MoinMoin: FeatureRequests/MissingPageForNotAuthorized

Short description

I use MoinMoin as a CMS-like system. Users who are not authorized to edit/create a new page that browse a non existing page should see an error document without a link to create that page.

Therefore I've create a patch to have a new page called "MissingPageNotAllowed". If it doesn't exist, it uses the MissingPage as a fallback.

The patch is for MoinMoin 1.8.0

--- occuris/hlgeist.de/dev2/site-packages/MoinMoin/Page.py      2008-12-13 11:35:08.000000000 +0100
+++ genetsis/hlgeist/hlgeist.de/shared/site-packages/MoinMoin/Page.py   2009-08-08 19:30:36.000000000 +0200
@@ -1370,8 +1370,12 @@
             if request.user.valid and request.user.name == self.page_name and \
                request.cfg.user_homewiki in ('Self', request.cfg.interwikiname):
                 page = wikiutil.getLocalizedPage(request, 'MissingHomePage')
-            else:
+            elif request.user.may.write(self.page_name):
                 page = wikiutil.getLocalizedPage(request, 'MissingPage')
+            else:
+                page = wikiutil.getLocalizedPage(request, 'MissingPageNotAllowed')
+                if not page.exists():
+                    page = wikiutil.getLocalizedPage(request, 'MissingPage')
 
             alternative_text = u"'''<<Action(action=edit, text=\"%s\")>>'''" % _('Create New Page')
         elif special_type == 'denied'

The code still works for version 1.9.3 but the line numbers are different. Also, to return a real 404 you can do:

+                page = wikiutil.getLocalizedPage(request, 'MissingPageNotAllowed')
+                request.status_code = 404

or similar.

Another approach is to use a Theme and some fancy div work to obfuscate the MissingPage contents. This has the advantage of not requiring a patch but it does require a little more code. The method is fairly simple - when the page does not exist and the user is not logged in, wrap the main #Page div with a div with style="display: none;"

You could just alter the html_stylesheets function to conditionally add an inline css that hides divs but that wouldn't allow you to put in a message.

I did a basic if verbose implementation of this in a function added to a theme's .py.

   1 def hide404(self, d):
   2         """ Assemble html div to obfuscate Page content with a 404 if user is not logged in.
   3 
   4                 @param d: parameter dictionary
   5                 @rtype: string
   6                 @return: start html, end html
   7                 """
   8  
   9         action_whitelist = ['show','print','raw','logout'] # Comment out to 404 any missing page on any action type. Can be annoying for 'login' and 'logout' actions.
  10         title = u'404 Not Found'
  11         message = u'The requested page was not found.'
  12 
  13         #By default, return empty strings for pages that are not to be wrapped in the hiding div
  14         start = u''
  15         end = u''
  16 
  17         page_blank = d['page'].exists() == False #Does the page exist?
  18         not_logged_in = not (self.request.user.valid and self.request.user.name) #Is the user not yet logged in?
  19 
  20         # Does this action override the 404 showing?
  21         action_override = True
  22         if action_whitelist and self.request.action in action_whitelist:
  23                 action_override = False
  24 
  25         if page_blank and not_logged_in and not action_override:
  26                 self.request.status_code = 404
  27                 start = u"""<div id="hide404">\n        <h1>%s</h1>\n   <p>%s</p>\n</div>\n<div style="display:none">""" % (title, message)
  28         return html

For good examples of the header a footer functions, see the modernized theme.

The #hide404 div may need styling in the same style as the #Page div for site consistency. I achieved this with a simple edit of screen.css in my theme but it may be in common.css for yours.

#page {

becomes

#page, #hide404 {

CategoryFeatureRequest