Permissions settings of the webs on this TWiki site

Web	Sitemap	VIEW		CHANGE
	Listed	DENY	ALLOW	DENY	ALLOW
Main	on
TWiki06x01	on				TWikiAdminGroup
Blog	on			TWikiGuest
Codev	on			TWikiGuest
Plugins	on
Sandbox	on
Support	on
TWiki	on			TWikiGuest
TWiki01	on				TWikiAdminGroup
TWiki02	on				TWikiAdminGroup
TWiki03	on				TWikiAdminGroup
TWiki04	on				TWikiAdminGroup, CrawfordCurrie
TWiki04x01	on				TWikiAdminGroup
TWiki04x02	on				TWikiAdminGroup
TWiki04x03	on				TWikiAdminGroup
TWiki05x00	on				TWikiAdminGroup
TWiki05x01	on				TWikiAdminGroup
TWiki06x00	on				TWikiAdminGroup
WikiWed	on

See TWikiAccessControl for details

Please Note:

• A blank in the the above table may mean either the corresponding control is absent or commented out or that it has been set to a null value. The two conditions have dramatically different and possibly opposed semantics.
• TWikiGuest is the guest account - used by unauthenticated users.
• The TWiki web must not deny view to TWikiGuest; otherwise, people will not be able to register.

Related Topics: SiteMap, UserDocumentationCategory, AdminDocumentationCategory, AdminToolsCategory

---

Comments & Questions about this Distribution Document Topic

Using %SEARCH{"DENYWEBVIEW" ...}% results in returning an incomplete list of webs, as not all have that variable defined. I modified my installation to use ".*" and regex="on". I also changed web= to be %WEBLIST{separator=","}%, but I see the current version uses %URLPARAM{}, providing an added feature. (The two could be combined.) In any case, it seems like a bug to not list all webs, regardless of whether they are hidden or have NOSEARCHALL set, which is what happens when you depend on the magic 'all' web name. I also added a "No Search All" column, seeing as that is permission related, even if deprecated.

-- TomMetro - 22 Dec 2006

All WebPreferences topics are assumed to contain a DENYWEBVIEW setting, your change works also for non-standard topics. A web="all" lists all public webs (unless you are in the admin group where you see all webs.) This is done for security.

-- PeterThoeny - 23 Dec 2006

All WebPreferences topics are assumed to contain a DENYWEBVIEW setting...

That seems like a fragile assumption. The default preferences has that variable commented out, and it is not unreasonable to think that someone might delete the line if trying to create a minimal preferences page.

...your change works also for non-standard topics.

Is that a problem? The intent is to collect a comprehensive list of webs, so it shouldn't matter which topics happen to match the query.

A =web="all"= lists all public webs...This is done for security.

That's a valid point, but isn't %SEARCH{...}% documented as respecting access controls? Does that break if you explicitly tell it to search a web the user doesn't have access to? Or do you mean it breaks "security through obscurity" by violating the NOSEARCHALL preference and showing hidden (but viewable) webs?

(unless you are in the admin group where you see all webs.)

I was in the admin group, and yet I didn't see webs with the NOSEARCHALL preference set, like Sandbox and Trash.

-- TomMetro - 28 Dec 2006

1. I fixed SEARCH on this topic to look just for WebPreferences topic.

2. I fixed the code to show all webs for admins, Bugs:Item3381, svn 12429.

-- PeterThoeny - 03 Jan 2007

Please use the Support forum if you have questions about TWiki features. This comment section is about the documentation of this topic.