[xwiki-devs] [Proposal] Add APIs to get and save document in the security context of the author of the script which called the function.
I'd like to make this change: Add to xwiki.api.Document saveAsAuthor() saveAsAuthor(String comment) saveAsAuthor(String connent, String isMinorEdit) deleteAsAuthor() Add to xwiki.api.XWiki getDocumentAsAuthor(DocumentReference reference) getDocumentAsAuthor(String fullName) I created an issue for it and posted a patch http://jira.xwiki.org/jira/browse/XWIKI-5041 http://jira.xwiki.org/jira/secure/attachment/16920/XWIKI-4952-CommentAddActi... The context user is momentarily switched to the content author of the document in the context before doing the action. I think the script editor should be responsible for the api method calls because they can only be called from script. I also see a lot of potential benefit in allowing a script to manipulate documents which it's viewers cannot save. I think this will reduce the amount of pages requiring programming rights. WDYT? Caleb
On 03/24/2010 02:52 PM, Caleb James DeLisle wrote:
I'd like to make this change:
Add to xwiki.api.Document saveAsAuthor() saveAsAuthor(String comment) saveAsAuthor(String connent, String isMinorEdit) deleteAsAuthor()
Add to xwiki.api.XWiki getDocumentAsAuthor(DocumentReference reference) getDocumentAsAuthor(String fullName)
I agree with the idea, but I want a clarification: this will use the author, or the contentAuthor? The right one is contentAuthor, but the name of the document could become too long, and even a bit confusing (saveAsContentAuthor). So, +1 for the new methods, with the proposed name, but with the suggested behavior.
I created an issue for it and posted a patch http://jira.xwiki.org/jira/browse/XWIKI-5041 http://jira.xwiki.org/jira/secure/attachment/16920/XWIKI-4952-CommentAddActi...
The context user is momentarily switched to the content author of the document in the context before doing the action.
I think the script editor should be responsible for the api method calls because they can only be called from script. I also see a lot of potential benefit in allowing a script to manipulate documents which it's viewers cannot save. I think this will reduce the amount of pages requiring programming rights.
-- Sergiu Dumitriu http://purl.org/net/sergiu/
Sergiu Dumitriu wrote:
On 03/24/2010 02:52 PM, Caleb James DeLisle wrote:
I'd like to make this change:
Add to xwiki.api.Document saveAsAuthor() saveAsAuthor(String comment) saveAsAuthor(String connent, String isMinorEdit) deleteAsAuthor()
Add to xwiki.api.XWiki getDocumentAsAuthor(DocumentReference reference) getDocumentAsAuthor(String fullName)
I agree with the idea, but I want a clarification: this will use the author, or the contentAuthor? The right one is contentAuthor, but the name of the document could become too long, and even a bit confusing (saveAsContentAuthor).
Yes my patch does use the content author (I forgot to mention it) my reason for proposing *AsAuthor is because I think the concept of the contentAuthor is related to the concept of a user who adds or modifies a single object being held responsible for all objects thereafter which seems incorrect. Naturally i am happy to use whatever names you like. Caleb
So, +1 for the new methods, with the proposed name, but with the suggested behavior.
I created an issue for it and posted a patch http://jira.xwiki.org/jira/browse/XWIKI-5041 http://jira.xwiki.org/jira/secure/attachment/16920/XWIKI-4952-CommentAddActi...
The context user is momentarily switched to the content author of the document in the context before doing the action.
I think the script editor should be responsible for the api method calls because they can only be called from script. I also see a lot of potential benefit in allowing a script to manipulate documents which it's viewers cannot save. I think this will reduce the amount of pages requiring programming rights.
participants (2)
-
Caleb James DeLisle -
Sergiu Dumitriu