[xwiki-users] Inventory Macro
Hi, As we plan to use Xwiki as our new wiki in our company, I'm looking at various use cases. One cool feature would be an Inventory System for Hard- and Software. I've set up a first draft with AppWithIn Minutes and it is looking not bad. But in a perfect world it would be cool to have following features in addition: 1. Either: When the "Add Entry" Button is pressed a new unique number will be generated ( a sequential number as Inventory number) Or: After the all data have been filled in, such a number will be generated (e.g. 01 for Hardware 03 for PC 0234 for running number, gives Inventory number 01030234) 2. If I put secret data in there (e.g. Pin/PUK for mobiles) I was able to let it not show in the list AppWithInMinutes generates (viewable only for admins), but of course in the generated Page, everybody can see it. Is there a way that this is only viewable for admins as well? Of course I can prohibit this by securing the hole page, but ( again in a perfect world :) it would be good that the employee can see and edit all his stuff in the inventory, but only he and/or admins can see the confidental data. Maybe one or another has a tip for me, or can point me in the right direction. Best Regards Stocki -- View this message in context: http://xwiki.475771.n2.nabble.com/Inventory-Macro-tp7580719.html Sent from the XWiki- Users mailing list archive at Nabble.com.
Hi Stocki, On Mon, Aug 6, 2012 at 12:48 PM, Stocki <Stefan.Stockinger@tfk.de> wrote:
Hi,
As we plan to use Xwiki as our new wiki in our company, I'm looking at various use cases. One cool feature would be an Inventory System for Hard- and Software. I've set up a first draft with AppWithIn Minutes and it is looking not bad. But in a perfect world it would be cool to have following features in addition:
1. Either: When the "Add Entry" Button is pressed a new unique number will be generated ( a sequential number as Inventory number) Or: After the all data have been filled in, such a number will be generated (e.g. 01 for Hardware 03 for PC 0234 for running number, gives Inventory number 01030234)
This is in progress. See http://jira.xwiki.org/browse/XWIKI-7374 . We hope to have it in 4.2 final.
2. If I put secret data in there (e.g. Pin/PUK for mobiles) I was able to let it not show in the list AppWithInMinutes generates (viewable only for admins), but of course in the generated Page, everybody can see it. Is there a way that this is only viewable for admins as well? Of course I can prohibit this by securing the hole page, but ( again in a perfect world :) it would be good that the employee can see and edit all his stuff in the inventory, but only he and/or admins can see the confidental data.
This is a bit tricky. You can customize the sheet used to view and edit the application entries so that the Pin/PUK field/value is displayed only for admins but it won't prevent users from editing the application entries (pages) in Object mode and see the secret value. If a user has the right to edit a page then he can see all the property values of objects attached to that page. In other words, the rights system doesn't work at the level of object property, not even at the level of object. The finest level is page. Hope this helps, Marius
Maybe one or another has a tip for me, or can point me in the right direction.
Best Regards Stocki
-- View this message in context: http://xwiki.475771.n2.nabble.com/Inventory-Macro-tp7580719.html Sent from the XWiki- Users mailing list archive at Nabble.com. _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
This is in progress. See http://jira.xwiki.org/browse/XWIKI-7374 . We hope to have it in 4.2 final.
Good to hear that this is in progress. Any Idea when 4.2 will be released?
2. If I put secret data in there (e.g. Pin/PUK for mobiles) I was able to let it not show in the list AppWithInMinutes generates (viewable only for admins), but of course in the generated Page, everybody can see it. Is there a way that this is only viewable for admins as well? Of course I can prohibit this by securing the hole page, but ( again in a perfect world :) it would be good that the employee can see and edit all his stuff in the inventory, but only he and/or admins can see the confidental data.
This is a bit tricky. You can customize the sheet used to view and edit the application entries so that the Pin/PUK field/value is displayed only for admins but it won't prevent users from editing the application entries (pages) in Object mode and see the secret value. If a user has the right to edit a page then he can see all the property values of objects attached to that page. In other words, the rights system doesn't work at the level of object property, not even at the level of object. The finest level is page.
