Re: [xwiki-users] stopping a page for non-editors
Hi,
Thanks for all the responses. Here are some results after testing the
suggestions:
* When I simply remove the #stop directive, I no longer get exceptions, but
also I don't get the page to block. Without the #stop, the velocity part
simply ends and it continues to the PHP part with no interruption and so the
page is shown normally. This solution is therefore not going to work in this
case.
* Nesting a PHP script inside a velocity script is not accepted, so this
solution will also not work here.
* I could use the native page access control, but it's somewhat of an
overhead as the pages in question are in different spaces and I would need
to go page by page to set the proper permissions. I realize that this may be
the more "correct" approach but it still appears to be easier for me to do
it at the code level - sort of 'do once and never worry about anything
else later'.
Anyway, following Raluca's advice I've opened a minor JIRA XE-887 about the
#stop excepetion issue, and what I ended up doing for now is the following,
which simply redirects to an error page. For my current needs this is good
enough, and eventually when the #stop directive will be supported again I'll
shift back to it.
{{velocity}}
#set($user=$xwiki.getUser())
#if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup"))
{{warning}}You don't have permission to view this document{{/warning}}
$response.sendRedirect($xwiki.getURL("MyMain.NoAccess"))
#end
{{/velocity}}
Thanks again for all the help!
On Thu, Apr 7, 2011 at 1:59 PM, Eduard Moraru wrote:
> Hi China :),
>
> On 04/05/2011 05:38 PM, China Sunrise wrote:
> > Hi,
> > I'm relatively new to xwiki. I have a few pages where dynamic tables had
> to
> > be shown, and I'm using PHP quite heavily there. In a couple of pages,
> the
> > content is supposed to be shown only if the user is in a specific group
> > called 'XWikiEditorsGroup'. I didn't want to rely on xwiki's native
> > single-page permissions as they looked a little cumbersome for what I
> > needed, and preferred to control access via the page code itself. Up to
> > xwiki 2.7, the following velocity section, which was the first section in
> > the page, did the trick:
> >
> > {{velocity}}
> > #set($user=$xwiki.getUser())
> > #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup"))
> >{{warning}}You don't have permission to view this document{{/warning}}
> >#stop
> > #end
> > {{/velocity}}
> I don`t know how the PHP macro(?) works, but why don`t you do something
> like:
>
> {{velocity}}
> #set($user=$xwiki.getUser())
> #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup"))
> {{warning}}You don't have permission to view this document{{/warning}}
> #else
> {{php}}
> do some php here.
> {{/php}}
> #end
> {{/velocity}}
>
>
> If you can nest the php macro into the velocity one, you are good to go
> and the code does not use velocity-dependent tricks.
>
> P.S.: On the other hand, I do recommend using XWiki's rights system. If
> you want to assign rights to multiple pages at once, do it at space
> level. You could also create a 'protected' space where you put all your
> protected pages that should be visible only to group X (so that you
> manage rights from a single -- space level -- point to avoid page level
> management).
>
> Hope this helps,
> Eduard
> > However, after upgrading to xwiki 3.0, this code no longer works. From
> what
> > I see, the issue appears to be related to velocity 1.7 and its different
> > syntax for the #stop directive. I can't seem to find the right syntax
> > though. As an alternative approach, I've also tried to relocate this
> access
> > control logic into the PHP code that follows the above velocity section.
> To
> > do that, I need to find a way to get the true/false value of
> > "$user.isUserInGroup("XWiki.XWikiEditorsGroup")" in PHP, but so far
> haven't
> > found a way to do that either and not sure how to pass the $user object
> and
> > its isUserInGroup() method to the PHP part. I've even looked into doing
> this
> > in groovy but no luck there either.
> >
> > Any advice will be appreciated...
