Item2395 < Tasks

NOTE: If you are a developer, please use a private wiki based on foswiki/trunk on a daily base ...or use trunk.foswiki.org to view this page for some minimal testing.
Use Item9693 for docu changes for 1.2 and 2.0.

You are here: Foswiki>Tasks Web>Item2395 (revision 5) (raw view)

If an admin sets =DENYWEBVIEW=WikiGuest= in the =Main.SitePreferences=, this is overridden by the shipped settings in the Main, Sandbox and System webs, as their =WebPreferences= topic contains =Set DENYWEBVIEW==.

this is a poor default, as it assumes that the user wants those webs to be 
   1 indexed by google etc
   2 reduces the choices admins have, as we strongly discourage modifying shipped topics.

There __Still__ is text saying =Remove the # to enable any of these settings=, but the #'s appear to have been removed

there seems to be something odd, and worrying going on, in that if i remove the ACL settings from the Sandbox  web prefs, it is not denying view to guest, even though that is set to DENYWEBVIEW in the SitePreferences.


additionally, how to deny view access to the Main web, while still using it to set the defaults? - ok, so maybe that is the problem?


-- Main.SvenDowideit - 22 Nov 2009

I think you are requesting a new feature here.

The Main.SitePreferences setting has never been able to set access rights globally. It is always per web. Ie you have to define the access in all webs.

If we want to add this it is a new feature and we better think carefully how this will interact with all other access settings people may be using in practical life.

Please limit any activity around this to trunk.

-- Main.KennethLavrsen - 25 Nov 2009

well, it turns out that I actually uncovered an existing and undocumented functionality - I might merge that docco commit to 1.0.8 - i'm still mulling over the consequenses..

I'm certainly not proposing we change the code in 1.0.x - unless there really is an insecurity.

-- Main.SvenDowideit - 25 Nov 2009

I just verified my original assumption.

You cannot define DENYWEBANYTHING in Default- or !SitePreferences. I just tried. It does not work.

Unfortunately I did not see the checkin you did so this has confused the hell out of people lately because the System.AccessControl says that DENYWEB.. is inherited from site wide preferences but when they try in practical it has no effect.

I have removed the added text and will do further editing.

And I put this item in No Action.

-- Main.KennethLavrsen - 25 Nov 2010

ItemTemplate edit

Summary	Shipped WebPreference topics default to over-riding ACL's with insecure choices (wrong assumption in this bug report)
ReportedBy	SvenDowideit
Codebase	1.0.7, trunk
SVN Range	Foswiki-1.0.7, Sun, 20 Sep 2009, build 5061
AppliesTo	Engine
Component
Priority	Enhancement
CurrentState	No Action Required
WaitingFor
Checkins	Foswikirev:5595
TargetRelease	minor
ReleasedIn	n/a

Topic revision: r5 - 25 Nov 2010, KennethLavrsen

Tasks

Submit and Query

Create Task

Developer Tasks

Non Developer Tasks

Developer Tools

Tools

The copyright of the content on this website is held by the contributing authors, except where stated elsewhere. see CopyrightStatement.