Hi, I would like to close XWIKI-6987. The simplest fix is to stop considering delete rights at document level. There was only one response to this vote when Sergiu proposed it so if it is ok I would like to propose it again:
Should the rights service ignore delete rights set at document level? Here is my +1. Best regards, /Andreas 2011-09-30 17:46, Sergiu Dumitriu skrev: > On 09/30/2011 11:18 AM, Guillaume Lerouge wrote: >> Hi, >> >> I agree with this, especially given the use case described by Dimitry a >> couple weeks ago where an user with edit rights on a page were able to give >> himself the right to delete it. In addition to this, it's quite rare to have >> to assign this right at page level. "Delete" is a clean-up right that >> usually makes sense at the space level (at least), less so at the page >> level. >> >> Side question: does this have an impact on the right to rename a page? Is >> the "rename" right mapped to the edit or the delete action? > > Renaming implies deleting the old document, so yes, currently one can't > rename a document if they can't delete it as well. Still, this is just a > technical link, given by the fact that we don't have a real rename > method, it's just copy+delete. > >> So I'm +1 to remove the "delete" right at document level. >> >> Guillaume >> >> On Fri, Sep 30, 2011 at 4:32 PM, Sergiu Dumitriu<[email protected]> wrote: >> >>> Rights have different scopes in XWiki. Administration rights can only be >>> set on a space or wiki level, and any "admin" right set on a document >>> alone will be silently ignored. Programming rights are only considered >>> when set on the xwiki:XWiki.XWikiPreferences document, being ignored in >>> any other virtual wiki and at the space or document level. >>> >>> Delete rights are a bit special as well. By default, the creator of a >>> document has delete rights on that document. Unlike the other rights >>> which default to true when no right is set, this one defaults to false. >>> >>> So, by default, when no "delete" rights are set on the >>> document/space/wiki, only the creator of a document and administrators >>> are allowed to delete it. >>> >>> Should we allow setting the delete right at the document level? >>> >>> Personally, I'd say no, since it's a rare requirement for a non-creator >>> to be able to delete just one document. Space-level rights should be >>> enough, IMO. > > _______________________________________________ devs mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/devs
