From f5ba791fea7c4933dbb7b548bb63d5631d01495a Mon Sep 17 00:00:00 2001 From: Simon Urli Date: Thu, 17 Jun 2021 09:49:26 +0200 Subject: [PATCH] XWIKI-17533: Allow to set custom rights in administration (#1644) * Provide a new API to retrieve all rights names in SecurityAuthorizationScriptService * Provide a new administration section to configure the custom rights * Edit rightsUI.vm to allow customize custom rights, without breaking the existing rights and UIs mechanisms --- .../XWiki/AdminExtensionRightsSheet.xml | 301 ++++++++++++++++++ .../resources/XWiki/AdminTranslations.xml | 1 + .../src/main/resources/flamingo/rightsUI.vm | 37 ++- .../SecurityAuthorizationScriptService.java | 12 + 4 files changed, 341 insertions(+), 10 deletions(-) create mode 100644 xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminExtensionRightsSheet.xml diff --git a/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminExtensionRightsSheet.xml b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminExtensionRightsSheet.xml new file mode 100644 index 000000000000..890442c805a8 --- /dev/null +++ b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminExtensionRightsSheet.xml @@ -0,0 +1,301 @@ + + + + + + XWiki + AdminExtensionRightsSheet + + + 0 + xwiki:XWiki.Admin + Main.WebHome + xwiki:XWiki.Admin + xwiki:XWiki.Admin + 1.1 + AdminExtensionRightsSheet + + false + xwiki/2.1 + true + {{velocity}} +### Sheet used to generically display the XWikiPreferences object fields in the administration sheets. +{{html}} + <form method="post" action="$xwiki.getURL($currentDoc, 'saveandcontinue')" class="xform"> + ############################################################################################ + ## RIGHTS + ############################################################################################ + <fieldset> + #template('rightsUI.vm') + </fieldset> + </form> +{{/html}} +{{/velocity}} + + XWiki.AdminExtensionRightsSheet + 0 + XWiki.ConfigurableClass + bad3af00-4a01-48b8-94ca-2111b758d219 + + XWiki.ConfigurableClass + + + + + + + + + + 0 + + categoryIcon + 11 + 0 + categoryIcon + 30 + 0 + + + com.xpn.xwiki.objects.classes.StringClass + + + VelocityWiki + + 0 + --- + + codeToExecute + 7 + 0 + codeToExecute + 5 + 40 + 0 + + + com.xpn.xwiki.objects.classes.TextAreaClass + + + 0 + + + + 0 + input + + + + 0 + 0 + configurationClass + 3 + 1 + configurationClass + 0 + + + 30 + none + + 0 + + + + com.xpn.xwiki.objects.classes.PageClass + + + + + 0 + checkbox + + + configureGlobally + 4 + configureGlobally + 0 + + + com.xpn.xwiki.objects.classes.BooleanClass + + + + 0 + + displayBeforeCategory + 10 + 0 + displayBeforeCategory + 30 + 0 + + + com.xpn.xwiki.objects.classes.StringClass + + + + 0 + + displayInCategory + 9 + 0 + displayInCategory + 30 + 0 + + + com.xpn.xwiki.objects.classes.StringClass + + + + 0 + + displayInSection + 1 + 0 + displayInSection + 30 + 0 + + + com.xpn.xwiki.objects.classes.StringClass + + + + 0 + + heading + 2 + 0 + heading + 30 + 0 + + + com.xpn.xwiki.objects.classes.StringClass + + + + 0 + + iconAttachment + 8 + 0 + iconAttachment + 30 + 0 + + + com.xpn.xwiki.objects.classes.StringClass + + + + 0 + + linkPrefix + 5 + 0 + linkPrefix + 30 + 0 + + + com.xpn.xwiki.objects.classes.StringClass + + + 0 + + + 0 + input + + + 0 + 1 + propertiesToShow + 6 + 0 + propertiesToShow + 1 + + ,| + 20 + none + 0 + + + + com.xpn.xwiki.objects.classes.StaticListClass + + + + 0 + + sectionOrder + 12 + integer + sectionOrder + 30 + 0 + + + com.xpn.xwiki.objects.classes.NumberClass + + + + + + + {{include reference="XWiki.AdminExtensionRightsSheet" /}} + + + + + + 1 + + + + + + usersgroups + + + usersgroups.extensionrights + + + + + + + + + + + + + + + 375 + + + diff --git a/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminTranslations.xml b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminTranslations.xml index b638824973a1..d26e063ec333 100644 --- a/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminTranslations.xml +++ b/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/AdminTranslations.xml @@ -140,6 +140,7 @@ administration.section.users.deleteUser.newAuthor.hint=Select an user that has { administration.section.users.deleteUser.newAuthor.error=The selected user doesn''t have {0} rights! administration.section.users.deleteUser.newAuthor.programming=programming administration.section.users.deleteUser.newAuthor.script=script +admin.usersgroups.extensionrights=Extension Rights # Other Category admin.other=Other diff --git a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/rightsUI.vm b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/rightsUI.vm index 618973d623db..63077b3690df 100644 --- a/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/rightsUI.vm +++ b/xwiki-platform-core/xwiki-platform-flamingo/xwiki-platform-flamingo-skin/xwiki-platform-flamingo-skin-resources/src/main/resources/flamingo/rightsUI.vm @@ -40,23 +40,37 @@ $xwiki.ssfx.use('js/xwiki/usersandgroups/usersandgroups.css', true) $xwiki.jsfx.use('js/xwiki/table/livetable.js', true) $xwiki.ssfx.use('js/xwiki/table/livetable.css', true) ## for admin, register, programming and createwiki, allow preceedes