Revision history for ACLsWithUserGroups


Revision [22713]

Last edited on 2016-04-17 20:34:33 by MasinAlDujaili [changed . to \V in regex]
Additions:
>>Working for 1.1.5.3 (according to author) to 1.3.6(latest)>>There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.
preg_match_all("/\+(\V*?)\+/",$thegroup["body"],$group_members);
Deletions:
>>Working for 1.1.5.3 (according to author) to 1.2(latest)>>There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.
preg_match_all("/\+(.*?)\+/",$thegroup["body"],$group_members);


Revision [21145]

Edited on 2010-04-17 06:26:23 by DarTar [rv]

No Differences

Revision [20997]

Edited on 2010-01-12 05:59:01 by GregorLindner [Works for 1.2]
Additions:
>>Working for 1.1.5.3 (according to author) to 1.2(latest)>>There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.
Deletions:
>>Working for 1.1.5.3 (according to author) to 1.1.6.4 (latest)>>There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.


Revision [20735]

Edited on 2009-07-06 18:12:33 by BrianKoontz [minor edit]
Additions:
===Dependency===
Deletions:
===Dependancy===


Revision [20734]

Edited on 2009-07-06 12:26:43 by BrianKoontz [restored (error in update)]
Additions:
>>Working for 1.1.5.3 (according to author) to 1.1.6.4 (latest)>>There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.
Deletions:
>>Working for 1.1.5.3 (according to author) to 1.1.6.4 (latest)
Included in trunk (future 1.3 release)>>
There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.


Revision [20733]

Edited on 2009-07-06 12:15:07 by BrianKoontz [Updated applicable version]
Additions:
>>Working for 1.1.5.3 (according to author) to 1.1.6.4 (latest)
Included in trunk (future 1.3 release)>>
There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.
Deletions:
>>Working for 1.1.5.3 (according to author) to 1.1.6.4 (latest)>>There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.


Revision [20000]

Edited on 2008-06-04 04:02:22 by MasinAlDujaili [working versions]
Additions:
>>Working for 1.1.5.3 (according to author) to 1.1.6.4 (latest)>>There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.
Deletions:
There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.


Revision [19897]

