ACLs for system-pages

[sebix]

How can the pages

• /+admin/itemsize
• /+admin/interwikihelp
• /+admin/highlighterhelp
• /+wanteds
• /all
• /all/+history
• /all/+tags

be restricted by ACLs? They seem not be part of a namespace and are not restricted by acl_functions

[RogerHaase]

User Error, ignore comments below, ACLs work

Any item with an ACL that denies READ should not be present on any of the above reports.

I can reproduce the error when a 1.9 wiki is imported, but not when a wiki created as empty and populated with new items.

Editing an item on a wiki created with import19 results in correct behavior (the item is not displayed in the reports).

[sebix]

Any item with an ACL that denies READ should not be present on any of the above reports.

I'm not speaking about the items of the pages, but the pages themselves.

[UlrichB22]

When I try +admin as anonymous user I get a message similar to "Item names must not start with '+'".
When I try +admin/itemsize, I get the list of items with their sizes. This seems to be a bug. All admin pages should be limited to an admin user login.

For the other views maybe we can add configuration options. IMO this cannot be solved with ACL.

[UlrichB22]

With the above fix all '+admin' views are restricted to a superuser as configured in wikiconfig.py.

For the rest of your question, there is no feature to restrict the other views from being displayed.

[sebix]

Thanks!

[UlrichB22]

@sebix can we close this issue?

[UlrichB22]

The fix breaks the user view from the navigation bar. This is available for everybody and uses the view '+admin/user' and results in a 'You are not allowed to access this resource.' now.

I think this needs some refactoring and redesign. E.g. we can move

• /+admin/itemsize
• /+admin/interwikihelp
• /+admin/highlighterhelp

into the admin area only visible for an admin with login.

Any Ideas?

[RogerHaase]

imho we should back off the above fix because it breaks the user view.

If made a configuration option, I think a minority of wiki admins would restrict itemsize, interwikihelp, and highlighterhelp to superusers. So I would leave these as is until it can be refactored and added as a configuration option.

Long ago I considered merging the User view into the Admin view and showing/hiding sections based upon superuser status. This could be superuser status and a configuration option.

I would not change the usage of /all, /all/+history and /all/+tags because the output is protected by ACL rules