Re: [xwiki-users] security concern: XWikiGuest rolling back
Yishay Mor wrote:
This has happened a few times on http://patternlanguagenetwork.myxwiki.org/, and I can't explain it. I set the access rights to allow view by all, but edit is restricted. I'm seeing documents rolled back to older versions by XWikiGuest. Example:
http://patternlanguagenetwork.myxwiki.org/xwiki/bin/view/Patterns/tabletopco...
On this document the guest has been granted edit rights. Look at the rights editing for it, and select Users, and you will see that Unregistered Users has set view, comment and edit.
--
That's strange: I see "view" and "comment" ticked, but not "edit"
Yishay Mor wrote:
Yishay Mor wrote:
This has happened a few times on http://patternlanguagenetwork.myxwiki.org/, and I can't explain it. I set the access rights to allow view by all, but edit is restricted. I'm seeing documents rolled back to older versions by XWikiGuest. Example:
http://patternlanguagenetwork.myxwiki.org/xwiki/bin/view/Patterns/tabletopco...
On this document the guest has been granted edit rights. Look at the rights editing for it, and select Users, and you will see that Unregistered Users has set view, comment and edit.
I still see edit selected... And as a guest I can indeed edit the document. Just to make sure we're on the same page, I'm looking at http://patternlanguagenetwork.myxwiki.org/xwiki/bin/edit/Patterns/tabletopco... -- Sergiu Dumitriu http://purl.org/net/sergiu/
Just to add to this
Yishay Mor wrote:
This has happened a few times on http://patternlanguagenetwork.myxwiki.org/, and I can't explain it. I set the access rights to allow view by all, but edit is restricted. I'm seeing documents rolled back to older versions by
XWikiGuest. Example:
http://patternlanguagenetwork.myxwiki.org/xwiki/bin/view/Patterns/tab letopconceptmapping
On this document the guest has been granted edit rights. Look at the rights editing for it, and select Users, and you will see that Unregistered Users has set view, comment and edit.
I still see edit selected... And as a guest I can indeed edit the document. Just to make sure we're on the same page, I'm looking at
http://patternlanguagenetwork.myxwiki.org/xwiki/bin/edit/Patterns/tablet opconceptmapping?editor=rights I went to the link Sergiu specified and I can view all groups and users without being logged in. Top right still says Log-in Register Ajdin -------------------------------------------------------- NOTICE This message and any files transmitted with it is intended for the addressee only and may contain information that is confidential or privileged. Unauthorised use is strictly prohibited. If you are not the addressee, you should not read, copy, disclose or otherwise use this message, except for the purpose of delivery to the addressee. Any views or opinions expressed within this e-mail are those of the author and do not necessarily represent those of Coventry University.
participants (3)
-
Ajdin Brandic -
Sergiu Dumitriu -
Yishay Mor