Contents

  1. allow 'admins' to delete/overwrite attachments?
  2. Disallow removal of own admin permission
  3. Is it possible to disable read on ALL pages except login?
  4. Why is block all except login possible with the following scenario?
  5. Administrating ACLs is cumbersome
  6. You can't change ACLs on this page since you have no admin rights on it!
  7. Lost Admin Rights?
  8. attachments only for certain users
  9. Project group members need permission to create new group pages?
  10. How to change a protected page into a non protected page
  11. Adding Myself As An Administrator
  12. How to prevent user-creation?
  13. Adding users
  14. How do I set the limit on the size of attachments?
  15. Prevent Editing When Not Logged In
  16. Disable overwriting attachments for common users
  17. Changing ACL-Rights on user-created pages without giving every user ACL-'admin' rights on the whole Wiki?
  18. Cannot get AutoAdmin to work
  19. Also cannot get AutoAdmin to work
  20. NewPage macro + ACL = You are not allowed to edit this page
  21. Groups in ACL are ignored
  22. Groups are ignored in ACLs
  23. After upgrade to 1.9.2, from 1.8.1, acl_hierarchic does not work the same
  24. Is it possible to have a password prompt on page approval?

allow 'admins' to delete/overwrite attachments?

At the moment only superadmins are allowed to delete or overwrite attachments on our page, is there any way to configure a 1.8 moinmoin to make this possible for normal admins/special usergroups? Tried several searches here on that theme but wasnt very successfull as it seems.

Disallow removal of own admin permission

Users often make mistakes editing ACL strings and inadvertantly change the page permission such that they cannot revert the change. There should be a configuration option disallow removal of your own read/write/admin permission on a page. Or maybe a confirmation dialog warning them that they are about to remove their own permission from the page. -- VitaliyShchupak 2008-07-20 11:48:22

Is it possible to disable read on ALL pages except login?

I want to prevent viewing of every single page (all, even the help pages) in my wiki. Users in a certain group will be able to view pages after logging in. The problem is that many pages (Help, recent changes, etc...) specify read for All in their ACL. The only way to override that is to specifly no privs for All in acl_rights_before, but then that would block everyone from the login page too. The FAQ above for closed community says to use acl_rights_default and set All : blank, but that won't stop people from seeing help and recent changes. Is there any way to do this other than to edit every page in the system to remove the All : read line?

(!) System / Help page ACLs were changed in moin 1.7 (they just take away "write" rights now and otherwise use Default ACLs. So if you change your default ACL, the change is also implemented by the system / help pages.

Why is block all except login possible with the following scenario?

In MoinMoin ver. 1.6.0, with acl_hierarchic = True and acl_rights_after = u"All:", the above (block all pages except login) is accomplished. We have acl_rights_before set to allow a specific admin group all privileges, and acl_rights_default set to allow a user group read,write,delete,revert. Only users in either the admin or user groups can view pages at all. My question is, why does this work? Is it a bug or a feature?

Administrating ACLs is cumbersome

Here's what I want to do. I want a certain user to be able to manage ACLs for a certain area of the wiki... say everything under a certain page. Without any hierarchical access control scheme, I can't just give him admin rights to the top page and let him go. It means that every single page he creates that needs any sort of access control, I have to go and manually add them to each page ONE AT A TIME! This is not only an annoyance for me, it also slows him down.

So I came up with an Idea I thought might work... Create a template that contains an ACL line giving this author admin rights, and restricting read rights so that only he has access to that template. I thought this might allow him to create pages by basing them off of this template. But alas, it appears that creating a page from a template amounts to a cut and paste of the text from the template, so non-admin types are not allowed to "add" the ACL's to the new page (even though they were already granted in the template).

Does anyone know of a way to give someone the ability to create certain pages with them as an admin, but without giving them admin rights to the entire wiki? -- SteveDavison 2007-03-01 22:03:43

You can't change ACLs on this page since you have no admin rights on it!

I get this error msg when I try and save a newpage w/ ACL's on it and I the TrustedGroup has admin rights to both.

Here's the ACLs on the page #acl TrustedGroup:read,write,delete,revert,admin

Here's the ACLs on the template for the new pages created by this group #acl TrustedGroup:read,write,delete,revert,admin

the result is the new pages fail to save w/ this error You can't change ACLs on this page since you have no admin rights on it!

thanks in advance

--Andrew

Lost Admin Rights?

