Can't edit Program rights anymore

[erwanleroy]

Hello.

I’m the admin of an xWiki install (16.10.0). Today I was redoing our rights, and wanted to set some rights back to default. For the XWikiAdminGroup right, the “program” permission was checked, and I wanted to set it back to “Undefined”.
When I clicked on it, it had to go through the deny phase, I got the popup saying I might be removing my own permission, which was probably fine as I was going to toggle again, then I clicked again to set it to undefined.

The problem is, it won’t save as undefined, nor as allowed anymore. I can set the value to whatever I want, but whenever I leave the page and come back, it’s back to Deny.

Is this a bug? Do I not have permission to edit this right anymore?
I’m stuck at this:

How can I go back?

[tmortagne]

@erwanleroy

The problem is, it won’t save as undefined, nor as allowed anymore. I can set the value to whatever I want, but whenever I leave the page and come back, it’s back to Deny.

Yes, that’s because you don’t have programming right anymore, so you cannot set it (the UI should be improved to reflect that).

@erwanleroy

How can I go back?

You will need to enable superadmin user (by setting a password for it in xwiki.cfg).

[vmassol]

@tmortagne

You will need to enable superadmin user (by setting a password for it in xwiki.cfg).

Details at https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Configuration/#HEnablesuperadminaccount

[CharpentierLucas]

@erwanleroy

When I clicked on it, it had to go through the deny phase, I got the popup saying I might be removing my own permission, which was probably fine as I was going to toggle again, then I clicked again to set it to undefined.

rightsmanager.denyrightforgroup

You are about to deny the __right__ right for  __name__. This implies denying your own __right__ right, if you are part of this group. Continue?

We should probably state in this string explicitely that this might be a non-reversible action.

EDIT: created XWIKI-23203: Updating own right warning is not clear enough about the consequences

[tmortagne]

@CharpentierLucas

We should probably state in this string explicitely that this might be a non-reversible action.

The UI should also disable the inputs you are not allowed to change.

[erwanleroy]

What got me was that I did not expect that program rights were related to the right to grant permissions.
Also I don’t know if there is already a way, but I don’t know how to get back to undefined checkbox without passing through a deny state first.

[tmortagne]

@erwanleroy

What got me was that I did not expect that program rights were related to the right to grant permissions.

It’s not. The problem is more that a user cannot manipulate a right he does not have. It’s less visible for other rights because when you have ADMIN right you have them all (except PROGRAMMING).

@erwanleroy

Also I don’t know if there is already a way, but I don’t know how to get back to undefined checkbox without passing through a deny state first.

With that UI, you cannot.

But you can directly edit the right object using the object editor, for example the wiki level rights are located on https://mydomain/xwiki/bin/edit/XWiki/XWikiPreferences?editor=object.

[MichaelHamann]

@tmortagne

@erwanleroy

Also I don’t know if there is already a way, but I don’t know how to get back to undefined checkbox without passing through a deny state first.

With that UI, you cannot.

It’s possible with this UI, it’s just hidden. When you click “Cancel” on this first question, you get a second question if you instead want to remove the right instead (i.e., go back to undefined).