SID-01523: Write protect user profile page

Status:	Answered	TWiki version:	5.1.1	Perl version:	5.10.1
Category:	CategoryAccessControl	Server OS:	CentOS 6.3 2.6.32-220.el6.x86_64	Last update:	13 years ago

Hi,

I know that this question has been put and discussed before:

• SID-00498: Restrict personal Sandbox access
• SID-00499: Edit Personal Information
• SID-01420: Restrict change of User Information

Unfortunately the proposed solution don't work for me.

If I enter either of the following lines to user profiles or to NewUserTemplate, the user looses the edit rights for his own profile page:

• • Set ALLOWTOPICCHANGE = %USERSWEB%.%TOPIC%
  • Set ALLOWTOPICCHANGE = %WIKIUSERNAME%

It works if I use the explicit user name:

• • Set ALLOWTOPICCHANGE = Main.JohnDoe

I have checked the files on OS level for illegal characters or invalid permissions.

By the way: WIKIUSERNAME resolves to the currently logged in user, so USERSWEB.TOPIC sounds more plausible to me, and it resolves correctly to JohnDoe.

I have scratched my head now for several hours, I even started thinking, but to no avail...

Can anybody give me some hints?

Thank you very much in advance,

Thomas

-- ThomasGutzmann - 2012-08-29

Discussion and Answer

I do not recommend to lock down user profile pages, it goes against the wiki spirit. See TWikiAccessControl.

Only certain variables get expanded by default when instantiating a topic based on a template topic. There is control over that, see TWikiTemplates.

Variables get expanded at topic view time as part of the rendering process. Checking for access control is done separately, and not all variables are expanded. That is, you have some limitations in using variables in access control settings.

One more note: No need to prefix the web name if you are in the same web. That is, user profile pages reside in the Main web, so you can omit the web name when setting the access control on a user profile page.

-- PeterThoeny - 2012-08-29

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.