Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-5004

Inactive user should be able to access the same UI than XWikiGuest

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 2.3, 2.2.6, 2.4 M1
    • 1.9.4, 2.2.2
    • {Unused} Core
    • None
    • patch

    Description

      When auth_active_check is activated and an inactive user sign in, the page it get is a complete mess, since he have almost no access to the wiki. It is possible to give him access to some documents, but not the skin's elements. More over, configuring allowed documents is an xwiki.cfg config, which does not fit well for XEM.

      Giving a logged in user less access than XWikiGuest, is somewhat not really clever. Giving him all access like WikiGuest may hide the inactivation too much, and lead to some security concerns that are difficult to mitigate in the current code base (copy/rename does not involve any check on user activity, and could be executed by a user if he can view the documents). Therefore I propose the attached (temporary) patch that improve the situation without taking too much risk or making big changes.

      It allows inactive users to access file system skin elements like what is done for XWikiGuest, as well as the same access than XWikiGuest for the following actions: skin, download, jsx and ssx. The rational of this is that it could now reach the css, a logo attach to a custom skin, a SSX augmenting it, and therefore see the UI properly.

      Inactive user is still forced to only see the userinactive.vm to help him activate his account, as well as the allowed document configured in xwiki.cfg if any.

      The patch provide is against 2.2 branches and include the patch of XWIKI-4378 as well, that has been applied only on 2.3. So, it is complete for 2.2.

      Attachments

        Issue Links

          Activity

            People

              softec Denis Gervalle
              softec Denis Gervalle
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: