9 Dec
2010
9 Dec
'10
2:21 a.m.
Hi again,
I wanted to protect my "Website Admin" from any non-admins,
So I edited the Rights to that space, and clicked the 'View' button on
'XWikiAllGroup' until it was a red cross.
Then I checked in the other webbrowser (logged in as a regular user), and
sure enough, I couldn't view the page.
However, I then went to this address:
http://domain.com/xwiki/edit/Website+Admin/
and the regular user was able to edit the page! which also includes a
'Preview' button, which shows them a View!
not good.
then it gets weirder, in a different way.
So far, as regular user, I've gone to Edit, then clicked Preview, and now I
clicked the back button, and I notice the status bar is going to my
redirect.com website...
I have set up my webserver (lighttpd), so that if anyone tries to go to
http://domain.com/ then it'll redirect to http://redirect.com - that way
noone can see the site until I am ready to make it live. The site currently
lives at http://domain.com/xwiki
So for some reason, going to Preview and back again has generated URLs that
are missing the xwiki part of the URL.
So anyway, I watch the page, and the usual Edit page reappears correctly,
but the CONTENT in the Edit window is wrong.
I am able to do this over and over again in Chrome, but not in Firefox.
If I go to Preview, then clear the Cache, and then hit the back button (on
browser, in Chrome), then I get a lot more rubbish in the Edit window:
<p><p>&lt;p&gt;&lt;!<del>startwikilink:false|-|doc|-|Timeline</del>&gt;&lt;span
class="wikilink"&gt;&lt;a
href="/xwiki/Website+Admin/Timeline"&gt;&lt;span
class="wikigeneratedlinkcontent"&gt;Timeline&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;&lt;!<del>stopwikilink</del>&gt;&lt;/p&gt;&lt;p&gt;&lt;br
class="spacer"&gt;&lt;/p&gt;&lt;p&gt;&lt;!<del>startwikilink:false|-|url|-|<!<del>startwikilink:false|-|url|-|<!
startwikilink:false|-|url|-|http://yahoo.com-\><span
class="wikiexternallink"><a class="wikimodel-freestanding"
href="
http://yahoo.com-"><span
class="wikigeneratedlinkcontent">http://yahoo.com-
</span></a></span><!stopwikilink>\-\</del>><span
class="wikiexternallink"><a
class="wikimodel-freestanding" href="<!
startwikilink:false|-|url|-|http://yahoo.com-\-\><span
class="wikiexternallink"><a class="wikimodel-freestanding"
href="
http://yahoo.com--"><span class="wikigeneratedlinkcontent">
http://yahoo.com--</span></a></span><!stopwikilink>…
class="wikigeneratedlinkcontent"><!startwikilink:false|-|url|-|
http://yahoo.com-\-\><span class="wikiexternallink"><a
class="wikimodel-freestanding" href="http://yahoo.com--"><span
class="wikigeneratedlinkcontent">http://yahoo.com--</span></a></span><!
stopwikilink></span></a></span><!<del>stopwikilink</del>>&gt;&lt;span
class="wikiexternallink"&gt;&lt;a
href="<!<del>startwikilink:false|-|url|-|<!startwikilink:false|-|url|-|
http://yahoo.com-\-\><span class="wikiexternallink"><a
class="wikimodel-freestanding" href="http://yahoo.com--"><span
class="wikigeneratedlinkcontent">http://yahoo.com--</span></a></span><!
stopwikilink>><span class="wikiexternallink"><a
class="wikimodel-freestanding" href="<!startwikilink:false|-|url|-|
http://yahoo.com--><span class="wikiexternallink"><a
class="wikimodel-freestanding" href="http://yahoo.com"><span
class="wikigeneratedlinkcontent">http://yahoo.com</span></a></span><!
stopwikilink>"><span
class="wikigeneratedlinkcontent"><!
startwikilink:false|-|url|-|http://yahoo.com--><span
class="wikiexternallink"><a class="wikimodel-freestanding"
href="
http://yahoo.com"><span
class="wikigeneratedlinkcontent">http://yahoo.com
</span></a></span><!stopwikilink></span></a></span><!
Note the yahoo links, I have one yahoo.com link on that short page (its just
a test page at the moment).
The only unusual thing I can see in Chrome's developer tools is in the
Console, this error:
1. Uncaught TypeError: Cannot call method 'removeEventListener' of null
1.
u1b6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:4711<http://www.ms-rap.co…
2.
