Here is a possible workaround for this issue, as well as for XWIKI-13089, that could either fix or slightly improve the situation (depending on the data and access rights), for XWiki instances that are using custom searches (or that can setup a custom search). This applies to the cases where some sort of association can be done between the user's role / groups and the content that they can view, and this association is somewhat fixed, or determined by little rules. A few examples:
the wiki contains a single page tree under the root that is public, all the other page trees are only accessible to authenticated users;
all page trees are accessible to all users, with the exception of a few page trees that are private and only accessible to some groups;
most of the access rights are controlled at a specified level of the page trees (usually the first level), there are little access rules that are deep in the page trees;
some rights on pages are correlated with a property of an object of the page, or with the presence of an object;
other similar cases.
For these cases, the following can be done to mitigate the impact of this issue and of XWIKI-13089 .
in the script that sets up the custom parameters for the search, determine the role of the current user, with respect to the little rules identified above
based on the determined role of the current user, add extra rules in the custom parameters of the search, in the filterQuery parameter, to exclude, from the search results, pages that won't be visible for the current user.
This workaround can be applied partially, only to some roles and some content (for example, excluding the private page trees for guest users), and it may not completely fix the problem, but only make it less visible / less bad (for example, only some differences of results would appear, sometimes, instead of constantly having differences in results).
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.
