Page only access rights are ignored

Good day!

I run an internal knowledge sharing platform based on XWiki Enterprise 8.4.5 and recently faced strange issue with “Page only” rights (These rights apply on this page only and do not affect the children).

Not sure if this is relevant, but just in case let me briefly describe my structure:

  • I have a group “Dept1” that have the following global rights: View, Comment, Edit, Delete (all others are unticked in wiki administration).
  • I create a page “Page A”. No custom rights are set for it.
  • I create a child page “Page A -> Page B” and a number of its children (“Page A -> Page B -> Page 1”, “Page A -> Page B -> Page 2”, “Page A -> Page B -> Page 3”, etc)
  • If I set any custom rights (Administration: Rights: Page & Children) for “Page B” - everything is working as expected
  • But I need to deny edit right on “Page B” for “Dept1”. And only for “Page B” itself not for children. I’m trying to set any rights (Administration: Rights: Page) for “Page B”, but they are simply ignored.

I haven’t found any info whether it’s a known issue or not. Could someone please advise if it is something that has been addressed in later XWiki releases ?

BR,
Mike

Huh, it turns out “page only” permissions are ignored regardless of hierarchy complexity…
Will check if this is fixed in newer versions

What do you exactly mean by that ? You deny EDIT on “Page B” for a specific user and this user can still click edit and save the page ?

Not even for “page B”, not even “edit” right.
I’ve just tested - even if I explicitly deny everything for the specific user at any page (page only, not affecting children), he still has access. Nothing changes at all.
Again, if I set right for page and children -everything works as expected.
Gonna test with newer build a bit later today…

I never seen any report of this bug and it works fine for me on 10.8.

See for example:

All I did is denying VIEW right to guest user on https://tuska.myxwiki.org/xwiki/bin/view/Test/PageOnlyRights page only.

Thomas, thank you for taking a look…
I quickly deployed fresh 8.4.5 install - and I cannot reproduce =(
Something went terribly wrong with my prod installation… not sure how to troubleshoot this…

Is there something like permissions cache which may need to be dropped ?

There is a permission cache but a restart should fix it. Make sure you are not testing with a user having ADMIN right at wiki level or being the owner of the wiki since you can’t deny anything to those.

Got it!
So steps to reproduce are as follows:

  1. Fresh install 8.4.5
  2. Install Rights UI Simplifier extension
  3. Page only permissions do not longer work
  4. Delete Rights UI Simplifier extension
  5. Page only permissions are still ignored
  6. To fix it you need to rollback XWiki/AdminPageAndChildrenRightsSheet, XWiki/AdminPageRightsSheet and XWiki/AdminRightsSheet manually!

Looks like extension uninstaller does not perform rollback automatically.
The bottom line is Rights UI Simplifier is useless and kind of dangerous extension. Don’t ever install it!

Thank you for your help!

Would be great if you could report it on Loading....

Done
https://jira.xwiki.org/projects/SIMRIGHT/issues/SIMRIGHT-17