• Do not register here on develop.twiki.org, login with your twiki.org account.
• Use View topic Item7700 for generic doc work for TWiki-6.0.2. Use View topic Item7703 for doc work on extensions that are not part of a release. More... Close
• Anything you create or change in standard webs (Main, TWiki, Sandbox etc) will be automatically reverted on every SVN update.
Does this site look broken?. Use the LitterTray web for test cases.

I just noticed that the TWiki.TWikiPreferences is not locked down explicitely. The whole TWiki web is locked down for editing to the admin group with a ALLOWWEBCHANGE WebPreferences setting. That is, the site preferences are write protected as well. So far so good.

BUT: What happens if an admin decides to remove the write restriction for the TWiki web? He/she does not realize that the TWikiPreferences is open. Same issue when upgrading from an earlier TWiki where the TWiki web is already open. This leaves the TWikiPreferences open for anyone to edit. What was the reason to remove ALLOWTOPICCHANGE and ALLOWTOPICRENAME? Any reason not to play safe and put it back?

-- PTh

Imho, the overall default policy should be reversed. Right now, a default install is world writeable as soon as it switched on. Given you don't want to have a world-writeable public wiki you have to go around and lock down everything which is a daunting and error prone task. And there is a time window where your site is not protected.

The solution is so simple: ship twiki with everything locked only allowing the TWikiAdminGroup any modifications, which is the first and only user in the beginning anyway. If you need more access then do so step by step...

-- MD

This is a good idea, and needs to be discussed elsewhere. Locking down everything by default brings up a chicken and egg problem at installation time.

-- PTh

Done:

  • TWiki 4: 10224
  • DEVELOP: 10225

-- PTh

ItemTemplate
Summary Lock down TWiki.TWikiPreferences to admin group
ReportedBy TWiki:Main.PeterThoeny
Codebase 4.0.2
SVN Range Sat, 06 May 2006 build 10108
AppliesTo Engine
Component Documentation
Priority Urgent
CurrentState Closed
WaitingFor

Checkins 10224 10225
TargetRelease patch
ReleasedIn

Edit | Attach | Watch | Print version | History: r9 < r8 < r7 < r6 < r5 | Backlinks | Raw View | Raw edit | More topic actions
Topic revision: r9 - 2007-02-04 - CrawfordCurrie
 
This site is powered by the TWiki collaboration platform Powered by PerlCopyright © 2008-2017 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback