now back to your search problem, you can edit the WebSearch page and exclude that space from the search by modifying: #set ($excludedWebs = "doc.web<>'XWiki' and doc.web<>'Main' and doc.web<>'Admin' and doc.web<>'Panels' and doc.name <http://doc.name/> <>'WebPreferences' and") Add your space to the exclusion list. Thanks -Vincent -- You receive this message as a subscriber of the xwiki-users(a)objectweb.org mailing list. To unsubscribe: mailto:xwiki-users-unsubscribe@objectweb.org For general help: mailto: sympa(a)objectweb.org?subject=help ObjectWeb mailing lists service home page: http://www.objectweb.org/wws -- You receive this message as a subscriber of the xwiki-users(a)objectweb.org mailing list. To unsubscribe: mailto:xwiki-users-unsubscribe@objectweb.org For general help: mailto:sympa@objectweb.org?subject=help ObjectWeb mailing lists service home page: http://www.objectweb.org/wws