Question

When I creata a new user using NewUserTemplate I'd like there to be an entry that generates the line

          o Set ALLOWTOPICCHANGE = .. username ...

My attempts to use the

    %NOP{ ..... }%

I'd also like to be able to construct something like

   %<nop>SEARCH{ "... username ..." web="TWiki" scope="text" 
                  nosearch="on" nosummary="on" noheader="on" 
                  nototal="on" regex="off" order="modified" 
                  reverse="on" limit="20"
               }%

You can look at my home page to see how this should come out when hand crafted.

I'l like to have it automatic on creation.

As I say, the %NOP{ ... }% comes out blank.

Environment

-- AntonAylward - 11 Mar 2005

Answer

I have the following in my NewUserTemplate:

      * Set ALLOWTOPICCHANGE = %WIKINAME%

This accomplishes what you want.

-- DavidBright - 11 Mar 2005

Yes, that works. It might send the wrong message though. Collaboration works best if there are no roadblocks. Soft security is good enough protection in most cases, see also TWikiAccessControl

-- PeterThoeny - 16 Mar 2005

It's a tricky subject. Enabling this as default in the distribution would allow for i.e. automatic (user handled) password reset procedures - and it would be easy to descripe a procedure for it, as in most corporations the email addresses of employees are static.

For user homepages I'd say that this is a good way to go. I believe those who set up i.e. comment-enabled blog-like environments on their homepage will have the insight to remove the ALLOWTOPICCHANGE line again - sending the "right signal"

-- TWikiGuest - 16 Mar 2005

The RegisterCgiScriptRewrite demands that the home page is protected from modification by others because the user's email address is stored there and new functionality exists to email a new password to that address. Without this a user's account can be hijacked.

• This needs to be reviewed. Cairo has two modes: External auth and internal auth. External auth should not require a lock of the user home pages. This should be made optional for internal auth. -- PeterThoeny - 19 Mar 2005

I suggest that you set up a GuestBooks web and link to and include that from the user's home page.

-- MartinCleaver - 16 Mar 2005

I'm not sure DavidBright's idea will work.

The way it seems to work for me is that the new user template is parsed and the % variables expanded to create the "home" topic for the new user. What identity is this carried out under?

Under Dakar/DEVELOP it certainly isn't that of the newly created user because the user hasn't been created and validated yet.

-- AntonAylward - 16 Mar 2005

With respect to PeterThoeny's comment about sending the wrong message, I remained neutral; I simply answered the question asked. Whether protecting the user pages is a good idea is up to the community involved.

With respect to AntonAylward's comment, all I can say is that the method does work for me on my Cairo release system. The %WIKINAME% variable is specifically mentioned as a variable that is expanded while processing the template and it is expanded with the value of the (new) user name. Whether it will continue to work on Dakar is a question that I'm interested in, but cannot answer at this time.

-- DavidBright - 16 Mar 2005