Base package in an virtual wiki does not receive programming rights as required

For example, when the backup pack xwiki-enterprise-wiki-n.n.xar is used as a template or imported into a virtual sub-wiki and since local user XWiki.Admin is used as authors of most pages, those don't receive programming rights, because only global user may have these rights. For most pages, this has no concequence, but a few ones don't work properly. For example XWiki.AllAttachementsResults, which use non-priviledged API does not work in a virtual wiki, without being resaved by a global user having programming rights first.

This is obviously not what is expected. It exist many options to fix this:

1) A first thought could be to change the way programming rights are evaluated against the local XWiki.Admin user. This has not my preference, since it include additionnal complexity in the way rights are checked; and it decrease security, since any local admin has full access to the entire farm. Forgotting to change the Admin password could therefore be dramatic and massive XWiki hosting like myxwiki.org at risk.

2) A better approach could be to prepare the backup pack differently, by ensuring that pages are authored by xwiki:XWiki.Admin in place of XWiki.Admin. This should not cause any issue with classical XWiki, and would help fixing the issue with virtual one. But, to easily prepare such package, the export tool, should provide a way to override authors of all exported document to a given author; that in our case would be xwiki:XWiki.Admin. (Note: Overwritting authors on export is not a security risk since resulting packages could be also freely edited, but there is a security hole in the import procedure, which allows local admins to gain programming rights by importing a backup pack containings documents authored by a global admin user.)

3) A better solution in my opinion would be to proceed like the application manager, which does not create a backup pack. If XWIKI-3725 is fixed (which seems required anyway), this would make the content author of all documents to be the one that import the pack. So taking care that the importing user has programming rights would be sufficient to properly import a new XWiki in either a virtuel or non virtual XWiki. (Note: I do not know what user you are when importing into a blank DB, should be checked!)

Please let me know your thoughts... maybe I can provide the patch.