Edited on 2008-05-05 06:01:02 by MarcElser [working versions]
Additions:
~~~& Could not get it working with master groups as described by MovieLady, so I changed the ""IsGroupMember"" function to recursivly go through all sub groups:
~~~&%%(php) // returns true if $who is member of $group
function isGroupMember($who, $group)
{
$thegroup=$this->LoadPage($group);
if ($thegroup) {
preg_match_all("/\+(.*?)\+/",$thegroup["body"],$group_members);
foreach ($group_members[1] as $group_member) {
if ($who == $group_member) { return true; }
if ($this->isGroupMember($who,$group_member)) { return true; }
}
}
else return false;
}%%
~~~& Does anybody have an idea why the setup described by MovieLady should work? I my setup members of the Group ""UGMetro"" or ""UGSports"" did not have access to pages where the read/write acl's were set to ""UGNewsroom""


Revision [19422]

Edited on 2008-01-28 00:15:45 by JavaWoman [Modified links pointing to docs server]

No Differences

Revision [17803]

Edited on 2007-12-12 09:53:12 by JavaWoman [prevent function references looking as page links]
Additions:
- The only code needed should be that ""HasAccess()"" function has to be modified in order to search if the user is part of the group or not.
In wikka.php add the ""isGroupMember()"" function (after ""TrimACLs()"" function for example):
Then change ""HasAccess()"" function:
A hacker may be able to get unauthorized access if they create a new user account with the same name as a groupname. For example, in the above scenario, the hacker may gain unauthorized access if (s)he creates a user with "UserGroupWikkaCrew" as the login name. The easiest way to prevent this from happening is to disallow new users to pick a name which is equal to an existing page.
Deletions:
- The only code needed should be that ""HasAccess"" function has to be modified in order to search if the user is part of the group or not.
In wikka.php add the isGroupMember function (after TrimACLs function for example):
Then change HasAccess function:
A hacker may be able to get unauthorized access if they create a new user account with the same name as a groupname. For example, in the above scenario, the hacker may gain unauthorized access if (s)he creates a user with "UserGroupWikkaCrew" as the login name. The easiest way to prevent this from happening is to disallow new users to pick a new which is equal to an existing page.


Revision [16852]

Edited on 2007-05-31 23:26:34 by WazoO [Reverted]
Additions:
- Then he would write in this page all the user logins he wants to be part of the group (embeded inside plus signs to avoid confusions: +UserLogin1+UserLogin2+).
$search = "+".$who."+"; // In the GroupListPages, the participants logins have to be embbeded inside '+' signs
Write in all the user login that have to be part of this group inside "+" signs: +UserLogin1+UserLogin2+ is valid as would be:
- +UserLogin1+
- +UserLogin2+.
~& This doesn't really make sense, because u can add it as a subgroupe using his page/groupname, no ?
~~& Correct. I'm using this to control access on my intranet and I've got multiple layers of groups (many that cross over) that allow me to manage groups of groups. Here's how I'm using it:
~~& Group 1 (""UGMetro"") has several names: ""+Reporter1+"" ""+Reporter2+"" ""+Reporter3+"" ""+MetroEditors+""
~~& Group 2 (""UGSports"") has others: ""+Reporter4+"" ""+Reporter5+"" ""+Reporter6+"" ""+SportsEditors+""
~~& And the master group (""UGNewsroom"") looks like this: ""+UGMetro+"" ""+UGSports+""
~~& Works just fine for me. :) --MovieLady
===Security Risks===
A hacker may be able to get unauthorized access if they create a new user account with the same name as a groupname. For example, in the above scenario, the hacker may gain unauthorized access if (s)he creates a user with "UserGroupWikkaCrew" as the login name. The easiest way to prevent this from happening is to disallow new users to pick a new which is equal to an existing page.
~&This check is already in place as of version 1.1.6.0. --JavaWoman
----
CategoryUserContributions
Deletions:
- Then he would write in this page all the user logins he wants to be part of the group (embeded inside plus signs to avoid confusions: UserLogin1 UserLogin2 ).
$search = " ".$who." "; // In the GroupListPages, the participants logins have to be embbeded inside ' ' signs
Write in all the user login that have to be part of this group inside " " signs: UserLogin1 UserLogin2 is valid as would be:
- UserLogin1
- UserLogin2 .
~


Revision [16648]

Edited on 2007-05-31 10:29:26 by MqaP1b [Reverted]
Additions:
- Then he would write in this page all the user logins he wants to be part of the group (embeded inside plus signs to avoid confusions: UserLogin1 UserLogin2 ).
$search = " ".$who." "; // In the GroupListPages, the participants logins have to be embbeded inside ' ' signs
Write in all the user login that have to be part of this group inside " " signs: UserLogin1 UserLogin2 is valid as would be:
- UserLogin1
- UserLogin2 .
~
Deletions:
