Search on multi-tenancy?

Help / Discuss
#1

Hello all,
We are running an XWiki which is public and works well.
Recently we added an internal wiki aside of it, completely locked to access except when logged in, using the multi-tenancy feature. Unfortunately, we discovered that the search is showing pages from both sites.

  • Can we disable search on multi-sites?
  • Is it normal that the pages which are not allowed the current user are also shown in the search result?

thanks in advance.
Paul

#2

You mean, you added a subwiki?

I have something similar - a main wiki that is open to all users who login, and a sub-wiki of more sensitive information where users have to be granted access.

so privileged users search results will return data from both wikis, while less privileged only receive results from the main wiki.

Perhaps your security settings are not quite right?

#3

Search from main wiki indeed search everywhere by default but you see only what you are allowed to see. What happen when your user click on the found page link ? If you are not allowed to access the page then you found a very serious regression that should be fixed ASAP.

By default the subwiki have no specific right and inherit main wiki ones which could explain why main wiki users have access to it in your case.

If your issue is not really a right issue and you just want to isolate those wikis searches it’s possible to indicate the list of wikis where solr is allowed to search in main wiki by editing Main.SolrSearchConfig page or by following http://extensions.xwiki.org/xwiki/bin/view/Extension/Solr+Search+Application#HMiscellaneous.

#4

As a guest, no link is clickable (the login is always shown) but the snippets are all visible.
I also tried to adjust the rights of the second wiki which only had “prevent guests from seeing any page” checked to include a prohibition to view any page for guests. I then reindexed. Same issue.

@tmortagne, your solution seems to imply that the second wiki would not be searchable anymore. That does not look like a good idea.
paul

#5

@tmortagne, your solution seems to imply that the second wiki would not be searchable anymore. That does not look like a good idea.

The name of the property is wikisSearchableFromMainWiki so no it won’t affect subwikis :slight_smile:

As a guest, no link is clickable (the login is always shown) but the snippets are all visible.
I also tried to adjust the rights of the second wiki which only had “prevent guests from seeing any page” checked to include a prohibition to view any page for guests. I then reindexed. Same issue.

This is weird since solr service do a view right check before sending back a result to the search page. Maybe there is a bug when the page come from a different wiki.