6 Aug
2012
6 Aug
'12
11:48 a.m.
Hi,
As we plan to use Xwiki as our new wiki in our company, I'm looking at
various use cases.
One cool feature would be an Inventory System for Hard- and Software.
I've set up a first draft with AppWithIn Minutes and it is looking not bad.
But in a perfect world it would be cool to have following features in
addition:
1. Either: When the "Add Entry" Button is pressed a new unique number will
be generated ( a sequential number as Inventory number)
Or: After the all data have been filled in, such a number will be generated
(e.g. 01 for Hardware 03 for PC 0234 for running number, gives Inventory
number 01030234)
2. If I put secret data in there (e.g. Pin/PUK for mobiles) I was able to
let it not show in the list AppWithInMinutes generates (viewable only for
admins), but of course in the generated Page, everybody can see it. Is there
a way that this is only viewable for admins as well? Of course I can
prohibit this by securing the hole page, but ( again in a perfect world :)
it would be good that the employee can see and edit all his stuff in the
inventory, but only he and/or admins can see the confidental data.
Maybe one or another has a tip for me, or can point me in the right
direction.
Best Regards
Stocki
--
View this message in context:
http://xwiki.475771.n2.nabble.com/Inventory-Macro-tp7580719.html
Sent from the XWiki- Users mailing list archive at Nabble.com.
6 Aug
6 Aug
12:06 p.m.
Hi Stocki,
On Mon, Aug 6, 2012 at 12:48 PM, Stocki <Stefan.Stockinger(a)tfk.de> wrote:
> Maybe one or another has a tip for me, or
can point me in the right
> direction.
> Best Regards
> Stocki
> --
> View this message in context:
http://xwiki.475771.n2.nabble.com/Inventory-Macro-tp7580719.html
> Sent from the XWiki- Users mailing list archive at Nabble.com.
> _______________________________________________
> users mailing list
> users(a)xwiki.org
> http://lists.xwiki.org/mailman/listinfo/users
Hi,
As we plan to use Xwiki as our new wiki in our company, I'm looking at
various use cases.
One cool feature would be an Inventory System for Hard- and Software.
I've set up a first draft with AppWithIn Minutes and it is looking not bad.
But in a perfect world it would be cool to have following features in
addition:
1. Either: When the "Add Entry" Button is
pressed a new unique number will
be generated ( a sequential number as Inventory number)
Or: After the all data have been filled in, such a number will be generated
(e.g. 01 for Hardware 03 for PC 0234 for running number, gives Inventory
number 01030234)
This is in progress. See http://jira.xwiki.org/browse/XWIKI-7374 . We
hope to have it in 4.2 final.
2. If I put secret data in there (e.g. Pin/PUK for
mobiles) I was able to
let it not show in the list AppWithInMinutes generates (viewable only for
admins), but of course in the generated Page, everybody can see it. Is there
a way that this is only viewable for admins as well? Of course I can
prohibit this by securing the hole page, but ( again in a perfect world :)
it would be good that the employee can see and edit all his stuff in the
inventory, but only he and/or admins can see the confidental data.
This is a bit tricky. You can customize the sheet used to view and
edit the application entries so that the Pin/PUK field/value is
displayed only for admins but it won't prevent users from editing the
application entries (pages) in Object mode and see the secret value.
If a user has the right to edit a page then he can see all the
property values of objects attached to that page. In other words, the
rights system doesn't work at the level of object property, not even
at the level of object. The finest level is page.
Hope this helps,
Marius
1:14 p.m.
This is in progress. See
http://jira.xwiki.org/browse/XWIKI-7374 . We
hope to have it in 4.2 final.
Good to hear that this is in progress. Any Idea when 4.2 will be released?
2. If I put
secret data in there (e.g. Pin/PUK for mobiles) I was able to
let it not show in the list AppWithInMinutes generates (viewable only for
admins), but of course in the generated Page, everybody can see it. Is
there
a way that this is only viewable for admins as well? Of course I can
prohibit this by securing the hole page, but ( again in a perfect world
:)
it would be good that the employee can see and edit all his stuff in the
inventory, but only he and/or admins can see the confidental data.
This is a bit tricky. You can customize the sheet used to view and
edit the application entries so that the Pin/PUK field/value is
displayed only for admins but it won't prevent users from editing the
application entries (pages) in Object mode and see the secret value.