I think I'm in over my head. I am completely new to wikis. But yesterday I set up a wiki page and specified myself as the administrator. I then set up a users page, and I went to edit one of the names I listed, and it said "You are not allowed to change this page." I can't figure out what happened. Thank you -- Laura 19 Dec 06

attachments only for certain users

Is it possible to finetune ACL to allow anonymous and new registered users to edit the page but WITHOUT the permission to add attachments. and add an ACL rule to each user that should be allowed to add attachments. thank you for your responds. HatschMa 01/12/2006

Not with a standard moin, it just uses the page ACLs for the page's attachments. For moin 1.5 you could patch AttachFile.py to not check for "write" rights, but for "attachwrite" right and add that right to the valid ACLs list. In some future moin version (not 1.6), file attachments will be first class items with own ACLs.

Project group members need permission to create new group pages?

I set up some independent groups, each one with it's own adminstrator. The default permissions permit Known users to read/write/edit but not admin for default pages. I set up templates for each group that allow the group to read/write/edit their pages and their admin user to read/write/edit/admin. I find that the group users get a "you can't change the permission of this page" when they try to create a new page using the group template. Is there a trick here to make that work? Is that what AutoAdmin is for?

Many thanks in advance for your help.

How to change a protected page into a non protected page

In my local wiki (MoinMoin Version 1.5.2 on IRIX64) the page WikiSandBox is a protected page ("Geschützte Seite"). Even though I have administrator rights I did not found a way so that any user can experiment with this page. What can I do to change the status of this page?

#format wiki #language en (...)}}}

I made some tests varying owner and file permissions but had no success. It remains protected. I solved the problem for me by copying the directory WikiSandBox manually from underlay/pages into the data/pages directory and changed its file permissions according to other files in this directory.

Beside my special problem I have some difficulties in understanding the general concept of the underlay directory. I understand that pages in this directory are normally read-only and should not be altered by users. There are only few exceptions like e.g. the WikiSandBox. But what do you have to do when you like to change such a page (in a perfect installed wiki setup). How do you change the state of a page from "protected" to "non-protected"?

Adding Myself As An Administrator

I just installed the latest stable version of Moin on FreeBSD + Apache in my $HOME directory on a shared web server. Everything is working very well except for the fact that I can't act as an administrator in my wiki.

I found the MoinMoinQuestions/Administration "How To Become An Administrator", and followed its directions. First, I registered with the site using a username of TomPurl. I then checked the $INSTANCE/data/user directory and made sure that the TomPurl username existed. I then added the following line to $INSTANCE/wikiconfig.py: 

acl_rights_before = u"TomPurl:read,write,delete,revert,admin"

I then logged into Firefox, but was unable to delete, rename, or add attachments to pages. To troubleshoot, I deleted all of my cookies and then logged in again. Still, no luck. I've even restarted Apache.

Can anyone else think of something that I could try to get this to work?

Thanks! - TomPurl 

allowed_actions = ['DeletePage', 'AttachFile', 'RenamePage']

in your wikiconfig.py -- ReimarBauer 2005-12-30 18:19:39

How to prevent user-creation?

I don't want to have any users except me. I'm running Version 1.5.0beta4, so that http://moinmoin.wikiwikiweb.de/FeatureRequests/NewUserCreationACL won't run. (i tried everything, but i didn't get it)

Adding users

I'm doing a wiki page for a company. My boss will be the admin, got all the rights etc. This wiki will not be edited by unknown people, only the users that my boss allow. How do the admin add the users to a group or what? Thanks.~

Do read HelpOnAccessControlLists

How do I set the limit on the size of attachments?

MoinMoin does not offer this facility, but if you use apache >= 1.3.2 then you might like to look at the LimitRequestBody directive

Prevent Editing When Not Logged In

I've searched and searched for how to do this, but can find nothing. I think the ability exists, since I have seen mention in several other questions of someone not being able to edit a page because they are not logged in. Are there instructions anywhere that describe how to configure MoinMoin to require login for edits? Thanks. --SteveDavison

Disable overwriting attachments for common users

Common users (anonymous and logged in) can't delete attachments, only administrators can do that. Which is good, because these changes can't be reverted. But I found out that anonymous users can overwrite attachments with whatever they want, it's enough to check "Overwrite existing attachment of same name" checkbox (moinmoin 1.5.7). This way evil anonymous users can destroy all my images/other attachments on my wiki in a few minutes, and I cannot revert it. How can I disable overwriting feature for non-admins? --Kamil

Changing ACL-Rights on user-created pages without giving every user ACL-'admin' rights on the whole Wiki?

I want to make it possible for normal Users to set ACL write-permission only for themselves on their pages, to create a simple Character-Database ( http://mylairexil.de/wiki/CharakterSeiten ) is this possible without giving every ACL-'admin' rights for the whole wiki, and without intervention of an Admin or TrustedUser on every Charpage?

You should define "their" pages. Moin does not have the concept of page "owner". However, if you to give write access to sub pages of the user page, you can do this with a custom security policy. Subclass MoinMoin.security.Permissions, and define a write method that check the current page name against the current user name and allow only the user to write on his sub pages ignoring the page ACL. See SecurityPolicy for more info.

Version 1.5 has autoadmin security policy that give admin rights to user pages, but it is not recommended for common users, because they will not be able to set ACL correctly. see HelpOnAutoAdmin.

Cannot get AutoAdmin to work

I want to enable users the ability to setup their Homepage using the HomepageTemplate with a pre-defined ACL. To do this they need 'admin' rights. I am using AutoAdmin and below is what I did

  1. Added the following line to wikiconfig.py, using Moin version 1.6.1

from MoinMoin.security.autoadmin import SecurityPolicy

  1. Created AutoAdminGroup page

  2. Added usernames to the AutoAdminGroup page which should enable these users 'admin' rights

But it does not seem to enable 'admin' rights. Am I missing something, can you help?

Kim Tran - 2024-04-19 11:56:26

Also cannot get AutoAdmin to work

The HelpOnAutoAdmin page is woefully inadequate. It mentions things but does not explain them fully or even tell you what they do.

Are page/ReadGroup and page/ReadWriteGroup supposed to work on projects as well as users? And how do you get them to work?

I can only assume that if a user is in ReadGroup or ReadWriteGroup that they are able to read all subpages by default, and the ReadWriteGroup also can edit. But I set up the ReadGroup and ReadWriteGroup pages with nothing in them, and I can still see and edit all of the subpages. Do I have to add ReadGroup, etc., to the AutoAdminGroup page as well as the page/AdminGroup in order to activate them?

HelpOnAutoAdmin mentions that you can set up project/ReadGroup, project/ReadWriteGroup, etc., but doesn't say what the "etc." includes. Can I create a project/RevertGroup or project/DeleteGroup? Or what about a WriteRevertGroup?

And another thing that needs explanation is, how exactly do these groups affect the ACL's of a page? Is it sort of like an automatic #acl +ReadGroup:read +ReadWriteGroup:read,write +AdminGroup:admin added to each subpage? If the subpage has its own ACL line, does this prevent the AutoAdmin ACLs from working (i.e., do the automatic rights work like "default", "before", or "after" ACL rights?

Oh, I should mention that I'm using version 1.5.8; I checked the latest HelpOnAutoAdmin and it seems to be identical to the 1.5.8 page, so I assume there haven't been significant changes since.

Thanks for any help... -- SteveDavison 2008-07-03 04:52:36

NewPage macro + ACL = You are not allowed to edit this page

I am using Moin 1.7 and am trying to set it to use the NewPage macro to make structured page creation easier on the users. I also have ACL's (hierarchic, if this matters) enabled. Now a certain user belonging to a certain group can easily create sub pages, perform edits, and do what they need to do. However, when they try to perform this task through the NewPage macro they get an error that says "You are not allowed to edit this page." As I have said before, creating this page and loading the proper template by hand works just fine. I don't know if this is the proper avenue to have this question answered but any help would be appreciated.

Cameron

Groups in ACL are ignored

Just updated from 1.5.5a to 1.7.1. To be more precise, old wiki was on Windows server with IIS and CGI. Then I installed 1.7.1 on Linux machine with Apache and fastcgi. Copied ./data, removed cache, removed all old macros, parsers and themes, performed pages migration. I took wikiconfig.py from the new distro and updated it accordingly.

I have very tight security policy with lots of groups. Now after upgrade only users who are specified explicitly in acl_rights_before, acl_rights_default or in a page's ACL get proper authorization. If user is the member of some group then he doesn't get authorized despite this group being mentioned in ACL. Look like group membership is just ignored.

I've tried switching acl_hierarchic off, searched through this site, read CHANGES and MIGRATION documents, looked in the sources, but still can't find the cause of the problem.

2008-08-12 05:49:07 

# -*- coding: utf-8 -*-
from MoinMoin.config.multiconfig import DefaultConfig
class Config(DefaultConfig):
    sitename = u'Ext.Wiki'
    logo_string = u'<img src="/moin_static171/common/moinmoin.png" alt="MoinMoin Logo">'
    html_head = '''<link rel="shortcut icon" href="/moin_static171/favicon.ico">'''
    page_front_page = u"FirstPage"
    data_dir = '/db/extwiki/data/'
    data_underlay_dir = '/db/extwiki/underlay/'
    url_prefix_static = '/moin_static171'
    superuser = [u"AlexanderAgibalov", u"GrigoryBaytsur"]
    acl_rights_before = u"AlexanderAgibalov:read,write,delete,revert,admin +MxGroup:read,write"
    acl_rights_default = u"AlexanderAgibalov,MxGroup:read,write,delete,revert,admin Known,All:none"
    acl_hierarchic = True
    surge_action_limits = None # disable surge protection
    navi_bar = [
        u'%(page_front_page)s',
        u'RecentChanges',
        u'FindPage',
        u'HelpContents',
    ]
    theme_default = 'modern'
    language_default = 'en'

    #page_category_regex = u'^Category[A-Z]'
    page_category_regex = ur'(?P<all>Category(?P<key>\S+))'
    page_dict_regex = u'[a-z]Dict$'
    page_form_regex = u'[a-z]Form$'
    page_group_regex = u'[a-z]Group$'
    page_template_regex = u'[a-z]Template$'

    show_hosts = 1

Remove the old rules or use the new syntax for 

 page_dict_regex = u'[a-z]Dict$'
 page_form_regex = u'[a-z]Form$'
 page_group_regex = u'[a-z]Group$'
 page_template_regex = u'[a-z]Template$'

see * HINT: page_*_regex processing had to be changed to fix category search. in the CHANGES file or look into MoinMoin.config.multiconfig. e.g. 

    page_category_regex =  ur'(?P<all>Category(?P<key>(?!Template)\S+))'
    page_dict_regex = ur'(?P<all>(?P<key>\S+)Dict)'
    page_group_regex = ur'(?P<all>(?P<key>\S+)Group)'
    page_template_regex = ur'(?P<all>(?P<key>\S+)Template)'

you can remove the vars completly if they are the defaults. -- ReimarBauer 2008-08-14 09:05:37

Note that this doesn't make too much sense: 

    acl_rights_before = u"AlexanderAgibalov:read,write,delete,revert,admin +MxGroup:read,write"
    acl_rights_default = u"AlexanderAgibalov,MxGroup:read,write,delete,revert,admin Known,All:none"

Reasons:

Thus, you maybe want this: 

    acl_rights_before = u"AlexanderAgibalov:read,write,delete,revert,admin +MxGroup:read,write"
    acl_rights_default = u"MxGroup:delete,revert,admin"

Groups are ignored in ACLs

2008-09-09 FrankSteinhauer
I have the same problem as AlexanderAgibalov (and Cameron) above - my Groups seem to be ignored. We're using MoinMoin 1.6.2.

From wikiconfig.py: 

    acl_rights_valid = ['read', 'write', 'delete', 'revert', 'admin', 'approve', 'review']
    acl_rights_before = u"my-admin,AdminGroup:read,write,delete,revert,admin,approve,review"
    acl_rights_default = u"Known:read,write,delete,revert All:read"

    #commented out the page_xxx_regex lines

Page TestApprovalGroup: (created by a member of the AdminGroup) 

#acl TestApprovalGroup:admin,read,write,delete,revert Known:read All:

=== All members of the ACL group "TestApprovalGroup" ===
 * SomeUser (part of the test department)

<<BR>>
----
~-this page belongs to the CategoryAdministratorSection-~

Now SomeUser is not allowed to change the page TestApprovalGroup. Furthermore, he's not able to create a new page and set any ACLs. This looks like a "feature", since he has no admin rights yet he's not allowed to give himself the admin rights - but still it's strange. Now I have to add all "XxxApprovalGroup"s to the acl_rights_before :-(

What is the approve right? Have you restarted the server process after removing the page_*_regex and do you have cleaned the dict cache? ReimarBauer/Photo/img.png -- ReimarBauer 2008-09-09 15:41:34

After upgrade to 1.9.2, from 1.8.1, acl_hierarchic does not work the same

The pertinent lines of my wikiconfig.py file are:
acl_rights_default = u"AdminGroup:read,write,delete,revert,admin DnDPlayersGroup:read DnDDMsGroup:read All:"
acl_hierarchic = True

I have a page called DnD, for which I want admins to have full rights and players and DMs to only be able to read. It has the ACL line:
#acl DnDDMsGroup:read DnDPlayersGroup:read

I have a child page called DnD/DMs, for which I want admins to have full rights, players none, and DMs to have read and write access. It has the ACL line:
#acl DnDDMsGroup:read,write DnDPlayersGroup:

I then have grandchild page DnD/DMs/DragonLance, for which I want admins to have full rights and players and DMs none. It has the ACL line:
#acl DnDDMsGroup:

Everyhing was working fine in 1.8.1. After the upgrade, admins can no longer access the child page nor the grandchild page. Oddly, players can access the grandchild page.

What happened?

Is it possible to have a password prompt on page approval?

I want to be able to prompt for a username and password when a user tries to approve a page or has updated/edited a page. Do you know if this is possible?

MoinMoin: MoinMoinQuestions/Permissions (last edited 2014-06-26 15:53:24 by RogerHaase)