Mmb6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:4770<http://www.ms-rap.co…
3.
Tmb6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:1101<http://www.ms-rap.co…
4. a.contentWindow.onunload
6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:4965<http://www.ms-rap.com/x…
5.
qYb6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:5102<http://www.ms-rap.co…
6.
iG6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:4630<http://www.ms-rap.com…
7.
NG6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:3547<http://www.ms-rap.com…
8. (anonymous function)
6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:3838<http://www.ms-rap.com/x…
9.
fq6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:4111<http://www.ms-rap.com…
10. (anonymous function)
6CFB0256D9CA24B14DB51FFF0B45A9B5.cache.html:3566<http://www.ms-rap.com/x…
Any ideas?
Oh, and: why is there .cache.html pages included in the static content? Why
isn't it using normal javascript file names?
thanks
Paul
ps are html emails to the list ok?
9 Dec
9 Dec
2:28 a.m.
New subject: [xwiki-users] View rights and Edit rights... and some weird stuff
On 9 December 2010 09:21, Paul Harris <harris.pc(a)gmail.com> wrote:
Hi again,
I wanted to protect my "Website Admin" from any non-admins,
So I edited the Rights to that space, and clicked the 'View' button on
'XWikiAllGroup' until it was a red cross.
Then I checked in the other webbrowser (logged in as a regular user), and
sure enough, I couldn't view the page.
However, I then went to this address:
http://domain.com/xwiki/edit/Website+Admin/
and the regular user was able to edit the page! which also includes a
'Preview' button, which shows them a View!
not good.
After I removed ALL the rights to the AllUsers group, I noticed that
unregistered users are able to view the space.
What happens when I add more groups to the wiki, will those users be able to
view the space? Or will they be covered by AllUsers?
I don't find this intuitive... I haven't thought this through, but I
would've preferred to be able to switch OFF all rights, and then switch on
the rights to the users/groups I want to edit. At the moment there are a
few places where you could accidentally leave access open to spaces that
should not be open.
thanks
Paul
10:29 a.m.
New subject: [xwiki-users] View rights and Edit rights... and some weird stuff
Hi Paul,
On Thu, Dec 9, 2010 at 02:28, Paul Harris <harris.pc(a)gmail.com> wrote:
On 9 December 2010 09:21, Paul Harris
<harris.pc(a)gmail.com> wrote:
There is a way to achieve this. In your wiki's administration, give all
rights (green checkmark) only to the XWiki.XWikikiAdminGroup . Leave all
other boxes blank. In practice, this will deny all rights to anyone on the
wiki but for the admin group.
Then you can add rights iteratively from there.
Guillaume
Hi again,
I wanted to protect my "Website Admin" from any non-admins,
So I edited the Rights to that space, and clicked the 'View' button on
'XWikiAllGroup' until it was a red cross.
Then I checked in the other webbrowser (logged in as a regular user), and
sure enough, I couldn't view the page.
However, I then went to this address:
http://domain.com/xwiki/edit/Website+Admin/
and the regular user was able to edit the page! which also includes a
'Preview' button, which shows them a View!
not good.
After I removed ALL the rights to the AllUsers group, I noticed that
unregistered users are able to view the space.
What happens when I add more groups to the wiki, will those users be able
to
view the space? Or will they be covered by AllUsers?
I don't find this intuitive... I haven't thought this through, but I
would've preferred to be able to switch OFF all rights, and then switch on
the rights to the users/groups I want to edit. At the moment there are a
few places where you could accidentally leave access open to spaces that
should not be open.
thanks
Paul
_______________________________________________
users mailing list
users(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/users
2:01 p.m.
New subject: [xwiki-users] View rights and Edit rights... and some weird stuff
On 9 December 2010 17:29, Guillaume Lerouge <guillaume(a)xwiki.com> wrote:
Hi Paul,
On Thu, Dec 9, 2010 at 02:28, Paul Harris <harris.pc(a)gmail.com> wrote:
on
Good idea, thanks Guillaume
On 9 December 2010 09:21, Paul Harris
<harris.pc(a)gmail.com> wrote:
> Hi again,
>
> I wanted to protect my "Website Admin" from any non-admins,
> So I edited the Rights to that space, and clicked the 'View' button on
> 'XWikiAllGroup' until it was a red cross.
> Then I checked in the other webbrowser (logged in as a regular user),
and
sure
enough, I couldn't view the page.
