XWiki Platform
  1. XWiki Platform
  2. XWIKI-12937

Impossible to copy a page if the user has no edit right at the wiki or space level

    Details

    • Difficulty:
      Unknown
    • Documentation:
      N/A
    • Documentation in Release Notes:
      N/A
    • Similar issues:

      Description

      Steps to reproduce:

      • on a fresh XE instance, create a new "space" called "ForGuests"
      • on that space, give the edit right to guests
      • as a guest, try to create a page under "ForGuest" -> you can
      • as a guest, try to copy the home page -> you cannot
      • as a guest, go to http://localhost:8080/xwiki/bin/view/Main/Welcome?xpage=copy -> you are not allowed

      Since guests have the edit right on some place inside the wiki, they should be able to copy any page (as soon as the target is inside the "ForGuest" space).

        Issue Links

          Activity

          Hide
          Guillaume Delhumeau added a comment -

          For example, here is the first line of copy.vm:

          #if(!$xwiki.hasAccessLevel("edit"))
          
          Show
          Guillaume Delhumeau added a comment - For example, here is the first line of copy.vm : # if (!$xwiki.hasAccessLevel( "edit" ))
          Hide
          Eduard Moraru added a comment - - edited

          XWIKI-10804 has helped a bit with this, since copy.vm was previously asking edit rights for the current page (so much more restrictive and desynchronized with the menu UI), but it is still too restrictive, since due to the definition of $hasCreatePage it is now asking for edit rights on the current space (which on Nested Documents can be synonymous with the current page).

          As Guillaume Delhumeau mentioned in https://github.com/xwiki/xwiki-platform/commit/b02aa93cd25d53d16ec1abb37fa63cd21daad380#commitcomment-18862512 and we agreed on the discussion at XWIKI-12931, a good fix would be to only check the view right when displaying the copy action in the UI and when accessing copy.vm so that the check for edit/creation rights are only done once the user actually specifies the destination and tries to copy to it, in the copy UI (copy.vm).

          Manuel Smeria's testing also validates that the current behavior is not intuitive and needs to be improved.

          Show
          Eduard Moraru added a comment - - edited XWIKI-10804 has helped a bit with this, since copy.vm was previously asking edit rights for the current page (so much more restrictive and desynchronized with the menu UI), but it is still too restrictive, since due to the definition of $hasCreatePage it is now asking for edit rights on the current space (which on Nested Documents can be synonymous with the current page). As Guillaume Delhumeau mentioned in https://github.com/xwiki/xwiki-platform/commit/b02aa93cd25d53d16ec1abb37fa63cd21daad380#commitcomment-18862512 and we agreed on the discussion at XWIKI-12931 , a good fix would be to only check the view right when displaying the copy action in the UI and when accessing copy.vm so that the check for edit/creation rights are only done once the user actually specifies the destination and tries to copy to it, in the copy UI (copy.vm). Manuel Smeria 's testing also validates that the current behavior is not intuitive and needs to be improved.
          Hide
          Eduard Moraru added a comment -

          Committing to the stable-8.4.x branch as soon as the 8.4 release is done.

          Show
          Eduard Moraru added a comment - Committing to the stable-8.4.x branch as soon as the 8.4 release is done.
          Hide
          Eduard Moraru added a comment -

          Done.

          Show
          Eduard Moraru added a comment - Done.
          Hide
          Marius Dumitru Florea added a comment -

          We forgot about this use case http://lists.xwiki.org/pipermail/users/2017-March/034849.html . We should hide the copy action when the wiki is in read-only mode.

          Show
          Marius Dumitru Florea added a comment - We forgot about this use case http://lists.xwiki.org/pipermail/users/2017-March/034849.html . We should hide the copy action when the wiki is in read-only mode.

            People

            • Assignee:
              Eduard Moraru
              Reporter:
              Guillaume Delhumeau
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:
                Date of First Response: