[xwiki-users] Rights Issue
One of our users accidently modified the search script, which prevented all other users from searching. All of our users have scripting right as they use "App within a Minute". I found that these users may modify system scripts and I was unable to protect this scripts from modifications. We are running Xwiki 7.4.2. Users rights set: View, Edit, Comment, Script, Register. Any Idea what to do? Wolfgang
It does not have much to do with script right. All it takes to modify a page (and break it if that page require special author rights) is edit right. I guess the main issue is more that Search page is located in Main space and you are not going to forbid edit right for everyone on that entire space like it's done in XWiki space by default. What you could do to prevent accidents like this is to explicitly give all but view right on pages you want to project (in this case Main.Search) to XWikiAdminGroup so that only members of that group can modify them. On Wed, Apr 27, 2016 at 12:01 PM, Wolfgang Theissen <wolfgang.theissen@online.de> wrote:
One of our users accidently modified the search script, which prevented all other users from searching. All of our users have scripting right as they use "App within a Minute". I found that these users may modify system scripts and I was unable to protect this scripts from modifications. We are running Xwiki 7.4.2. Users rights set: View, Edit, Comment, Script, Register. Any Idea what to do?
Wolfgang _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
In Xwiki 7.4.2 In don't have spaces any more. If you mean the "Xwiki" branch with main space, I already disallowed editing but this didn't helped. If "main" is anything else let me know. Wolfgang Am 27.04.2016 um 12:15 schrieb Thomas Mortagne:
It does not have much to do with script right. All it takes to modify a page (and break it if that page require special author rights) is edit right.
I guess the main issue is more that Search page is located in Main space and you are not going to forbid edit right for everyone on that entire space like it's done in XWiki space by default. What you could do to prevent accidents like this is to explicitly give all but view right on pages you want to project (in this case Main.Search) to XWikiAdminGroup so that only members of that group can modify them.
On Wed, Apr 27, 2016 at 12:01 PM, Wolfgang Theissen <wolfgang.theissen@online.de> wrote:
One of our users accidently modified the search script, which prevented all other users from searching. All of our users have scripting right as they use "App within a Minute". I found that these users may modify system scripts and I was unable to protect this scripts from modifications. We are running Xwiki 7.4.2. Users rights set: View, Edit, Comment, Script, Register. Any Idea what to do?
Wolfgang _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
Problem solved. You are right. Thanks! ----- Ursprüngliche Nachricht ----- Von: "Thomas Mortagne" <thomas.mortagne@xwiki.com> Gesendet: 27.04.2016 12:15 An: "XWiki Users" <users@xwiki.org> Betreff: Re: [xwiki-users] Rights Issue It does not have much to do with script right. All it takes to modify a page (and break it if that page require special author rights) is edit right. I guess the main issue is more that Search page is located in Main space and you are not going to forbid edit right for everyone on that entire space like it's done in XWiki space by default. What you could do to prevent accidents like this is to explicitly give all but view right on pages you want to project (in this case Main.Search) to XWikiAdminGroup so that only members of that group can modify them. On Wed, Apr 27, 2016 at 12:01 PM, Wolfgang Theissen <wolfgang.theissen@online.de> wrote:
One of our users accidently modified the search script, which prevented all other users from searching. All of our users have scripting right as they use "App within a Minute". I found that these users may modify system scripts and I was unable to protect this scripts from modifications. We are running Xwiki 7.4.2. Users rights set: View, Edit, Comment, Script, Register. Any Idea what to do?
Wolfgang _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
Yes I'm old and know how it's actually working behind the scene so I keep talking about "spaces" too much :) On Wed, Apr 27, 2016 at 1:21 PM, Wolfgang Theissen <wolfgang.theissen@online.de> wrote:
Problem solved. You are right. Thanks!
----- Ursprüngliche Nachricht ----- Von: "Thomas Mortagne" <thomas.mortagne@xwiki.com> Gesendet: 27.04.2016 12:15 An: "XWiki Users" <users@xwiki.org> Betreff: Re: [xwiki-users] Rights Issue
It does not have much to do with script right. All it takes to modify a page (and break it if that page require special author rights) is edit right.
I guess the main issue is more that Search page is located in Main space and you are not going to forbid edit right for everyone on that entire space like it's done in XWiki space by default. What you could do to prevent accidents like this is to explicitly give all but view right on pages you want to project (in this case Main.Search) to XWikiAdminGroup so that only members of that group can modify them.
On Wed, Apr 27, 2016 at 12:01 PM, Wolfgang Theissen <wolfgang.theissen@online.de> wrote:
One of our users accidently modified the search script, which prevented all other users from searching. All of our users have scripting right as they use "App within a Minute". I found that these users may modify system scripts and I was unable to protect this scripts from modifications. We are running Xwiki 7.4.2. Users rights set: View, Edit, Comment, Script, Register. Any Idea what to do?
Wolfgang _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne
When I started working with Xwiki space still exist so your answer made some sense to me. Wolfgang ----- Ursprüngliche Nachricht ----- Von: "Thomas Mortagne" <thomas.mortagne@xwiki.com> Gesendet: 27.04.2016 14:41 An: "XWiki Users" <users@xwiki.org> Betreff: Re: [xwiki-users] Rights Issue Yes I'm old and know how it's actually working behind the scene so I keep talking about "spaces" too much :) On Wed, Apr 27, 2016 at 1:21 PM, Wolfgang Theissen <wolfgang.theissen@online.de> wrote:
Problem solved. You are right. Thanks!
----- Ursprüngliche Nachricht ----- Von: "Thomas Mortagne" <thomas.mortagne@xwiki.com> Gesendet: 27.04.2016 12:15 An: "XWiki Users" <users@xwiki.org> Betreff: Re: [xwiki-users] Rights Issue
It does not have much to do with script right. All it takes to modify a page (and break it if that page require special author rights) is edit right.
I guess the main issue is more that Search page is located in Main space and you are not going to forbid edit right for everyone on that entire space like it's done in XWiki space by default. What you could do to prevent accidents like this is to explicitly give all but view right on pages you want to project (in this case Main.Search) to XWikiAdminGroup so that only members of that group can modify them.
On Wed, Apr 27, 2016 at 12:01 PM, Wolfgang Theissen <wolfgang.theissen@online.de> wrote:
One of our users accidently modified the search script, which prevented all other users from searching. All of our users have scripting right as they use "App within a Minute". I found that these users may modify system scripts and I was unable to protect this scripts from modifications. We are running Xwiki 7.4.2. Users rights set: View, Edit, Comment, Script, Register. Any Idea what to do?
Wolfgang _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
-- Thomas Mortagne _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
participants (2)
-
Thomas Mortagne -
Wolfgang Theissen