- Then he would write in this page all the user logins he wants to be part of the group (embeded inside plus signs to avoid confusions: +UserLogin1+UserLogin2+).
$search = "+".$who."+"; // In the GroupListPages, the participants logins have to be embbeded inside '+' signs
Write in all the user login that have to be part of this group inside "+" signs: +UserLogin1+UserLogin2+ is valid as would be:
- +UserLogin1+
- +UserLogin2+.
~& This doesn't really make sense, because u can add it as a subgroupe using his page/groupname, no ?
~~& Correct. I'm using this to control access on my intranet and I've got multiple layers of groups (many that cross over) that allow me to manage groups of groups. Here's how I'm using it:
~~& Group 1 (""UGMetro"") has several names: ""+Reporter1+"" ""+Reporter2+"" ""+Reporter3+"" ""+MetroEditors+""
~~& Group 2 (""UGSports"") has others: ""+Reporter4+"" ""+Reporter5+"" ""+Reporter6+"" ""+SportsEditors+""
~~& And the master group (""UGNewsroom"") looks like this: ""+UGMetro+"" ""+UGSports+""
~~& Works just fine for me. :) --MovieLady
===Security Risks===
A hacker may be able to get unauthorized access if they create a new user account with the same name as a groupname. For example, in the above scenario, the hacker may gain unauthorized access if (s)he creates a user with "UserGroupWikkaCrew" as the login name. The easiest way to prevent this from happening is to disallow new users to pick a new which is equal to an existing page.
~&This check is already in place as of version 1.1.6.0. --JavaWoman
----
CategoryUserContributions


Revision [14583]

Edited on 2006-06-14 03:26:47 by WazoO [dropped the Beta, final 1.1.6.2 is out, mod works]
Additions:
(for version 1.1.6.2, the required file has beem moved and renamed to ...../libs/Wakka.class.php )
Deletions:
(for version 1.1.6.2-Beta, the required file has beem moved and renamed to ...../libs/Wakka.class.php )


Revision [14510]

Edited on 2006-06-09 00:10:29 by WazoO [updated file location for 1.1.6.2-Beta]
Additions:
(for version 1.1.6.2-Beta, the required file has beem moved and renamed to ...../libs/Wakka.class.php )
Deletions:
(for version 1.1.6.2-Beta, this file has beem moved and renamed to ...../libs/Wakka.class.php )


Revision [14509]

Edited on 2006-06-09 00:08:59 by WazoO [updated file location for 1.1.6.2-Beta]
Additions:
(for version 1.1.6.2-Beta, this file has beem moved and renamed to ...../libs/Wakka.class.php )


Revision [14496]

Edited on 2006-06-06 20:37:05 by MovieLady [example on use for multi-level groups]
Additions:
My code needs probably to be reviewed by expert coder as I am not at all a developer (I just rely on the above user group).
~~& Correct. I'm using this to control access on my intranet and I've got multiple layers of groups (many that cross over) that allow me to manage groups of groups. Here's how I'm using it:
~~& Group 1 (""UGMetro"") has several names: ""+Reporter1+"" ""+Reporter2+"" ""+Reporter3+"" ""+MetroEditors+""
~~& Group 2 (""UGSports"") has others: ""+Reporter4+"" ""+Reporter5+"" ""+Reporter6+"" ""+SportsEditors+""
~~& And the master group (""UGNewsroom"") looks like this: ""+UGMetro+"" ""+UGSports+""
~~& Works just fine for me. :) --MovieLady
Deletions:
My code needs probably to be reviewed by expert coder as I am not at all a developper (I just rely on the above user group).


Revision [12289]

Edited on 2005-12-16 09:05:35 by EltharielHdh [example on use for multi-level groups]
Additions:
~& This doesn't really make sense, because u can add it as a subgroupe using his page/groupname, no ?


Revision [12288]

Edited on 2005-12-16 09:02:58 by EltharielHdh [some cleaning]
Additions:
// aha! a user entry.
// aha! a user entry.
Deletions:
~&Two suggestions here:
~~1) Call it "isGroupMember" rather than CheckGroupMember: that conveys better that you'll get a TRUE/FALSE answer;
~~1) Make sure the function always returns a boolean (easy by casting the substr_count() to boolen) instead of sometimes a boolean and sometimes a number.
~&Apart from that I think this is a brilliant idea! --JavaWoman
~~& Done as recommended - thanks -- ChristianBarthelemy
// aha! a user entry.
// aha! a user entry.


Revision [6547]

Edited on 2005-03-07 15:52:22 by JavaWoman [reply re: security risks]
Additions:
~&This check is already in place as of version 1.1.6.0. --JavaWoman


Revision [6544]

Edited on 2005-03-07 13:46:18 by FreekDijkstra [Added security risk note]
Additions:
====Managing User Groups through ACLs====

There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.

===My solution===
I though about a simpler way to deal with User Groups - my concept is: Give the power to the users and Keep it simple.

- The idea is that anyuser could define a new group by creating a dedicated WikiPage: something like ""MyProjectGroup"".
- Then he would write in this page all the user logins he wants to be part of the group (embeded inside plus signs to avoid confusions: +UserLogin1+UserLogin2+).
- He would decide through the ACLs of this page who can manage the group list.
- Then he may use this page name in the ACLs of any page in order to manage the access authorizations.