> >
> > Thanks
> > ___
> > users mailing list
> > users@xwiki.org
> > http://lists.xwiki.org/mailman/listinfo/users
> >
>
> ___
> users mailing list
> users@xwiki.org
> http://lists.xwiki.org/mailman/listinfo/users
>
___
users mailing list
users@xwiki.org
http://lists.xwiki.org/mailman/listinfo/users
Re: [xwiki-users] stopping a page for non-editors
Hi China :),
On 04/05/2011 05:38 PM, China Sunrise wrote:
> Hi,
> I'm relatively new to xwiki. I have a few pages where dynamic tables had to
> be shown, and I'm using PHP quite heavily there. In a couple of pages, the
> content is supposed to be shown only if the user is in a specific group
> called 'XWikiEditorsGroup'. I didn't want to rely on xwiki's native
> single-page permissions as they looked a little cumbersome for what I
> needed, and preferred to control access via the page code itself. Up to
> xwiki 2.7, the following velocity section, which was the first section in
> the page, did the trick:
>
> {{velocity}}
> #set($user=$xwiki.getUser())
> #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup"))
>{{warning}}You don't have permission to view this document{{/warning}}
>#stop
> #end
> {{/velocity}}
I don`t know how the PHP macro(?) works, but why don`t you do something
like:
{{velocity}}
#set($user=$xwiki.getUser())
#if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup"))
{{warning}}You don't have permission to view this document{{/warning}}
#else
{{php}}
do some php here.
{{/php}}
#end
{{/velocity}}
If you can nest the php macro into the velocity one, you are good to go
and the code does not use velocity-dependent tricks.
P.S.: On the other hand, I do recommend using XWiki's rights system. If
you want to assign rights to multiple pages at once, do it at space
level. You could also create a 'protected' space where you put all your
protected pages that should be visible only to group X (so that you
manage rights from a single -- space level -- point to avoid page level
management).
Hope this helps,
Eduard
> However, after upgrading to xwiki 3.0, this code no longer works. From what
> I see, the issue appears to be related to velocity 1.7 and its different
> syntax for the #stop directive. I can't seem to find the right syntax
> though. As an alternative approach, I've also tried to relocate this access
> control logic into the PHP code that follows the above velocity section. To
> do that, I need to find a way to get the true/false value of
> "$user.isUserInGroup("XWiki.XWikiEditorsGroup")" in PHP, but so far haven't
> found a way to do that either and not sure how to pass the $user object and
> its isUserInGroup() method to the PHP part. I've even looked into doing this
> in groovy but no luck there either.
>
> Any advice will be appreciated...
>
> Thanks
> ___
> users mailing list
> users@xwiki.org
> http://lists.xwiki.org/mailman/listinfo/users
>
___
users mailing list
users@xwiki.org
http://lists.xwiki.org/mailman/listinfo/users
Re: [xwiki-users] stopping a page for non-editors
Hello,
Indeed, #stop throws an exception on XWiki 3.0.
You should create an issue on Jira about the #stop problem. I don't really
know if this is caused by XWiki, or is strictly related to Velocity. This is
a regression from my point of view and it should be fixed.
Another solution for you would be to override contentview.vm and replace the
line:
$renderedContent
with:
#if(!$xwiki.getUser().isUserInGroup("XWiki.XWikiEditorsGroup"))
{{warning}}You don't have permission to view this document{{/warning}}
#else
$renderedContent
#end
More info about how to override a template can be found here:
http://platform.xwiki.org/xwiki/bin/view/DevGuide/Skins#HD.OverridingtheSkincomponents.
Raluca.
On Tue, Apr 5, 2011 at 5:38 PM, China Sunrise wrote:
> Hi,
> I'm relatively new to xwiki. I have a few pages where dynamic tables had to
> be shown, and I'm using PHP quite heavily there. In a couple of pages, the
> content is supposed to be shown only if the user is in a specific group
> called 'XWikiEditorsGroup'. I didn't want to rely on xwiki's native
> single-page permissions as they looked a little cumbersome for what I
> needed, and preferred to control access via the page code itself. Up to
> xwiki 2.7, the following velocity section, which was the first section in
> the page, did the trick:
>
> {{velocity}}
> #set($user=$xwiki.getUser())
> #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup"))
> {{warning}}You don't have permission to view this document{{/warning}}
> #stop
> #end
> {{/velocity}}
>
> However, after upgrading to xwiki 3.0, this code no longer works. From what
> I see, the issue appears to be related to velocity 1.7 and its different
> syntax for the #stop directive. I can't seem to find the right syntax
> though. As an alternative approach, I've also tried to relocate this access
> control logic into the PHP code that follows the above velocity section. To
> do that, I need to find a way to get the true/false value of
> "$user.isUserInGroup("XWiki.XWikiEditorsGroup")" in PHP, but so far haven't
> found a way to do that either and not sure how to pass the $user object and
> its isUserInGroup() method to the PHP part. I've even looked into doing
> this
> in groovy but no luck there either.
>
> Any advice will be appreciated...
>
> Thanks
> ___
> users mailing list
> users@xwiki.org
> http://lists.xwiki.org/mailman/listinfo/users
>
___
users mailing list
users@xwiki.org
http://lists.xwiki.org/mailman/listinfo/users
Re: [xwiki-users] stopping a page for non-editors
Hi China,
On Tue, Apr 5, 2011 at 16:38, China Sunrise wrote:
> Hi,
> I'm relatively new to xwiki. I have a few pages where dynamic tables had to
> be shown, and I'm using PHP quite heavily there. In a couple of pages, the
> content is supposed to be shown only if the user is in a specific group
> called 'XWikiEditorsGroup'. I didn't want to rely on xwiki's native
> single-page permissions as they looked a little cumbersome for what I
> needed, and preferred to control access via the page code itself. Up to
> xwiki 2.7, the following velocity section, which was the first section in
> the page, did the trick:
>
> {{velocity}}
> #set($user=$xwiki.getUser())
> #if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup"))
> {{warning}}You don't have permission to view this document{{/warning}}
> #stop
> #end
> {{/velocity}}
>
Why do you need the #stop directive to begin with? Simply remove it and see
what happens.
Guillaume
However, after upgrading to xwiki 3.0, this code no longer works. From what
> I see, the issue appears to be related to velocity 1.7 and its different
> syntax for the #stop directive. I can't seem to find the right syntax
> though. As an alternative approach, I've also tried to relocate this access
> control logic into the PHP code that follows the above velocity section. To
> do that, I need to find a way to get the true/false value of
> "$user.isUserInGroup("XWiki.XWikiEditorsGroup")" in PHP, but so far haven't
> found a way to do that either and not sure how to pass the $user object and
> its isUserInGroup() method to the PHP part. I've even looked into doing
> this
> in groovy but no luck there either.
>
> Any advice will be appreciated...
>
> Thanks
> ___
> users mailing list
> users@xwiki.org
> http://lists.xwiki.org/mailman/listinfo/users
___
users mailing list
users@xwiki.org
http://lists.xwiki.org/mailman/listinfo/users
[xwiki-users] stopping a page for non-editors
Hi,
I'm relatively new to xwiki. I have a few pages where dynamic tables had to
be shown, and I'm using PHP quite heavily there. In a couple of pages, the
content is supposed to be shown only if the user is in a specific group
called 'XWikiEditorsGroup'. I didn't want to rely on xwiki's native
single-page permissions as they looked a little cumbersome for what I
needed, and preferred to control access via the page code itself. Up to
xwiki 2.7, the following velocity section, which was the first section in
the page, did the trick:
{{velocity}}
#set($user=$xwiki.getUser())
#if(!$user.isUserInGroup("XWiki.XWikiEditorsGroup"))
{{warning}}You don't have permission to view this document{{/warning}}
#stop
#end
{{/velocity}}
However, after upgrading to xwiki 3.0, this code no longer works. From what
I see, the issue appears to be related to velocity 1.7 and its different
syntax for the #stop directive. I can't seem to find the right syntax
though. As an alternative approach, I've also tried to relocate this access
control logic into the PHP code that follows the above velocity section. To
do that, I need to find a way to get the true/false value of
"$user.isUserInGroup("XWiki.XWikiEditorsGroup")" in PHP, but so far haven't
found a way to do that either and not sure how to pass the $user object and
its isUserInGroup() method to the PHP part. I've even looked into doing this
in groovy but no luck there either.
Any advice will be appreciated...
Thanks
___
users mailing list
users@xwiki.org
http://lists.xwiki.org/mailman/listinfo/users
