Wiki source code of Rights Storage
Last modified by Eleni Cojocariu on 2026/08/31 19:11
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | The [[rights grid>>documentation.xs.admin.rights.set-page-rights.WebHome]] of the administration is an editor for [[XObjects>>doc:documentation.xs.dev.data-model.x-objects.WebHome]] stored on the wiki pages themselves. Knowing which page holds which object explains why a rule that a page really carries is sometimes absent from the grid, and why the rights of a page stop applying once it is moved to another wiki. | ||
| 2 | |||
| 3 | {{image reference="rights-object-levels.png" size="large" alt="The XWikiRights object of a page in the object editor, with its Levels, Users and Allow properties"/}} | ||
| 4 | |||
| 5 | == Where each level is stored == | ||
| 6 | |||
| 7 | |=Level|=Page holding the objects|=Class | ||
| 8 | |The whole wiki|##XWiki.XWikiPreferences##|##XWiki.XWikiGlobalRights## | ||
| 9 | |A page and its children|the ##WebPreferences## page of that page|##XWiki.XWikiGlobalRights## | ||
| 10 | |A page alone|the page itself, which is ##WebHome## unless the page is terminal|##XWiki.XWikiRights## | ||
| 11 | |||
| 12 | Only those combinations are read. An ##XWiki.XWikiRights## object placed on a ##WebPreferences## page applies to that configuration page alone, which no reader opens, and an "Admin" level inside an ##XWiki.XWikiRights## object is ignored because "Admin" cannot be set on a single page, as [[Right Types>>doc:documentation.xs.admin.rights.right-types.WebHome]] lists. | ||
| 13 | |||
| 14 | Two of those three pages are ~[~[hidden]], ##XWiki.XWikiPreferences## and every ##WebPreferences## page, so no link of the wiki leads to them and their objects cannot be reached by browsing. They are opened by asking for the object editor in their address: ##/bin/edit/XWiki/XWikiPreferences?editor=object## for the wiki, and the path of a page followed by ##/WebPreferences?editor=object## for that page and its children, as in ##/bin/edit/Sandbox/WebPreferences?editor=object##. The objects of a page itself need no such address, since the "Edit" menu of that page offers an "Objects" entry. | ||
| 15 | |||
| 16 | == Why the grid does not show every rule == | ||
| 17 | |||
| 18 | The grid does not read directly from the stored rules. Instead, it builds itself from two things: the accounts that exist on the wiki, and the rights the administrator viewing it happens to have. Because of this, a rule can be active and enforced while the grid shows nothing about it: | ||
| 19 | |||
| 20 | * A column is displayed only for a right that the administrator holds themselves. An administrator without "Script" right sees no "Script" column, and the rules granting it stay out of reach. | ||
| 21 | * A row is displayed only for a user or a group that exists on the wiki. The grid lists the accounts and looks up their rules, never the other way round. | ||
| 22 | * On a subwiki the accounts of the main wiki are listed only once the scope is changed, as [[Set the Rights of a Wiki>>doc:documentation.xs.admin.rights.set-wiki-rights.WebHome]] describes. | ||
| 23 | |||
| 24 | == A rule pointing to an account that no longer exists == | ||
| 25 | |||
| 26 | XWiki never checks whether the user or group named in a rule actually exists, and the rule still applies even if it doesn't. Such a rule matches nobody directly, but because allowing a right to someone implicitly denies it to everyone else at that level (see [[Rights Resolution>>path:/xwiki/bin/view/documentation/xs/admin/rights/rights-resolution/]]), it can **quietly lock everyone out**. A page whose only rule grants "View" to a missing account ends up readable by no one, and its grid will show no rule at all, since there's no row to display it on. | ||
| 27 | |||
| 28 | This can't happen from a normal account deletion: XWiki automatically removes an account from every rights object, on every wiki, when that account is deleted. So if a rule points to a name that resolves to nothing, that account was never really an account of this wiki, but rather came from an import, a migration, or a typo. | ||
| 29 | |||
| 30 | == References are relative to the wiki of the page == | ||
| 31 | |||
| 32 | A rule stores the [[reference>>documentation.xs.user.base.page.linking-references.WebHome||anchor="PageReferences"]] to a user or group as text. When that reference has no wiki prefix, for example just XWiki.Jane, (not xwiki:XWiki.Jane), XWiki reads it relative to the wiki the //page// is on, not the wiki the account is on. So if you [[move the page>>doc:documentation.xs.user.base.page.operations-refactor.move-rename.WebHome]] to another wiki, its rules now point to accounts on the //new// wiki, accounts that usually don't exist there. The rule doesn't disappear; it just stops matching anyone. | ||
| 33 | |||
| 34 | To fix this, you need to prefix the reference with the wiki that actually owns the account, for example, ##xwiki:XWiki.Jane## for an account on the main wiki. That way the rule keeps working no matter where the page moves. | ||
| 35 | |||
| 36 | Note that these are two different situations. If you rename or move the user's or group's own account page, XWiki automatically updates every rule that referenced it, on every wiki. But if you move a page that simply contains a rights rule, leaving the account itself completely untouched, nothing gets updated automatically, and the references are left for you to fix by hand. |
