[xwiki-users] stopping a page for non-editors
Hi, I'm relatively new to xwiki. I have a few pages where dynamic tables had to be shown, and I'm using PHP quite heavily there. In a couple of pages, the content is supposed to be shown only if the user is in a specific group called 'XWikiEditorsGroup'. I didn't want to rely on xwiki's native single-page permissions as they looked a little cumbersome for what I needed, and preferred to control access via the page code itself. Up to xwiki 2.7, the following velocity section, which was the first section in the page, did the trick: {{velocity}} #set($user=$xwiki.getUser()) #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup")) {{warning}}You don't have permission to view this document{{/warning}} #stop #end {{/velocity}} However, after upgrading to xwiki 3.0, this code no longer works. From what I see, the issue appears to be related to velocity 1.7 and its different syntax for the #stop directive. I can't seem to find the right syntax though. As an alternative approach, I've also tried to relocate this access control logic into the PHP code that follows the above velocity section. To do that, I need to find a way to get the true/false value of "$user.isUserInGroup("XWiki.XWikiEditorsGroup")" in PHP, but so far haven't found a way to do that either and not sure how to pass the $user object and its isUserInGroup() method to the PHP part. I've even looked into doing this in groovy but no luck there either. Any advice will be appreciated... Thanks
Hi China, On Tue, Apr 5, 2011 at 16:38, China Sunrise <china.sunrise@gmail.com> wrote:
Hi, I'm relatively new to xwiki. I have a few pages where dynamic tables had to be shown, and I'm using PHP quite heavily there. In a couple of pages, the content is supposed to be shown only if the user is in a specific group called 'XWikiEditorsGroup'. I didn't want to rely on xwiki's native single-page permissions as they looked a little cumbersome for what I needed, and preferred to control access via the page code itself. Up to xwiki 2.7, the following velocity section, which was the first section in the page, did the trick:
{{velocity}} #set($user=$xwiki.getUser()) #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup")) {{warning}}You don't have permission to view this document{{/warning}} #stop #end {{/velocity}}
Why do you need the #stop directive to begin with? Simply remove it and see what happens. Guillaume However, after upgrading to xwiki 3.0, this code no longer works. From what
I see, the issue appears to be related to velocity 1.7 and its different syntax for the #stop directive. I can't seem to find the right syntax though. As an alternative approach, I've also tried to relocate this access control logic into the PHP code that follows the above velocity section. To do that, I need to find a way to get the true/false value of "$user.isUserInGroup("XWiki.XWikiEditorsGroup")" in PHP, but so far haven't found a way to do that either and not sure how to pass the $user object and its isUserInGroup() method to the PHP part. I've even looked into doing this in groovy but no luck there either.
Any advice will be appreciated...
Thanks _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
Hello, Indeed, #stop throws an exception on XWiki 3.0. You should create an issue on Jira about the #stop problem. I don't really know if this is caused by XWiki, or is strictly related to Velocity. This is a regression from my point of view and it should be fixed. Another solution for you would be to override contentview.vm and replace the line: $renderedContent with: #if(!$xwiki.getUser().isUserInGroup("XWiki.XWikiEditorsGroup")) {{warning}}You don't have permission to view this document{{/warning}} #else $renderedContent #end More info about how to override a template can be found here: http://platform.xwiki.org/xwiki/bin/view/DevGuide/Skins#HD.OverridingtheSkin.... Raluca. On Tue, Apr 5, 2011 at 5:38 PM, China Sunrise <china.sunrise@gmail.com>wrote:
Hi, I'm relatively new to xwiki. I have a few pages where dynamic tables had to be shown, and I'm using PHP quite heavily there. In a couple of pages, the content is supposed to be shown only if the user is in a specific group called 'XWikiEditorsGroup'. I didn't want to rely on xwiki's native single-page permissions as they looked a little cumbersome for what I needed, and preferred to control access via the page code itself. Up to xwiki 2.7, the following velocity section, which was the first section in the page, did the trick:
{{velocity}} #set($user=$xwiki.getUser()) #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup")) {{warning}}You don't have permission to view this document{{/warning}} #stop #end {{/velocity}}
However, after upgrading to xwiki 3.0, this code no longer works. From what I see, the issue appears to be related to velocity 1.7 and its different syntax for the #stop directive. I can't seem to find the right syntax though. As an alternative approach, I've also tried to relocate this access control logic into the PHP code that follows the above velocity section. To do that, I need to find a way to get the true/false value of "$user.isUserInGroup("XWiki.XWikiEditorsGroup")" in PHP, but so far haven't found a way to do that either and not sure how to pass the $user object and its isUserInGroup() method to the PHP part. I've even looked into doing this in groovy but no luck there either.
Any advice will be appreciated...
Thanks _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
Hi China :), On 04/05/2011 05:38 PM, China Sunrise wrote:
Hi, I'm relatively new to xwiki. I have a few pages where dynamic tables had to be shown, and I'm using PHP quite heavily there. In a couple of pages, the content is supposed to be shown only if the user is in a specific group called 'XWikiEditorsGroup'. I didn't want to rely on xwiki's native single-page permissions as they looked a little cumbersome for what I needed, and preferred to control access via the page code itself. Up to xwiki 2.7, the following velocity section, which was the first section in the page, did the trick:
{{velocity}} #set($user=$xwiki.getUser()) #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup")) {{warning}}You don't have permission to view this document{{/warning}} #stop #end {{/velocity}} I don`t know how the PHP macro(?) works, but why don`t you do something like:
{{velocity}} #set($user=$xwiki.getUser()) #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup")) {{warning}}You don't have permission to view this document{{/warning}} #else {{php}} do some php here. {{/php}} #end {{/velocity}} If you can nest the php macro into the velocity one, you are good to go and the code does not use velocity-dependent tricks. P.S.: On the other hand, I do recommend using XWiki's rights system. If you want to assign rights to multiple pages at once, do it at space level. You could also create a 'protected' space where you put all your protected pages that should be visible only to group X (so that you manage rights from a single -- space level -- point to avoid page level management). Hope this helps, Eduard
However, after upgrading to xwiki 3.0, this code no longer works. From what I see, the issue appears to be related to velocity 1.7 and its different syntax for the #stop directive. I can't seem to find the right syntax though. As an alternative approach, I've also tried to relocate this access control logic into the PHP code that follows the above velocity section. To do that, I need to find a way to get the true/false value of "$user.isUserInGroup("XWiki.XWikiEditorsGroup")" in PHP, but so far haven't found a way to do that either and not sure how to pass the $user object and its isUserInGroup() method to the PHP part. I've even looked into doing this in groovy but no luck there either.
Any advice will be appreciated...
Thanks _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
Hi, Thanks for all the responses. Here are some results after testing the suggestions: * When I simply remove the #stop directive, I no longer get exceptions, but also I don't get the page to block. Without the #stop, the velocity part simply ends and it continues to the PHP part with no interruption and so the page is shown normally. This solution is therefore not going to work in this case. * Nesting a PHP script inside a velocity script is not accepted, so this solution will also not work here. * I could use the native page access control, but it's somewhat of an overhead as the pages in question are in different spaces and I would need to go page by page to set the proper permissions. I realize that this may be the more "correct" approach but it still appears to be easier for me to do it at the code level - sort of 'do once and never worry about anything else later'. Anyway, following Raluca's advice I've opened a minor JIRA XE-887 about the #stop excepetion issue, and what I ended up doing for now is the following, which simply redirects to an error page. For my current needs this is good enough, and eventually when the #stop directive will be supported again I'll shift back to it. {{velocity}} #set($user=$xwiki.getUser()) #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup")) {{warning}}You don't have permission to view this document{{/warning}} $response.sendRedirect($xwiki.getURL("MyMain.NoAccess")) #end {{/velocity}} Thanks again for all the help! On Thu, Apr 7, 2011 at 1:59 PM, Eduard Moraru <eduard.moraru@xwiki.com>wrote:
Hi China :),
On 04/05/2011 05:38 PM, China Sunrise wrote:
Hi, I'm relatively new to xwiki. I have a few pages where dynamic tables had to be shown, and I'm using PHP quite heavily there. In a couple of pages, the content is supposed to be shown only if the user is in a specific group called 'XWikiEditorsGroup'. I didn't want to rely on xwiki's native single-page permissions as they looked a little cumbersome for what I needed, and preferred to control access via the page code itself. Up to xwiki 2.7, the following velocity section, which was the first section in the page, did the trick:
{{velocity}} #set($user=$xwiki.getUser()) #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup")) {{warning}}You don't have permission to view this document{{/warning}} #stop #end {{/velocity}} I don`t know how the PHP macro(?) works, but why don`t you do something like:
{{velocity}} #set($user=$xwiki.getUser()) #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup")) {{warning}}You don't have permission to view this document{{/warning}} #else {{php}} do some php here. {{/php}} #end {{/velocity}}
If you can nest the php macro into the velocity one, you are good to go and the code does not use velocity-dependent tricks.
P.S.: On the other hand, I do recommend using XWiki's rights system. If you want to assign rights to multiple pages at once, do it at space level. You could also create a 'protected' space where you put all your protected pages that should be visible only to group X (so that you manage rights from a single -- space level -- point to avoid page level management).
Hope this helps, Eduard
However, after upgrading to xwiki 3.0, this code no longer works. From what I see, the issue appears to be related to velocity 1.7 and its different syntax for the #stop directive. I can't seem to find the right syntax though. As an alternative approach, I've also tried to relocate this access control logic into the PHP code that follows the above velocity section. To do that, I need to find a way to get the true/false value of "$user.isUserInGroup("XWiki.XWikiEditorsGroup")" in PHP, but so far haven't found a way to do that either and not sure how to pass the $user object and its isUserInGroup() method to the PHP part. I've even looked into doing this in groovy but no luck there either.
Any advice will be appreciated...
Thanks _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
_______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
participants (4)
-
China Sunrise -
Eduard Moraru -
Guillaume Lerouge -
Raluca Stavro