Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-5894

Incorrect author when saving document in a different wiki.

    XMLWordPrintable

Details

    • Bug
    • Resolution: Duplicate
    • Major
    • None
    • None
    • Model
    • None
    • Unknown
    • N/A
    • N/A

    Description

      In api.Document, we have the method saveDocument, which will be called
      when saving a document:

          protected void saveDocument(String comment, boolean minorEdit) throws XWikiException
          {
              XWikiDocument doc = getDoc();
              doc.setAuthor(this.context.getUser());
              if (doc.isNew()) {
                  doc.setCreator(this.context.getUser());
              }
              getXWikiContext().getWiki().saveDocument(doc, comment, minorEdit, getXWikiContext());
              this.cloned = false;
          }
      

      However, context.getUser() always seems to return a username that is
      unqualified with respect to the wikiname. This means that when saving
      a document in a different wiki the author will be incorrect.

      This bug is a problem when executing scripts from the main wiki to do
      various administrative tasks on virtual wikis, for instance to assign
      programming rights. (Even though a user with programming rights can
      work around it.)

      In virtual mode, it doesn't seem possible to assign edit rights on the
      main wiki to a user of a virtual wiki via the user interface, so it
      seems that this cannot normally be exploited to obtain programming
      rights.

      A quick fix is to just add in the wiki name:

          DocumentReference ref = doc.getDocumentReference();
          if (!ref.getWikiReference().getName().equals(context.getDatabase())) {
             doc.setAuthor(context.getDatabase() + ":" + context.getUser());
          }
      

      But I'd guess that in the long run, we would like to add a user
      reference type and a serializer to the EntityReference family to
      represent user names?

      Attachments

        Issue Links

          Activity

            People

              aj Andreas Jonsson
              aj Andreas Jonsson
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: