- xwiki-devs@xwiki.org - lists.xwiki.org

Re: [xwiki-devs] xwiki-sandbox/org.xwiki.model vs xwiki-sandbox/components/xwiki-model
by Asiri Rathnayake 10 Mar '08

10 Mar '08

---------- Forwarded message ---------- From: Asiri Rathnayake <asiri.rathnayake(a)gmail.com> Date: Mon, Mar 10, 2008 at 4:55 AM Subject: Re: [xwiki-devs] xwiki-sandbox/org.xwiki.model vs xwiki-sandbox/components/xwiki-model To: Vincent Massol <vincent(a)massol.net> Cc: XWiki Developers <devs(a)xwiki.org> Hi Vincent, Following is a simple discussion of the two implementations of the new data-model of ArchitectureV2. Both of these implementations are not complete yet and my knowledge of xwiki is still limited. There for, there may be short-commings in the following discussion, please bare with me and try to correct me where i'm wrong (this will help me a lot). xwiki-sandbox/components/xwiki-model (Vincent) ----------------------------------------------------------------------- -> Represents a clear hierarchical view of domain objects (Server->Wiki->Space->Page) [ A simple graphical representation of the model is attached. ] -> Does not include any administrative / security / rights related code (simple model definitions). -> Currently upward navigation (given a page find it's parent space) is not possible. (but i believe this can be implemented at a higher layer) -> PropertyDefinition class is currently isolated, and no mention about Users. -> No mention about persistence related issues (DAOs). -> All are concrete classes Q.) Shouldn't we have interfaces (with a default impl) rather than classes here ? xwiki-sandbox/org.xwiki.model (Mikhail, Stéphane) ------------------------------------------------------------------------- -> The business layer (org.xwiki.model) contains model classes (Farm, Wiki, Space, Document, User) Along with (Session and XWikiException) Q.) Strictly speaking, Session and XWikiException are not domain classes. Shouldn't we try to keep things more simple in the model ? -> Here the notion of a hierarchy seems to be little blured, Farm doesn't have any method like getWikis() but it seems to contain some administrative / authentication related methods like createUser() and checkPassword() (This looks quite odd for me). And with this model it is possible to navigate upwards the hierarchy (Page->Space->Wiki). -> Some domain classes have code related to session handling / user rights. (is this ok?) -> In a sense, domain classes seems to be active rather than being passive (getters / setters). Example : space.addPage(Page page) <- passive, space.newPage(, , ,) <- active Example (imaginary) : space.getPages(SomeFilter) <- passive, space.getPages(...) {/* perform validations, access rights and return */} <- active -> There is a persistance layer (org.xwiki.model.dao). If we are to have two seperate plexus components for storage and data-model (or in other words, to decouple the model from storage), DAO classes should actually go inside the storage component. Having DAO classes inside the model will automatically bind the model to a particular storage implementation. -> org.xwiki.model.dao seems to have a single DAO interface (IWikiDAO) to access the storage rather than having separate DAO classes for each domain class. Q.) Why not have separate DAO classes for each model class ? Q.) org.xwiki.model.dao has *Value classes for each domain class. Why not use domain classes directly ? -> There is a default in-memory implementation of IWikiDAO inside org.xwiki.model.dao.memory I think that's all for the moment. Thanks. - Asiri On Sun, Mar 9, 2008 at 7:48 PM, Vincent Massol <vincent(a)massol.net> wrote: > Hi Asiri, > > On Mar 9, 2008, at 2:25 PM, Asiri Rathnayake wrote: > > > Hi Stéphane, > > > > I think the new data model is commited at xwiki-sandbox/ > > org.xwiki.model. But i'm bit confused with xwiki-sandbox/components/ > > xwiki-model. What does the latter stand for ? > > The one in org.xwiki.model was done by Stephane and the other one by > me ;) > > I guess they are two proposals for the same thing so we'll need to > decide which one to use. Note that the one I have isn't finished > either. We need to continue working on it, make proposals, etc. > Maybe you could review both and send an email with the differences. > This is an area I'd like to work on actively too. I've just been busy > with the 1.3 release but now it's done I'll try to spend more time on > the v2 components. However for this to happen we need someone to work > actively on fixing the important 1.3 bugs, releasing a 1.3.1 (for > example to fix the login issue with tomcat/IE7) and taking the lead on > 1.4. > > Anyone interested in doing this or simply helping out? > > Thanks > -Vincent > _______________________________________________ > devs mailing list > devs(a)xwiki.org > http://lists.xwiki.org/mailman/listinfo/devs >

1 0

[xwiki-devs] xwiki-sandbox/org.xwiki.model vs xwiki-sandbox/components/xwiki-model
by Asiri Rathnayake 09 Mar '08

09 Mar '08

Hi Stéphane, I think the new data model is commited at xwiki-sandbox/org.xwiki.model. But i'm bit confused with xwiki-sandbox/components/xwiki-model. What does the latter stand for ? Thanks. - Asiri

2 2

[xwiki-devs] i did a bad thing on xwiki.org --> authentication/access control issue in xwiki 1.3
by Niels Mayer 09 Mar '08

09 Mar '08

I thought I was "playing" with my xwiki install (same skin) but it turns out was actually playing with xwiki.org. Unfortunately, I "hit" some buttons on xwiki.org and the actions I did should have been prevented by access-control, but they weren't. The actions assoc'd with these button should probably be available only to 'Admin' (or someone w/ programming rights) and not available to me logged in as 'NielsMayer' ( http://www.xwiki.org/xwiki/bin/view/XWiki/NielsMayer ) Given that I just recently registered and I'm not a "committer" (yet) I assume I should not have programming Access rights. Unfortunately, it let me perform the actions anyways as if I did have these rights. Specifically, http://www.xwiki.org/xwiki/bin/view/Scheduler/ has the following list: WatchList hourly notificationsNormalSun Mar 09 07:00:00 CET 2008*Infos* : view <http://www.xwiki.org/xwiki/bin/view/Scheduler/WatchListJob1> *Job* : pause<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=pause&which=Scheduler.Wat…> delete<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=delete&which=Scheduler.Wa…> unschedule<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=unschedule&which=Schedule…> WatchList daily notificationsNoneN/A*Infos* : view<http://www.xwiki.org/xwiki/bin/view/Scheduler/WatchListJob2> *Job* : schedule<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=schedule&which=Scheduler.…> delete<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=delete&which=Scheduler.Wa…> WatchList weekly notificationsNormalSun Mar 16 00:00:00 CET 2008*Infos* : view<http://www.xwiki.org/xwiki/bin/view/Scheduler/WatchListJob3> *Job* : pause<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=pause&which=Scheduler.Wat…> delete<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=delete&which=Scheduler.Wa…> unschedule<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=unschedule&which=Schedule…> WatchList monthly notificationsNormalSat Mar 15 00:00:00 CET 2008*Infos* : view<http://www.xwiki.org/xwiki/bin/view/Scheduler/WatchListJob4> *Job* : pause<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=pause&which=Scheduler.Wat…> delete<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=delete&which=Scheduler.Wa…> unschedule<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=unschedule&which=Schedule…> IRC BotNormal *Infos* : view<http://www.xwiki.org/xwiki/bin/view/Scheduler/IRCBot> *Job* : pause<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=pause&which=Scheduler.IRC…> delete<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=delete&which=Scheduler.IR…> unschedule<http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=unschedule&which=Schedule…> When I click on "pause" it paused the job, and when I clicked resume, it resumed it with the following message: "Job *WatchList monthly notifications* *resumed*. Next fire time : *Sat Mar 15 00:00:00 CET 2008" *This is despite the printed warning at the bottom of the page:* *"Job creation is reserved for programmers. It seems you do not have programming access right allowed on the Scheduler space." Xwiki.org <http://xwiki.org/> says it's running "1.3-rc-1.8082" --------------------------- This leads me to wonder how such administrative functions are secured. It makes sense to condition presentation of pause/delete/unschedule/schedule on whether Administrative/programming-access is available to the logged-in user. (i.e. don't present UI capabilities which aren't accessible to the given login/role). However, if someone were to just enter the URL http://www.xwiki.org/xwiki/bin/view/Scheduler/?do=pause&which=Scheduler.Wat… action should be access-controlled and prevented anyways. In my case, it wasn't. Anyways, sorry about doing this by accident. Hopefully no damage was done (I did resume the job i paused). I assume this is a "bug" I've discovered, and not a "feature." I guess further explorations in this area should be done on my own instance rather than xwiki.org .... ( no, i didn't test "unschedule" or "delete" given the potential that they'd actuallty work). If this is a bug, it would probably make good sense to review other instances where this might happen (aka "security walkthrough" of code). Is there any automated functional testing of the entire system (as opposed to unit testing) to ensure such access control issues aren't lurking in other areas? -- Niels. http://nielsmayer.com PS: Is there a document describing the security architecture of Xwiki?

4 4

[xwiki-devs] SPAWN and external services
by Paul Libbrecht 09 Mar '08

09 Mar '08

Hello, Sergiu criticized that a MathTran (a TeX-daeomon over the web) solution for formulae is bad because it relies on an external service or a complex installation... probably correct and the rest of his argument (in particular the wish for MathML) is more than valid! But, I realize that scientific documents, the goal of spawn, right?, are often made of external services. Consider the success of TeXmacs, one of the great features is its ability to connect to external systems, precisely. Typically, the following artifacts are sensible products of external services: - plots of functions - plots of data-sets - presentation of data-sets - advanced visualizations (e.g. chemical diagrams, construction plans, interactive geometry constructions...). I don't think we want all that to be solved internally in spawn, using external services is a must and, on a web-system, those should be web-services. In many cases, the XWiki source may contain info to regenerate fully the artifact (this is the case of many TeXmacs session I think), in other cases external interactions are needed. The service has to be running when authoring, for sure, but it should not need to when running. Or at least breakage of it should not impact viewers. That leads me to think that a good approach would be to store the products in a more managed way, e.g., as attachments, than in a cache where it can go away for size reasons. Comments welcome. paul

2 1

[xwiki-devs] XWiki build nows works with Maven 2.0.9-SNAPSHOT too
by Vincent Massol 08 Mar '08

