Unprivileged creators can lock themselves out easily

Help / Discuss
1

Hello,

I found a scenario where an advanced (but still non-privileged) XWiki user can easily lock themselves out of a page.

Steps to reproduce:

  1. Create and log in as an unprivileged XWiki user (default permissions).
  2. Switch to advanced mode (via the keyboard shortcut xxxa ).
  3. Open Access rights edit mode on any page.
  4. Grant view permissions to the XWikiAdminGroup .
  5. Wait for 5 seconds.
  6. Try to change other access rights.

Result:

A popup is displayed: An error occurred while communicating with the server. Please check that the server is accessible, and you have the proper rights to perform the requested action.. If you reload, the page is no longer visible. I suspect this is related to the implicit deny behavior of access rights (which would be expected behaviour).

I think this is an issue because unprivileged users should likely not be able to modify access rights on arbitrary pages just by switching to advanced mode. Also, it is easy to lockout of the page.

However, it would make sense if unprivileged users could set access rights on pages they created. This allows them to setup personal pages shared with few people themselves without asking the wiki admin.
Preferrably, this should be possible to configure in the UI. Maybe the original page author could become a scoped ADMIN on the page? This would also make it impossible to lock himself out of the page.
I also noted that admin users do not see the Access rights mode at all.

2

That’s why we made a small jsx:

var buttonAccessRights = document.querySelector('#tmEditRights');
try {
  buttonAccessRights.remove();
} catch (e) {};

Or you can do a ssx:

#tmEditRights {
   display: none;
}

We did not see a reason for anyone except admins to give dedicated rights for pages.