However, I then went to this address:
http://domain.com/xwiki/edit/Website+Admin/
and the regular user was able to edit the page! which also includes a
'Preview' button, which shows them a View!
not good.
After I removed ALL the rights to the AllUsers group, I noticed that
unregistered users are able to view the space.
What happens when I add more groups to the wiki, will those users be able
to
view the space? Or will they be covered by AllUsers?
I don't find this intuitive... I haven't thought this through, but I
would've preferred to be able to switch OFF all rights, and then switch the rights to the users/groups I want to edit.
At the moment there are
a
few places where you could accidentally leave
access open to spaces that
should not be open.
There is a way to achieve this. In your wiki's administration, give all
rights (green checkmark) only to the XWiki.XWikikiAdminGroup . Leave all
other boxes blank. In practice, this will deny all rights to anyone on the
wiki but for the admin group.
Then you can add rights iteratively from there.
Guillaume
3:30 p.m.
New subject: [xwiki-users] View rights and Edit rights... and some weird stuff
On 12/09/2010 02:28 AM, Paul Harris wrote:
On 9 December 2010 09:21, Paul
Harris<harris.pc(a)gmail.com> wrote:
Switching on some rights automatically has the effect of switching off
the default rights, which means if a right is not explicitly granted, it
is considered forbidden. Not very intuitive, I know.
Hi again,
I wanted to protect my "Website Admin" from any non-admins,
So I edited the Rights to that space, and clicked the 'View' button on
'XWikiAllGroup' until it was a red cross.
Then I checked in the other webbrowser (logged in as a regular user), and
sure enough, I couldn't view the page.
However, I then went to this address:
http://domain.com/xwiki/edit/Website+Admin/
and the regular user was able to edit the page! which also includes a
'Preview' button, which shows them a View!
not good.
After I removed ALL the rights to the AllUsers group, I noticed that
unregistered users are able to view the space.
What happens when I add more groups to the wiki, will those users be able to
view the space? Or will they be covered by AllUsers?
I don't find this intuitive... I haven't thought this through, but I
would've preferred to be able to switch OFF all rights, and then switch on
the rights to the users/groups I want to edit. At the moment there are a
few places where you could accidentally leave access open to spaces that
should not be open.
--
Sergiu Dumitriu
http://purl.org/net/sergiu/
11:46 p.m.
New subject: [xwiki-users] View rights and Edit rights... and some weird stuff
On 9 December 2010 22:30, Sergiu Dumitriu <sergiu(a)xwiki.com> wrote:
On 12/09/2010 02:28 AM, Paul Harris wrote:
to
That doesn't seem to be the case, as I said, I turned off some of the rights
(View), and yet another right (Edit) for the same bunch of users was still
allowed. Switching off some of the rights did *not* have the effect of
switching off the default rights.
Or do I have to switch on some rights in order to get the behaviour you are
talking about?
thanks,
Paul
On 9 December 2010 09:21, Paul
Harris<harris.pc(a)gmail.com> wrote:
> Hi again,
>
> I wanted to protect my "Website Admin" from any non-admins,
> So I edited the Rights to that space, and clicked the 'View' button on
> 'XWikiAllGroup' until it was a red cross.
> Then I checked in the other webbrowser (logged in as a regular user),
and
sure
enough, I couldn't view the page.
However, I then went to this address:
http://domain.com/xwiki/edit/Website+Admin/
and the regular user was able to edit the page! which also includes a
'Preview' button, which shows them a View!
not good.
After I removed ALL the rights to the AllUsers group, I noticed that
unregistered users are able to view the space.
What happens when I add more groups to the wiki, will those users be able view the space? Or will they be covered by
AllUsers?
I don't find this intuitive... I haven't thought this through, but I
would've preferred to be able to switch OFF all rights, and then switch
on
the rights to the users/groups I want to edit.
Switching on some rights automatically has the effect of switching off
the default rights, which means if a right is not explicitly granted, it
is considered forbidden. Not very intuitive, I know.
10 Dec
10 Dec
7:26 a.m.
New subject: [xwiki-users] View rights and Edit rights... and some weird stuff
On 9 December 2010 21:01, Paul Harris <harris.pc(a)gmail.com> wrote:
On 9 December 2010 17:29, Guillaume Lerouge <guillaume(a)xwiki.com> wrote:
Hi again,
I tried Guillaume's idea, but it doesn't work.
What I did:
goto XWikiPreferences, and change ALL the rights in Unregistered users to NO
(red cross).
