Note that whatever you do, if the user has view mode he can access the
content using ?xpage=code
Ludovic
Jean-Vincent Drean a écrit :
2007/2/16, Esbach, Brandon
<Esbachb(a)tycoelectronics.com>om>:
A small note about the separate groovy page (I
made note of this in the
page you put in JV):
When you create the page, it cannot have "<%" and "%>". If it
does,
then it won't work (understandable, a lot of other languages work this
way when a separate file used as a source, eg Javascript).
Right, thanks for the addition.
However, this then results in your class being
shown in plain text in
the saved document (this occurs in B2 and B4, can't test B3 as it's not
running on our test environment anymore) - which I would not like to see
user's having any view access to.
I'm unsure of what to suggest around this, or if it is even a concern.
Naturally, if "parseGroovyFromString" would allow the "<%%>"
then the
page would be protected by default from the user (being correctly
assessed as a Groovy page), BUT this is not quite a good solution.
A page with "<%%>" is not be protected by default, the only difference
is that the content is not displayed but executed if the page has been
saved by a user with programming rights (UWPR).
I've added a small trick in the tutorial to prevent a groovy class
from being displayed as plain text, but you can't prevent it from
being edited by a basic user without using appropriate page rights.
http://www.xwiki.org/xwiki/bin/view/DevGuide/GroovyClassHelloWorldTutorial
JV.
------------------------------------------------------------------------
--
You receive this message as a subscriber of the xwiki-users(a)objectweb.org mailing list.
To unsubscribe: mailto:xwiki-users-unsubscribe@objectweb.org
For general help: mailto:sympa@objectweb.org?subject=help
ObjectWeb mailing lists service home page:
http://www.objectweb.org/wws