Details
-
Bug
-
Resolution: Fixed
-
Critical
-
14.10, 15.6
-
Unknown
-
N/A
-
N/A
-
Description
Following XWIKI-20321, members of xwiki:XWiki.XWikiAllGroup don't get script rights by default on the main wiki.
While this gives great benefits in regards with security, it also creates a situation where standard users cannot edit a part of the default home page without having velocity errors, because the home page comes by default with two velocity scripts :
- One for adding the xwiki version passed as a parameter to a documentation page on xwiki.org : https://github.com/xwiki/xwiki-platform/blob/b697f3c99270e837c134e7a66d202b18826f546f/xwiki-platform-distribution/xwiki-platform-distribution-flavor/xwiki-platform-distribution-flavor-common/src/main/resources/Main/WebHome.xml#L56C33-L56C33
- One for creating a URL to access the extension manager in XWiki Preferences : https://github.com/xwiki/xwiki-platform/blob/b697f3c99270e837c134e7a66d202b18826f546f/xwiki-platform-distribution/xwiki-platform-distribution-flavor/xwiki-platform-distribution-flavor-common/src/main/resources/Main/WebHome.xml#L64C5-L64C5
The second link can be replaced as [[Extension Manager>>XWiki.XWikiPreferences||queryString="editor=globaladmin§ion=XWiki.Extensions"]] (taking advantage of the fact that the user will be redirected automatically to the admin action.
The first link is more difficult to modify ; currently I don't know how we use this version for our documentation on xwiki.org
The problem that this situation causes a bad experience for new users testing out XWiki without being necessarily the ones that have installed the XWiki instance (and thus being admins). The home page looks like a pretty normal page, and users get confused / don't understand why red messages appear once they change the first paragraph.
We could think of two options for this issue :
- Either remove completely any velocity macro, so that the home page is editable again by users without scripting rights
- Or only grant edit rights on this page to XWikiAdminGroup by default, so that only admins can edit it.