Wiki source code of Rights Resolution
Last modified by Eleni Cojocariu on 2026/08/31 14:01
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
 |
2.1 | 1 | When a user tries to act on a page, XWiki does not read a single setting. It walks the rules that apply to that page and stops at the first one that decides. Knowing that order explains why a right granted in the wiki administration sometimes has no effect on a given page. |
| 2 | |||
| 3 | == The order in which rules are examined == | ||
| 4 | |||
| 5 | Rules are examined from the most specific level to the least specific one: first the rules set on the page itself, then those set on the space through "Rights: Page & Children", then those set on the wiki. The first level that determines the right decides, so a rule set on a page overrides a rule set on the wiki. | ||
| 6 | |||
| 7 | Within one level, a rule that names the user directly beats a rule that matches one of their groups, whether it allows or denies. When several rules of the same kind disagree, the conflict rule of the right settles it, and that rule is not the same for every right: [[Right Types>>doc:documentation.xs.admin.rights.right-types.WebHome]] gives it per right. | ||
| 8 | |||
| 9 | {{plantuml}} | ||
| 10 | @startuml | ||
| 11 | !theme bluegray | ||
| 12 | start | ||
| 13 | :A user asks to act on a page; | ||
| 14 | if (the superadmin account?) then (yes) | ||
| 15 | :Allowed; | ||
| 16 | stop | ||
| 17 | endif | ||
| 18 | repeat :Take the next level, most specific first:\nthe page, then the space, then the wiki; | ||
| |
4.2 | 19 | if (a rule set directly on the user?) then (yes) |
| |
2.1 | 20 | :That rule decides; |
| 21 | stop | ||
| 22 | endif | ||
| |
4.3 | 23 | if (rule set on a group the user belongs to?) then (yes) |
| |
2.1 | 24 | :The conflict rule of the right decides; |
| 25 | stop | ||
| 26 | endif | ||
| 27 | if (the right is allowed to someone else at this level?) then (yes) | ||
| 28 | :Denied; | ||
| 29 | stop | ||
| 30 | endif | ||
| 31 | repeat while (a less specific level remains?) is (yes) not (no) | ||
| 32 | :The default value of the right applies; | ||
| 33 | stop | ||
| 34 | @enduml | ||
| 35 | {{/plantuml}} | ||
| 36 | |||
| 37 | == Allowing a right denies it to everyone else == | ||
| 38 | |||
| 39 | At a given level, allowing a right to one user or group denies it to everyone that level does not mention. Granting "View" to one group on a page therefore hides that page from everyone else, without a single denial being set, and this implicit denial is the recommended way to restrict access. It covers only the right actually allowed: the rights that come with another right, such as the "View" implied by "Edit", are never implicitly denied. | ||
| 40 | |||
| |
5.1 | 41 | An explicit denial works the other way round: it refuses the right to the user or group it names and leaves everyone else inheriting whatever the levels above grant. Denying "View" to one group therefore closes the page to that group alone, which is why allowing the right to the few who need it restricts more reliably than denying it to the many who do not. |
| 42 | |||
| |
2.1 | 43 | The scope chosen when setting the right decides how far the implicit denial reaches. A right set through "Rights: Page" applies to that page alone, so its children keep inheriting the rules of the levels above. |
| 44 | |||
| 45 | == Rights that cannot be overridden == | ||
| 46 | |||
| 47 | "Admin", "Program" and "Creator" behave differently from the other rights: once one of them is allowed at any level, a denial set on a more specific space or page does not take it away. This is why an administrator of a wiki or of a space keeps their administration rights on every page it contains, together with the rights that "Admin" implies. | ||
| 48 | |||
| 49 | == When no rule applies == | ||
| 50 | |||
| 51 | A right that no rule determines falls back to its default value, listed in [[Right Types>>doc:documentation.xs.admin.rights.right-types.WebHome]]. One case does not follow that fallback: a user account defined in another wiki, who is not a global user, is denied everything by default. | ||
| 52 | |||
| 53 | == Accounts and pages that are treated apart == | ||
| 54 | |||
| 55 | The ##superadmin## account short-circuits every rights check. The owner of the main wiki always has "Program" right, and the owner of a subwiki always has "Admin" right on that wiki. The creator of a page is always granted the "Creator" right on it, which is what lets an author delete a page they created even though "Delete" is denied by default. | ||
| 56 | |||
| 57 | The pages that store the rights configuration, ##XWiki.XWikiPreferences## for a wiki and ##WebPreferences## for a space, are editable by administrators only, whatever the "Edit" rules say. Without that, a user allowed to edit everything could grant themselves any right. |
