Velocity: how to check if user has right 'view'

Help / Discuss
1

Hi.

I have some code that worked for a long time. Currently this line isn’t working anymore. I query for all changed articles and will list them as a table. But I wan’t to show only those results that the current visiting user is allowed to view:

#if($xwiki.hasAccessLevel('view', $xcontext.user, $recentDocResult))

We are at XWiki 17.4.4 now. I’m quite sure it worked with 15.10.13.

Is the code line above valid?

Regards, Simpel

2

Hello,

Just tested the following on XWiki 17.7.0 and it works fine:

{{velocity}}
#if ($xwiki.hasAccessLevel('view', $xcontext.user, $doc.documentReference))
  Works!
#end
{{/velocity}}

What doesn’t work?

3

Thanks. adding .documentReference fixed it.

#if($xwiki.hasAccessLevel('view', $xcontext.user, $recentDocResult.documentReference))

I iterated the returned query object with #foreach($recentDocResult in ${recentDocs}). And it did work long versions ago without adding .documentReference.

4

@Simpel I don’t think we changed that API.

You can try it yourself:

{{velocity}}
$doc.toString()
$doc.documentReference.toString()
{{/velocity}}

Gives (on my page where I tried it):

Main.test.WebHome
xwiki:Main.test.WebHome
5

Maybe it’s more that your use case has changed and before $recentDocResult was pointing to a page in the same wiki and it’s now located in another wiki?

7

Note that $xwiki.hasAccessLevel is actually quite legacy and will be explicitly marked as deprecated one day.

The current standard would be more

#if($services.security.authorization.hasAccess('view', $xcontext.userReference, $recentDocResult.documentReference))

or just

#if($services.security.authorization.hasAccess('view', $recentDocResult.documentReference))

which assumes you are checking the context user.

8

Tested:

    #foreach($recentDocResult in ${recentDocs})
        $recentDocResult.toString()
        $recentDocResult.documentReference.toString()
    #end

Results:

[Ljava.lang.Object;@1330a544
$recentDocResult.documentReference.toString()
[Ljava.lang.Object;@4dcb0313
$recentDocResult.documentReference.toString()
[Ljava.lang.Object;@e2aab68
$recentDocResult.documentReference.toString()
[Ljava.lang.Object;@541875ca
$recentDocResult.documentReference.toString()
[Ljava.lang.Object;@f32f5ca
$recentDocResult.documentReference.toString()
[Ljava.lang.Object;@26963c15
$recentDocResult.documentReference.toString()

Guess my query is somewhat faulty? I see opening square brackets but no closing.

The querying page and the pages pointing to are all in the same sub wiki.

9

Changed that to be future proof. Thanks.

10

Btw what language did you choose for the code format? I can’t find velocity in the drop down menu and my first approach ‘java’ didn’t fit.

11

This means that recentDocResult is not of type Document but it’s an array of objects.

Noe: Don’t know if it’s your issue but if you do a XWQL SELECT you’ll get a list of object arrays.

12

None