08 Mar '08

All is in the title... So now, I think xwiki should build on most maven versions... barring the potential maven bugs... ;) -Vincent

1 0

[xwiki-devs] Do you like our new T-Shirt?
by Vincent Massol 08 Mar '08

08 Mar '08

Hi, Here's the new T-shirt that we're planning to print: http://www.xwiki.com/xwiki/bin/download/Blog/NoTShirtYetCeBIT2008/TSHIRTCEB… WDYT? Do you like it? Would you wear it? :) (Full story at CEBIT here: http://www.xwiki.com/xwiki/bin/view/Blog/NoTShirtYetCeBIT2008) Thanks -Vincent

2 3

[xwiki-devs] Is templates directory required any more?
by Sachin Mittal 08 Mar '08

08 Mar '08

Hi, I see that under xwiki webapp there is a template directory, that contains vm files. Same filenames are included in respective skins directory also. So based on my understanding of how velocity files are called and invoked upon user action, the vm files under templates directory play no role. Also in some previous discussion it was mentioned that they were redundant and there was a plan to separate common set of vm files into single directory. So I have two questions: 1. Can I delete the templates directory from my deployment. 2. If these files under this are no more required then what about deleting them from svn istelf. If have I have missed something and these files are required then please let me know in what case would these be required. Thanks Sachin ----- http://www.assembla.com/wiki/show/sachin_mittal about me: -- View this message in context: http://www.nabble.com/Is-templates-directory-required-any-more--tp15397359p… Sent from the XWiki- Dev mailing list archive at Nabble.com.

4 9

[xwiki-devs] [VOTE] Anca as core committer
by Vincent Massol 08 Mar '08

08 Mar '08

Hi XWiki Committers, I'd like to vote Anca Paula Luca as XWiki core committer. She's been a committer on XWiki Watch for a long time, she understand the xwiki dev process and she wants to work on our core GWT support to move it to use GWT 1.4. You can see her work here: http://svn.xwiki.org/svnroot/xwiki/xwiki-platform/web/branches/xwiki-web-gw… I feel she would be a great committer and she's interested in maintaing and improving this GWT code on the long run. Note that I have little idea how good the code on that branch is since I have not touched GWT yet but I trust Anca to do a good job and improve it if the quality is not to the par. Here's my +1 Thanks -Vincent

6 5

[xwiki-devs] About GSoC 2008
by Asiri Rathnayake 08 Mar '08

08 Mar '08

Hi All, Sorry if this is the wrong place / time to ask this question. I wanted to know whether XWiki will participate in GSoC 2008<http://code.google.com/soc/2008/>. ( care to hint some project ideas ? ) Thank you. - Asiri

4 15

[xwiki-devs] [ANN] XWiki Enterprise 1.3 Released
by Vincent Massol 08 Mar '08

08 Mar '08

The XWiki development team is pleased to announce the release of XWiki Enterprise 1.3 final. Go grab it at http://www.xwiki.org/xwiki/bin/view/Main/Download This release spanned 2 full months starting on the 10th of January 2008 and ending on the 7th of March 2008. During that period we implemented over 200 issues, fixing close to 100 bugs and adding new features such as: * Ability to export pages as HTML in a zip file * Ability to export the current page in a XAR * Better Oracle support * New Toucan skin * Complete rewrite of the LDAP authentication support including the support for LDAP groups * Diff emails sent by the Watchlist feature + ability to customize the email sent * Improved translation (German, French, Spanish) + new transaltions (Slovak) Main changes from 1.3RC1: * Core changes: o Bugs + XWIKI-1850 - No security against recursive includes + XWIKI-2047 - DB2 Hibernate Mapping for 1.2 + XWIKI-2163 - XWiki.parseGroovyFromPage() doesn't work when passing the a page containing JARs to be put in the Groovy classloader + XWIKI-2164 - Cannot log out + XWIKI-2171 - When user is not in the bind_DN/ bind_pass search for DN from user uid fail o Improvements + XWIKI-2157 - Add Slovak translation + XWIKI-2170 - Allow inactive users to see specific pages * Albatross Skin: o Bugs + XSALBATROSS-18 - Parse error when serving skin.js through SkinAction * Toucan Skin: o Bugs + XSTOUCAN-11 - RSS macro isn't styled correctly in Toucan + XSTOUCAN-12 - In inline edit mode all the input fields are stretched to the full content width + XSTOUCAN-13 - Numbered lists do not appear as numbered + XSTOUCAN-17 - Bulletted lists do not show bullets in the WYSIWYG editor o Improvements + XSTOUCAN-14 - In admin mode allow clicking anywhere on a tab to select it + XSTOUCAN-15 - Increase size of info box displayed by the #xwikimessageboxstart macro + XSTOUCAN-16 - Remove borders for tables using the memberstable class id * Watchlist plugin o Bugs + XPWATCHLIST-20 - Exception on Scheduler.WebHome about "isDocumentWatched" For more information see the Release notes at: http://www.xwiki.org/xwiki/bin/view/Main/ReleaseNotesXWikiEnterprise13 Thanks -The XWiki dev team

1 0