Ok so I'm using xwiki 1.0 standalone. Setup is pretty simple. I just unzipped the files and ran the start_xwiki.sh and opened it up in my browser. I haven't made any modifications (except changing the port number to 80 in the startup script). My problem is that a lot of the security related options don't seem to work. For example, when I create a new group, it doesn't always show up under http://192.168.1.27/xwiki/bin/view/XWiki/XWikiGroups and if I try to recreate that group it says it already exists. Also, when adding a user to a group by clicking the little + button to add a new line for a new user (on http://192.168.1.27/xwiki/bin/inline/XWiki/GroupName), the link goes to http://192.168.1.27xwiki/bin/objectadd/XWiki/GroupName?classname=XWiki.XWiki... Notice that there's no "/" in between the IP address and "xwiki", so of course the "page cannot be displayed". If I fix the link myself in the address bar and add the missing "/" then the page allowing me to add a user comes up correctly. If I change the startup script to go back to port 8080 (default), then the link is http://192.168.1.27:8080/bin/objectadd/XWiki/GroupName?classname=XWiki.XWiki.... Of course, now there's a "/" but "/xwiki" is missing and I still get a "page cannot be displayed". My other problem is that once I do get a user and/or group created and I want to set permissions on a particular "space" (i.e. I do or don't want it to show up altogether for different users), I can deny all the permissions available on the administration "space rights" tab, but the space is still visible on the right hand side, it's just that it returns the user an error if they don't have rights. So I figured I might be able to hide the space altogether and saw the "space prefs" tab and thought that might be useful. Of course the link for this tab is http://192.168.1.27xwiki/bin/objectadd/SpaceName/WebPreferences?classname=XW.... Notice the lack of "/" in between the IP address and "xwiki" again at the beginning of the link. Of course I can't bring that page up either. I'm using a completely default xwiki 1.0 standalone version downloaded from xwiki.org on Fedora 7. Apache is not running, just xwiki (tomcat, I guess). It seems rather bizarre that I'd have so many problems with something I didn't change at all, except for the port number. Of course, changing the port number back just mangles the above mentioned links differently. It doesn't fix the problem. Seems like I'm missing something pretty fundamental here. Any ideas what I'm doing wrong? -BJ Quinn -- View this message in context: http://www.nabble.com/Security-problems-tf4119184.html#a11714695 Sent from the XWiki- Users mailing list archive at Nabble.com.
Don't know about the link problems, looks like a bug to me. However, mystifying behavior often results when adding groups or adding users to groups. I fought this for quite a while even after reading the FAQ that mentioned this, and here's the reason for the fuddlement. For performance reasons, XWiki caches group memberships, and the cache must be flushed before changes to the groups take effect. The XWikiGroupService itself also has a separate cache. Because my memory is a little faint on this, please take this as a clue rather than an absolute procedure: First and foremost, you should find that restarting XWiki causes the newly-created groups and members to behave as expected. If you find restarting undesirable, as I suspect, calling xwiki.flushCache() should have the same effect, without having to take down the whole wiki, but it will cause the first requests after it to load more slowly. Finally, the least disruptive (and the one I'm least sure of) is xwiki.getGroupService().flushCache(). Note: the object "xwiki" in both cases above is an instance of com.xpn.xwiki.XWiki, which can be obtained in a Velocity script by the reference $xwiki.getXWiki() (or just $xwiki.xWiki, of course). The getWiki method is privileged, and accessible only to pages whose last author has the "programming" privilege on that page. brain[sic]
-----Original Message----- From: bjquinn [mailto:[email protected]] Sent: Friday, July 20, 2007 2:35 PM To: [email protected] Subject: [xwiki-users] Security problems
Ok so I'm using xwiki 1.0 standalone. Setup is pretty simple. I just unzipped the files and ran the start_xwiki.sh and opened it up in my browser. I haven't made any modifications (except changing the port number to 80 in the startup script).
My problem is that a lot of the security related options don't seem to work. For example, when I create a new group, it doesn't always show up under http://192.168.1.27/xwiki/bin/view/XWiki/XWikiGroups and if I try to recreate that group it says it already exists.
Also, when adding a user to a group by clicking the little + button to add a new line for a new user (on http://192.168.1.27/xwiki/bin/inline/XWiki/GroupName), the link goes to http://192.168.1.27xwiki/bin/objectadd/XWiki/GroupName?classna me=XWiki.XWikiGroups&xredirect=http://192.168.1.27/xwiki/bin/inl> ine/XWiki/GroupName Notice that there's no "/" in between the IP address and "xwiki", so of course the "page cannot be displayed". If I fix the link myself in the address bar and add the missing "/" then the page allowing me to add a user comes up correctly. If I change the startup script to go back to port 8080 (default), then the link is http://192.168.1.27:8080/bin/objectadd/XWiki/GroupName?classna me=XWiki.XWikiGroups&xredirect=http://192.168.1.27/xwiki/bin/inl> ine/XWiki/GroupName. Of course, now there's a "/" but "/xwiki" is missing and I still get a "page cannot be displayed".
My other problem is that once I do get a user and/or group created and I want to set permissions on a particular "space" (i.e. I do or don't want it to show up altogether for different users), I can deny all the permissions available on the administration "space rights" tab, but the space is still visible on the right hand side, it's just that it returns the user an error if they don't have rights. So I figured I might be able to hide the space altogether and saw the "space prefs" tab and thought that might be useful. Of course the link for this tab is http://192.168.1.27xwiki/bin/objectadd/SpaceName/WebPreference s?classname=XWiki.XWikiPreferences&xredirect=http://192.168.1. 27/xwiki/bin/admin/SpaceName/WebPreferences?editor=spaceprefs& global=1&space=SpaceName. Notice the lack of "/" in between the IP address and "xwiki" again at the beginning of the link. Of course I can't bring that page up either. I'm using a completely default xwiki 1.0 standalone version downloaded from xwiki.org on Fedora 7. Apache is not running, just xwiki (tomcat, I guess). It seems rather bizarre that I'd have so many problems with something I didn't change at all, except for the port number. Of course, changing the port number back just mangles the above mentioned links differently. It doesn't fix the problem. Seems like I'm missing something pretty fundamental here. Any ideas what I'm doing wrong?
-BJ Quinn -- View this message in context: http://www.nabble.com/Security-problems-tf4119184.html#a11714695 Sent from the XWiki- Users mailing list archive at Nabble.com.
participants (2)
-
bjquinn -
THOMAS, BRIAN M (ATTSI)