Uploaded image for project: '{RETIRED} XWiki Enterprise'
  1. {RETIRED} XWiki Enterprise
  2. XE-390

No right set at the wiki level, accesing space administration throws error if right is set at space level

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Cannot Reproduce
    • Affects Version/s: 1.8 RC1
    • Fix Version/s: None
    • Labels:
      None
    • Similar issues:

      Description

      Here's the behavior I got in XE 1.8 RC1 when performing the following actions:

      Error number 4001 in 4: Error while parsing velocity page /templates/admin.vm Wrapped Exception: Failed to evaluate content with id [/templates/admin.vm]
      

      Stacktrace when clicking on the error:

      Error number 4001 in 4: Error while parsing velocity page /templates/admin.vm
      Wrapped Exception: Failed to evaluate content with id [/templates/admin.vm]
      com.xpn.xwiki.XWikiException: Error number 4001 in 4: Error while parsing velocity page /templates/admin.vm
      Wrapped Exception: Failed to evaluate content with id [/templates/admin.vm]
      	at com.xpn.xwiki.render.XWikiVelocityRenderer.evaluate(XWikiVelocityRenderer.java:114)
      ...
      Wrapped Exception:
      org.apache.velocity.exception.MethodInvocationException: Invocation of method 'save' in  class com.xpn.xwiki.api.Document threw exception com.xpn.xwiki.XWikiException: Error number 9001 in 9: Access denied in edit mode on document XWiki.WebPreferences @ /templates/admin.vm[58,26]
      	at org.apache.velocity.runtime.parser.node.ASTMethod.execute(ASTMethod.java:286)
      ...
      Caused by: com.xpn.xwiki.XWikiException: Error number 9001 in 9: Access denied in edit mode on document XWiki.WebPreferences
      	at com.xpn.xwiki.api.Document.save(Document.java:1631)
      

      Additional note: since every user can do everything, the current user can give Admin rights to himself at the wiki level. He will then be able to access and change the rights of the Sandbox space that he couldn't access before.

        Attachments

          Activity

            People

            Assignee:
            tmortagne Thomas Mortagne
            Reporter:
            wikibc Guillaume Lerouge
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Date of First Response: