Re: [xwiki-users] RSS feed = Security problem?

2007-12-26 Thread Marco Fabbri
Hi Robert, if you take a look at the rss feed url without the ?xpage=rdf
in editing mode, as suggested by Guillame, you should see the page
XWiki.WebRssCode is include, taking a look at it will show you that
access rights are taken into account:

#if($xwiki.hasAccessLevel("view", "${context.database}:${currentdoc.fullName}"))

the problem AFAIK is the call to the caching service
$context.setCacheDuration(1800) at the beginning of the page, commenting
it (i.e. ##$context.setCacheDuration(1800) ) should solve your problem.

On Mon, 2007-12-24 at 12:41 +, [EMAIL PROTECTED] wrote:
> Hi Robert, as everything else in XWiki RSS feeds are generated through
> scripts. The easier way to stop them is to delete their pages (remove
> ?xpage=rdf at the end of the feed url to access the wiki page
> underneath). Then you can either delete the page or try to play with
> it in wiki edition mode to add velocity hasAdmin checks for instance.
> My knowledge of XWiki scripting alas isnt good enough to provide you
> with the precise modification to make there. Hope this helps,
> Guillaume
> 
> On 23/12/2007, Robert Hercz <[EMAIL PROTECTED]> wrote:
> > It seems that the RSS feed publishes whatever is changed, even from Spaces
> > which are non-public. This means that anyone subscribing to RSS feeds will
> > get document titles of new/changed pages, even if they are not among the
> > users who have the right to view the pages.
> >
> > Is this a "feature" in XWiki, i.e. that all changes are published
> > indiscriminately if RSS is available?
> >
> > If so, is there a way to disable RSS and/or to decide which page changes
> > should be published?
> >
> > Best regards,
> > Robert
> >
> > ___
> > users mailing list
> > users@xwiki.org
> > http://lists.xwiki.org/mailman/listinfo/users
> >
> 
> 
> ___
> users mailing list
> users@xwiki.org
> http://lists.xwiki.org/mailman/listinfo/users

-- 
Marco

=
"We know nothing
 — that is the first point.
Therefore we should be very modest
 — that is the second.
That we should not claim to know when we do not know
 — that is the third."

 Karl R. Popper

___
users mailing list
users@xwiki.org
http://lists.xwiki.org/mailman/listinfo/users


Re: [xwiki-users] RSS feed = Security problem?

2007-12-24 Thread guillaume
Hi Robert, as everything else in XWiki RSS feeds are generated through
scripts. The easier way to stop them is to delete their pages (remove
?xpage=rdf at the end of the feed url to access the wiki page
underneath). Then you can either delete the page or try to play with
it in wiki edition mode to add velocity hasAdmin checks for instance.
My knowledge of XWiki scripting alas isnt good enough to provide you
with the precise modification to make there. Hope this helps,
Guillaume

On 23/12/2007, Robert Hercz <[EMAIL PROTECTED]> wrote:
> It seems that the RSS feed publishes whatever is changed, even from Spaces
> which are non-public. This means that anyone subscribing to RSS feeds will
> get document titles of new/changed pages, even if they are not among the
> users who have the right to view the pages.
>
> Is this a "feature" in XWiki, i.e. that all changes are published
> indiscriminately if RSS is available?
>
> If so, is there a way to disable RSS and/or to decide which page changes
> should be published?
>
> Best regards,
> Robert
>
> ___
> users mailing list
> users@xwiki.org
> http://lists.xwiki.org/mailman/listinfo/users
>


-- 
http://wikibc.blogspot.com/
___
users mailing list
users@xwiki.org
http://lists.xwiki.org/mailman/listinfo/users


[xwiki-users] RSS feed = Security problem?

2007-12-23 Thread Robert Hercz
It seems that the RSS feed publishes whatever is changed, even from Spaces
which are non-public. This means that anyone subscribing to RSS feeds will
get document titles of new/changed pages, even if they are not among the
users who have the right to view the pages.

Is this a "feature" in XWiki, i.e. that all changes are published
indiscriminately if RSS is available?

If so, is there a way to disable RSS and/or to decide which page changes
should be published?

Best regards,
Robert

___
users mailing list
users@xwiki.org
http://lists.xwiki.org/mailman/listinfo/users