Details
- 
    
Bug
 - 
    Resolution: Fixed
 - 
    
Critical
 - 
    14.10, 15.6
 
- 
        Unknown
 - 
        N/A
 - 
        N/A
 - 
        
 
Description
Following XWIKI-20321, members of xwiki:XWiki.XWikiAllGroup don't get script rights by default on the main wiki.
While this gives great benefits in regards with security, it also creates a situation where standard users cannot edit a part of the default home page without having velocity errors, because the home page comes by default with two velocity scripts :
- One for adding the xwiki version passed as a parameter to a documentation page on xwiki.org : https://github.com/xwiki/xwiki-platform/blob/b697f3c99270e837c134e7a66d202b18826f546f/xwiki-platform-distribution/xwiki-platform-distribution-flavor/xwiki-platform-distribution-flavor-common/src/main/resources/Main/WebHome.xml#L56C33-L56C33
 - One for creating a URL to access the extension manager in XWiki Preferences : https://github.com/xwiki/xwiki-platform/blob/b697f3c99270e837c134e7a66d202b18826f546f/xwiki-platform-distribution/xwiki-platform-distribution-flavor/xwiki-platform-distribution-flavor-common/src/main/resources/Main/WebHome.xml#L64C5-L64C5
 
The second link can be replaced as [[Extension Manager>>XWiki.XWikiPreferences||queryString="editor=globaladmin§ion=XWiki.Extensions"]] (taking advantage of the fact that the user will be redirected automatically to the admin action.
The first link is more difficult to modify ; currently I don't know how we use this version for our documentation on xwiki.org
The problem that this situation causes a bad experience for new users testing out XWiki without being necessarily the ones that have installed the XWiki instance (and thus being admins). The home page looks like a pretty normal page, and users get confused / don't understand why red messages appear once they change the first paragraph.
We could think of two options for this issue :
- Either remove completely any velocity macro, so that the home page is editable again by users without scripting rights
 - Or only grant edit rights on this page to XWikiAdminGroup by default, so that only admins can edit it.