Hope this helps, Marius
Yeah, I thought so, but wanted to ask anyway. I will look into the hole confidental data thing and probably will leave it out there. Thank you Stocki -- View this message in context: http://xwiki.475771.n2.nabble.com/Inventory-Macro-tp7580719p7580723.html Sent from the XWiki- Users mailing list archive at Nabble.com.
On Mon, Aug 6, 2012 at 2:14 PM, Stocki <Stefan.Stockinger@tfk.de> wrote:
This is in progress. See http://jira.xwiki.org/browse/XWIKI-7374 . We hope to have it in 4.2 final.
Good to hear that this is in progress. Any Idea when 4.2 will be released?
There is a vote in progress to release 4.2 final on 17th September, but you may be able to preview this feature sooner in 4.2M3 or 4.2RC1 if Sergiu manages to commit on time. Hope this helps, Marius
2. If I put secret data in there (e.g. Pin/PUK for mobiles) I was able to let it not show in the list AppWithInMinutes generates (viewable only for admins), but of course in the generated Page, everybody can see it. Is there a way that this is only viewable for admins as well? Of course I can prohibit this by securing the hole page, but ( again in a perfect world :) it would be good that the employee can see and edit all his stuff in the inventory, but only he and/or admins can see the confidental data.
This is a bit tricky. You can customize the sheet used to view and edit the application entries so that the Pin/PUK field/value is displayed only for admins but it won't prevent users from editing the application entries (pages) in Object mode and see the secret value. If a user has the right to edit a page then he can see all the property values of objects attached to that page. In other words, the rights system doesn't work at the level of object property, not even at the level of object. The finest level is page.
Hope this helps, Marius
Yeah, I thought so, but wanted to ask anyway. I will look into the hole confidental data thing and probably will leave it out there.
Thank you Stocki
-- View this message in context: http://xwiki.475771.n2.nabble.com/Inventory-Macro-tp7580719p7580723.html Sent from the XWiki- Users mailing list archive at Nabble.com. _______________________________________________ users mailing list users@xwiki.org http://lists.xwiki.org/mailman/listinfo/users
If a user has the right to edit a page then he can see all the property values of objects attached to that page.
I will look into the hole confidental data thing
i worked at company where they used hidden properties as well. In IBM Lotus Notes, client versions 5 till 7 The same trick was widely used by everyone. It was good - for really doing one's work one had to know more than bare minimum. But it was security breach nonetheless. It looks like IBM/Lotus could not implement per-property visibility. And probably it is rather hard to implement it in doc-flow systems at all. -- View this message in context: http://xwiki.475771.n2.nabble.com/Inventory-Macro-tp7580719p7580727.html Sent from the XWiki- Users mailing list archive at Nabble.com.
On 08/06/2012 07:14 AM, Stocki wrote:
This is in progress. See http://jira.xwiki.org/browse/XWIKI-7374 . We hope to have it in 4.2 final.
Good to hear that this is in progress. Any Idea when 4.2 will be released?
2. If I put secret data in there (e.g. Pin/PUK for mobiles) I was able to let it not show in the list AppWithInMinutes generates (viewable only for admins), but of course in the generated Page, everybody can see it. Is there a way that this is only viewable for admins as well? Of course I can prohibit this by securing the hole page, but ( again in a perfect world :) it would be good that the employee can see and edit all his stuff in the inventory, but only he and/or admins can see the confidental data.
This is a bit tricky. You can customize the sheet used to view and edit the application entries so that the Pin/PUK field/value is displayed only for admins but it won't prevent users from editing the application entries (pages) in Object mode and see the secret value. If a user has the right to edit a page then he can see all the property values of objects attached to that page. In other words, the rights system doesn't work at the level of object property, not even at the level of object. The finest level is page.
Hope this helps, Marius
Yeah, I thought so, but wanted to ask anyway. I will look into the hole confidental data thing and probably will leave it out there.
There is a way to fix this, but it requires more code. The basic idea is that you store confidential information as custom data stored in the database, not as basic class properties, and you create a script service that provides access to this data. Since this script service is the only way to access the data, you can enforce rights any way you like in it. -- Sergiu Dumitriu http://purl.org/net/sergiu/
participants (4)
-
Arioch -
Marius Dumitru Florea -
Sergiu Dumitriu -
Stocki