XWiki Debian 17.6.0 : profile pages protection

Help / Discuss
1

Hello,

Installed using the stable sources.list, in a Debian 12 server, with Apache2 and xjetty, I would now like to open the wiki for everyone to see its content, before setting up the security around registrations. (https://xwiki.linuxvillage.org).

However, I would not want the profile pages to show to the whole world:

  • publicly
  • to other users, even when signed in

I have first felt concerned about private information : real name, mail address. For this part, I have found some answers on the forum : Hide the user directory for non-admin users

Ideally, I was looking for “on/off” switches. I have found some, but not all. Is there a simple way, for an 17.6.0 edition, to hide a personal profile to the rest of the world, without having to add / run a code that might risk not working anymore in the next version of XWiki?
(Seen here : How to restrict users from accessing other users profiles and profile data - #6 by slauriere , no idea if it is what I would be looking for).

I have been able to remove my login ID from public view, it seems, (found a switch somewhere) and part of my mail adress. (I am the only user registered yet, as it is a brand new install, not yet fully configured).

But I noticed the groups in which my user profile belongs are also showing publicly. I think it is not a good idea, especially with users belonging to admin group.

Could it be done differently? How?

Thank you for your help.

PS: this page, https://snippets.xwiki.org/xwiki/bin/view/Extension/Initialize%20rights%20of%20user%20profiles/ starts with “Last modified (…) on 2025/02/12 12:25” and ends with “This example was tested on version 12.10.5 of XWiki.”

This is why I am in a wonder on “what could go wrong”, if I’d give it a try?

1 Like
2

That’s a wiki, so you can always head to the History tab to check what changed among page versions and when:

https://snippets.xwiki.org/xwiki/bin/view/Extension/Initialize%20rights%20of%20user%20profiles/#History

3

I see, thank you. However I am still unsure what I can expect in regard of what I am looking for.
Also while testing the snippet, how to revert back in case of need?

(Should I create a snapshot first and revert if needed, for example, or is there another way?)

4

There’s no feature built in to do that. I think the expectation is that XWiki is a collaboration tool and this it’s important to see who the person is that made such pages or brought such changes to a page, hence the fact the profile is viewable by default.

Now I can understand the need to protect the user profile page. See Loading...

Right now you’ll need to set rights on user profile pages that need to be restricted. This is what the snippet mentioned in the jira issue above does, by creating an event listener that sets rights to user profile pages when they’re created.

This is pretty safe and to remove the feature you’ll just need to delete the page with the script and restart your wiki.

Note: I haven’t tested the script myself so I don’t know if it works or how well it works but you can test it. Ofc always make sure you have a backup in case something goes wrong somehow.