If a user has the right to edit a page then he can see all the
property values of objects attached to that page. In other words, the
rights system doesn't work at the level of object property, not even
at the level of object. The finest level is page.
Hope this helps,
Marius
1:32 p.m.
On Mon, Aug 6, 2012 at 2:14 PM, Stocki <Stefan.Stockinger(a)tfk.de> wrote:
Yeah, I thought so, but wanted to ask anyway. I will look into the hole
confidental data thing and probably will leave it out there.
Thank you
Stocki
--
View this message in context:
http://xwiki.475771.n2.nabble.com/Inventory-Macro-tp7580719p7580723.html
Sent from the XWiki- Users mailing list archive at Nabble.com.
_______________________________________________
users mailing list
users(a)xwiki.org
http://lists.xwiki.org/mailman/listinfo/users
This is in progress. See
http://jira.xwiki.org/browse/XWIKI-7374 . We
hope to have it in 4.2 final.
Good to hear that this is in progress. Any Idea when
4.2 will be released?
There is a vote in progress to release 4.2 final on 17th September,
but you may be able to preview this feature sooner in 4.2M3 or 4.2RC1
if Sergiu manages to commit on time.
Hope this helps,
Marius
2. If I
put secret data in there (e.g. Pin/PUK for mobiles) I was able to
let it not show in the list AppWithInMinutes generates (viewable only for
admins), but of course in the generated Page, everybody can see it. Is
there
a way that this is only viewable for admins as well? Of course I can
prohibit this by securing the hole page, but ( again in a perfect world
:)
it would be good that the employee can see and edit all his stuff in the
inventory, but only he and/or admins can see the confidental data.
This is a bit tricky. You can customize the sheet used to view and
edit the application entries so that the Pin/PUK field/value is
displayed only for admins but it won't prevent users from editing the
application entries (pages) in Object mode and see the secret value.
If a user has the right to edit a page then he can see all the
property values of objects attached to that page. In other words, the
rights system doesn't work at the level of object property, not even
at the level of object. The finest level is page.
Hope this helps,
Marius
3:22 p.m.
> If a user has the right to edit a page then he can
see all the
> property values of objects attached to that page.
I will look into the hole confidental data thing
i worked at company where they used hidden properties as well.
In IBM Lotus Notes, client versions 5 till 7
The same trick was widely used by everyone.
It was good - for really doing one's work one had to know more than bare
minimum.
But it was security breach nonetheless.
It looks like IBM/Lotus could not implement per-property visibility.
And probably it is rather hard to implement it in doc-flow systems at all.
--
View this message in context:
http://xwiki.475771.n2.nabble.com/Inventory-Macro-tp7580719p7580727.html
Sent from the XWiki- Users mailing list archive at Nabble.com.
4:20 p.m.
On 08/06/2012 07:14 AM, Stocki wrote:
Yeah, I thought so, but wanted to ask anyway. I will look into the hole
confidental data thing and probably will leave it out there.
There is a way to fix this, but it requires more code.
The basic idea is that you store confidential information as custom data
stored in the database, not as basic class properties, and you create a
script service that provides access to this data. Since this script
service is the only way to access the data, you can enforce rights any
way you like in it.
--
Sergiu Dumitriu
http://purl.org/net/sergiu/
This is in progress. See
http://jira.xwiki.org/browse/XWIKI-7374 . We
hope to have it in 4.2 final.
Good to hear that this is in progress. Any Idea when 4.2 will be released?
2. If I
put secret data in there (e.g. Pin/PUK for mobiles) I was able to
let it not show in the list AppWithInMinutes generates (viewable only for
admins), but of course in the generated Page, everybody can see it. Is
there
a way that this is only viewable for admins as well? Of course I can
prohibit this by securing the hole page, but ( again in a perfect world
:)
it would be good that the employee can see and edit all his stuff in the
inventory, but only he and/or admins can see the confidental data.
This is a bit tricky. You can customize the sheet used to view and
edit the application entries so that the Pin/PUK field/value is
displayed only for admins but it won't prevent users from editing the
application entries (pages) in Object mode and see the secret value.
If a user has the right to edit a page then he can see all the
property values of objects attached to that page. In other words, the
rights system doesn't work at the level of object property, not even
at the level of object. The finest level is page.
Hope this helps,
Marius
4474
days inactive
4474
days old
5 comments
4 participants
participants (4)
-
Arioch -
Marius Dumitru Florea -
Sergiu Dumitriu -
Stocki