I also did that for AllUsers,
and for AllAdmins i ticked them all Green, except for Program which i ticked
NO.
Then I checked the website without logging on - sure enough it asked me to
log in. Good.
Then I edited the Rights in the Main space, and ticked on View only for
Unregistered users.
Then I checked again. This time the Main page DID come up, however the
background images that are part of the skin did NOT appear (I'm using the
nightfall colour scheme).
The link required for the background image is:
domain.com/xwiki/download/ColorThemes/Nightfall/bg8x540.jpg
what rights does unregistered users require for that?
thanks
Paul
Hi Paul,
On Thu, Dec 9, 2010 at 02:28, Paul Harris <harris.pc(a)gmail.com> wrote:
able
Good idea, thanks Guillaume
On 9 December 2010 09:21, Paul Harris
<harris.pc(a)gmail.com> wrote:
> Hi again,
>
> I wanted to protect my "Website Admin" from any non-admins,
> So I edited the Rights to that space, and clicked the 'View' button on
> 'XWikiAllGroup' until it was a red cross.
> Then I checked in the other webbrowser (logged in as a regular user),
and
sure
enough, I couldn't view the page.
However, I then went to this address:
http://domain.com/xwiki/edit/Website+Admin/
and the regular user was able to edit the page! which also includes a
'Preview' button, which shows them a View!
not good.
After I removed ALL the rights to the AllUsers group, I noticed that
unregistered users are able to view the space.
What happens when I add more groups to the wiki, will those users be to
view the space? Or will they be covered by AllUsers?
I don't find this intuitive... I haven't thought this through, but I
would've preferred to be able to switch OFF all rights, and then switch
on
the rights to the users/groups I want to edit.
At the moment there are
a
few places where you could accidentally leave
access open to spaces that
should not be open.
There is a way to achieve this. In your wiki's administration, give all
rights (green checkmark) only to the XWiki.XWikikiAdminGroup . Leave all
other boxes blank. In practice, this will deny all rights to anyone on the
wiki but for the admin group.
Then you can add rights iteratively from there.
Guillaume
10:08 a.m.
New subject: [xwiki-users] View rights and Edit rights... and some weird stuff
On Thu, Dec 9, 2010 at 23:46, Paul Harris <harris.pc(a)gmail.com> wrote:
On 9 December 2010 22:30, Sergiu Dumitriu
<sergiu(a)xwiki.com> wrote:
Rights are not connected to each other, that means that "no view
rights" doesn't imply "no other rights", even if logically
"edit" is
stronger than "view".
Also allow edit, admin, comment for the users that should have these rights.
Note that the rights implementation is going to change soon, see
http://svn.xwiki.org/svnroot/xwiki/contrib/sandbox/xwiki-security-rightserv…
--
http://purl.org/net/sergiu
On 12/09/2010 02:28 AM, Paul Harris wrote:
to
That doesn't seem to be the case, as I said, I turned off some of the rights
(View), and yet another right (Edit) for the same bunch of users was still
allowed. Switching off some of the rights did *not* have the effect of
switching off the default rights.
Or do I have to switch on some rights in order to get the behaviour you are
talking about?
On 9 December 2010 09:21, Paul
Harris<harris.pc(a)gmail.com> wrote:
> Hi again,
>
> I wanted to protect my "Website Admin" from any non-admins,
> So I edited the Rights to that space, and clicked the 'View' button on
> 'XWikiAllGroup' until it was a red cross.
> Then I checked in the other webbrowser (logged in as a regular user),
and
sure
enough, I couldn't view the page.
However, I then went to this address:
http://domain.com/xwiki/edit/Website+Admin/
and the regular user was able to edit the page! which also includes a
'Preview' button, which shows them a View!
not good.
After I removed ALL the rights to the AllUsers group, I noticed that
unregistered users are able to view the space.
What happens when I add more groups to the wiki, will those users be able view the space? Or will they be covered by
AllUsers?
I don't find this intuitive... I haven't thought this through, but I
would've preferred to be able to switch OFF all rights, and then switch
on
the rights to the users/groups I want to edit.
Switching on some rights automatically has the effect of switching off
the default rights, which means if a right is not explicitly granted, it
is considered forbidden. Not very intuitive, I know.
5032
days inactive
5033
days old
7 comments
3 participants
participants (3)
-
Guillaume Lerouge -
Paul Harris -
Sergiu Dumitriu