Question

Hello there,

I have set edited the Main Web preferences so that users who are not in AdminGroup cannot change topics. The problem I have now is that they cannot change theie own password or registration details as these topics belong to Main Web. They get the message "You do not have permission to change topic JoeBloke."

Also, when they click on the link ChangePassword they get a blank page.

Is there any way I can set up so that users can edit their own details but still prevented from editing all other topics from Main Web?

This is puzzling me for a while...

Thanks in advence.

Rio

Environment

-- RioMurata - 23 Nov 2005

Answer

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.

You could write protect each and every user home page with the user's WIKINAME. I do not recommend this setup since is not very wiki-like and hinders free form collaboration. It also sends the wrong message. It is better to rely on soft security.

-- PeterThoeny - 24 Nov 2005

Hello,

Sorry for not coming back here earlier.

I found that the problem I have here. When a user goes to his/her user page and clikc on the ChangePassowrd link, it goes to /Main/UserName (which displays blank bage) rather than /TWiki/UserName.

I'm wondering where to rectify this.

-- RioMurata - 13 Dec 2005

Sorry, in above I meant to say it goes to /Main/ChangePassword rather than /TWiki/ChangePassword

-- RioMurata - 13 Dec 2005

I disagree with Peter's assertion above.

While it may be reasonable for a free discusson web, there are many situations where it does not apply. At the very least, the reason we have login and often restrict write access to those logged in is for corporate policy on accountability.

Users have a reasonable expectation of privacy with respect to their own home pages. They expect them to be editable by themselves and to be protected from 'defacement' by others. The home pages are something 'personal' whereas the whiteboard of a general web is 'public'.

Write protecting the whole of the TWiki (i.e. system configuration & docuemtnation) web agaist defacement and alteration is reasonable, though in a cooperative development environment such as TWiki.org that isn't the case. The same argument applies to the Main web. Exceptions such as 'guest book' handling are discussed variously in this web.

All the commercial sites I deploy I do as you've suggested, Rio, and protected the Main web as a whole, then granted each individual the right to modify his or her own topic. I have never had users complain that they can't modify someone else's home topic

-- AntonAylward - 13 Dec 2005

I understand Anton's point of view. he is from the IT world where control is very important. Hence the urge to lock things down.

The TWiki sites I setup and maintain behind corporate firewalls have a wide open Main web. I have seen that people like to cross post on other user's home pages. A large search engine company for example encourages all new employees to register in their TWiki and post the resume on their TWiki home page so that people of similar interests can find each other. Home pages also contain comment boxes for other folks to share their thoughts.

So, I think it is better keep the user home pages open and to rely on soft security. This fosters collaboration and sends the right message of sharing knowlege openly; away from the IT world of locking things down.

-- PeterThoeny - 14 Dec 2005

It seems like two distinctly different culture meeting here. I think it all depends on what kind of people are involved in each of the collaboration environment. I will adopt the soft approach to begin with and update the rights issue as and when the need arises.

Still, one think I have to address here is the fact that ChangePassword link on the generated user detail page is linked to /Main/ChangePassword rather than /TWiki/ChangePassword, producing an empty page. How could I correct this?

-- RioMurata - 15 Dec 2005

That is a small bug. Please fix the link in your TWiki.NewUserTemplate

-- PeterThoeny - 15 Dec 2005