over deny -#if("$!request.section"=='wikis.rights') +#set ($standardRights = ['view', 'comment', 'edit', 'script', 'delete', 'admin', 'register', 'programming', 'login', + 'createwiki']) +#set ($sectionWikiRights = 'wikis.rights') +#set ($sectionExtensionRights = 'usersgroups.extensionrights') +#set ($isStandardRights = false) +#if("$!request.section"==$sectionWikiRights) #set ($rightsLevels = {'createwiki': 0}) #set ($allowWins = [0]) -## This should be changed in the future to include dynamically registered rights. -#elseif ($services.security.authorization.isRightRegistered('like')) - #set ($rightsLevels = {'view': 0, 'like': 1, 'comment': 2, 'edit': 3, 'script': 4, 'delete': 5, 'admin': 6, 'register': 7, 'programming': 8}) - #set ($allowWins = [5, 6, 7]) +#elseif ("$!request.section"==$sectionExtensionRights) + #set ($allRights = $services.security.authorization.allRightsNames) + #set ($rightsLevels = {}) + #set ($allowWins = []) + #set ($index = 0) + #foreach ($right in $allRights) + #if (!$standardRights.contains($right)) + #set ($discard = $rightsLevels.put($right, $index)) + #set ($discard = $allowWins.add($index)) + #set ($index = $index + 1) + #end + #end #else #set ($rightsLevels = {'view': 0, 'comment': 1, 'edit': 2, 'script': 3, 'delete': 4, 'admin': 5, 'register': 6, 'programming': 7}) #set ($allowWins = [5, 6, 7]) + #set ($isStandardRights = true) #end #set ($levelsRights = {}) #foreach ($r in $rightsLevels.keySet()) #set ($discard = $levelsRights.put($rightsLevels.get($r), $r)) #end #set ($maxlevel = $rightsLevels.get('delete')) ## Default: view, comment, edit, script, delete -#if("$!request.section"=='wikis.rights') +#if("$!request.section"==$sectionWikiRights) #set ($maxlevel = $rightsLevels.get('createwiki')) #set ($clsname = 'XWiki.XWikiGlobalRights') #else @@ -82,7 +96,9 @@ $xwiki.ssfx.use('js/xwiki/table/livetable.css', true) #set ($clsname = 'XWiki.XWikiRights') #end #end - +#if ("$!request.section"==$sectionExtensionRights) + #set ($maxlevel = $index - 1) +#end ## Get rights allowed for the current user #set ($currentAllowed = {}) #foreach ($i in [0..$maxlevel]) @@ -235,7 +251,8 @@ $xwiki.ssfx.use('js/xwiki/table/livetable.css', true) ## Global settings: mandatory authentication for view/edit, captcha #set ($guest_comment_captcha_prop = $targetDocument.getObject('XWiki.XWikiPreferences').getxWikiClass().get('guest_comment_requires_captcha')) - #if (("$!request.editor" == 'globaladmin' || "$!editor" == 'globaladmin' || $guest_comment_captcha_prop) && $request.section != 'wikis.rights') + #if (("$!request.editor" == 'globaladmin' || "$!editor" == 'globaladmin' || $guest_comment_captcha_prop) + && $isStandardRights)
#if ("$!request.editor" == 'globaladmin' || "$!editor" == 'globaladmin') #set ($auth_view = $targetDocument.getObject('XWiki.XWikiPreferences').getProperty('authenticate_view').getValue()) @@ -342,11 +359,11 @@ $xwiki.ssfx.use('js/xwiki/table/livetable.css', true) $('unregistered').removeClassName('hidden'); } }); - #if("$!editor" == 'globaladmin' && $request.section != 'wikis.rights') + #if("$!editor" == 'globaladmin' && $isStandardRights) Event.observe($('authenticate_view'), 'click', setBooleanPropertyFromLiveCheckbox($('authenticate_view'), '$xwiki.getURL('XWiki.XWikiPreferences', 'save', "form_token=$!{services.csrf.getToken()}")', 'XWiki.XWikiPreferences', 0)); Event.observe($('authenticate_edit'), 'click', setBooleanPropertyFromLiveCheckbox($('authenticate_edit'), '$xwiki.getURL('XWiki.XWikiPreferences', 'save', "form_token=$!{services.csrf.getToken()}")', 'XWiki.XWikiPreferences', 0)); #end - #if($guest_comment_captcha_prop && $request.section != 'wikis.rights') + #if($guest_comment_captcha_prop && $isStandardRights) Event.observe($('guest_comment_requires_captcha'), 'click', setBooleanPropertyFromLiveCheckbox($('guest_comment_requires_captcha'), '$targetDocument.getURL('save', "form_token=$!{services.csrf.getToken()}")', 'XWiki.XWikiPreferences', 0)); #end return true; diff --git a/xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-script/src/main/java/org/xwiki/security/authorization/script/SecurityAuthorizationScriptService.java b/xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-script/src/main/java/org/xwiki/security/authorization/script/SecurityAuthorizationScriptService.java index 1fe63a57f39b..206bf06d0fcc 100644 --- a/xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-script/src/main/java/org/xwiki/security/authorization/script/SecurityAuthorizationScriptService.java +++ b/xwiki-platform-core/xwiki-platform-security/xwiki-platform-security-script/src/main/java/org/xwiki/security/authorization/script/SecurityAuthorizationScriptService.java @@ -19,6 +19,8 @@ */ package org.xwiki.security.authorization.script; +import java.util.List; + import javax.inject.Inject; import javax.inject.Named; import javax.inject.Singleton; @@ -159,4 +161,14 @@ public boolean isRightRegistered(String rightName) { return Right.toRight(rightName) != Right.ILLEGAL; } + + /** + * @return all the registered rights names. + * @since 13.5RC1 + */ + @Unstable + public List getAllRightsNames() + { + return Right.getAllRightsAsString(); + } }