Question

A question regarding Twiki Access Control.

I have a SecureTopic which is set to

* Set ALLOWTOPICCHANGE = Main.MyAdminGroup

Main.MyAdminGroup is set to:

* Set GROUP =
* Set ALLOWTOPICCHANGE = Main.MyName

In this configuration, it seems any user can edit the SecureTopic. Only once I actually populate MyAdminGroup with a name, is SecureTopic protected. This seems to be dangerous. Why would a Group that exists but is empty be considered to include all users?

• TWiki version: 03 August 2002
• Web server: Apache
• Server OS: Linux
• Web browser: Opera
• Client OS: Linux

-- MathiasKoerber - 05 Sep 2002

Answer

All new groups should be defined with some names in the GROUP. There was some design reason why we chose an empty GROUP to be open, but I can't recall.

-- PeterThoeny - 07 Sep 2002