- The only code needed should be that ""HasAccess"" function has to be modified in order to search if the user is part of the group or not.

===Dependancy===
None that I can figure out. I have it working with 1.1.5.3 version.

===The code===
In wikka.php add the isGroupMember function (after TrimACLs function for example):

%%(php)
// returns true if $who is member of $group
function isGroupMember($who, $group)
{
$thegroup=$this->LoadPage($group);
if ($thegroup) {
$search = "+".$who."+"; // In the GroupListPages, the participants logins have to be embbeded inside '+' signs
return (boolean)(substr_count($thegroup["body"], $search));
}
else return false;
}
%%
~&Two suggestions here:
~~1) Call it "isGroupMember" rather than CheckGroupMember: that conveys better that you'll get a TRUE/FALSE answer;
~~1) Make sure the function always returns a boolean (easy by casting the substr_count() to boolen) instead of sometimes a boolean and sometimes a number.
~&Apart from that I think this is a brilliant idea! --JavaWoman
~~& Done as recommended - thanks -- ChristianBarthelemy

Then change HasAccess function:

from:

%%(php)
// aha! a user entry.
default:
if ($line == $user)
{
return !$negate;
}
%%

to:

%%(php)
// aha! a user entry.
default:
if ($line == $user)
{
return !$negate;
}
// this may be a UserGroup so we check if $user is part of the group
else if (($this->isGroupMember($user, $line)))
{
return !$negate;
}
%%

===How to use it?===
Create a WikiPage to manage a particular user group: a name like UserGroupWikkaCrew makes sense (it exists ;-) ), it could be nice to link to a CategoryUserGroup.
Write in all the user login that have to be part of this group inside "+" signs: +UserLogin1+UserLogin2+ is valid as would be:
- +UserLogin1+
- +UserLogin2+.
Modify the ACLs of this ""UserGroupPage"" to reflect who is allowed to manage the group.
Use the ""UserGroupPage"" in any ACLs, they can be can be negated using the "!" character as usual.

===To Do===
My code needs probably to be reviewed by expert coder as I am not at all a developper (I just rely on the above user group).
Any ideas and comments than welcome.
This does not allow to manage Groups of Groups (don't think about using the ""{{include}}"" action!)

===Security Risks===

A hacker may be able to get unauthorized access if they create a new user account with the same name as a groupname. For example, in the above scenario, the hacker may gain unauthorized access if (s)he creates a user with "UserGroupWikkaCrew" as the login name. The easiest way to prevent this from happening is to disallow new users to pick a new which is equal to an existing page.

----
Deletions:
====Managing User Groups through ACLs====

There is already a proposal for this at GroupManagement. However this code doesn't seem to work anymore.

===My solution===
I though about a simpler way to deal with User Groups - my concept is: Give the power to the users and Keep it simple.

- The idea is that anyuser could define a new group by creating a dedicated WikiPage: something like ""MyProjectGroup"".
- Then he would write in this page all the user logins he wants to be part of the group (embeded inside plus signs to avoid confusions: +UserLogin1+UserLogin2+).
- He would decide through the ACLs of this page who can manage the group list.
- Then he may use this page name in the ACLs of any page in order to manage the access authorizations.
- The only code needed should be that ""HasAccess"" function has to be modified in order to search if the user is part of the group or not.

===Dependancy===
None that I can figure out. I have it working with 1.1.5.3 version.

===The code===
In wikka.php add the isGroupMember function (after TrimACLs function for example):

%%(php)
// returns true if $who is member of $group
function isGroupMember($who, $group)
{
$thegroup=$this->LoadPage($group);
if ($thegroup) {
$search = "+".$who."+"; // In the GroupListPages, the participants logins have to be embbeded inside '+' signs
return (boolean)(substr_count($thegroup["body"], $search));
}
else return false;
}
%%
~&Two suggestions here:
~~1) Call it "isGroupMember" rather than CheckGroupMember: that conveys better that you'll get a TRUE/FALSE answer;
~~1) Make sure the function always returns a boolean (easy by casting the substr_count() to boolen) instead of sometimes a boolean and sometimes a number.
~&Apart from that I think this is a brilliant idea! --JavaWoman
~~& Done as recommended - thanks -- ChristianBarthelemy

Then change HasAccess function:

from:

%%(php)
// aha! a user entry.
default:
if ($line == $user)
{
return !$negate;
}
%%

to:

%%(php)
// aha! a user entry.
default:
if ($line == $user)
{
return !$negate;
}
// this may be a UserGroup so we check if $user is part of the group
else if (($this->isGroupMember($user, $line)))
{
return !$negate;
}
%%

===How to use it?===
Create a WikiPage to manage a particular user group: a name like UserGroupWikkaCrew makes sense (it exists ;-) ), it could be nice to link to a CategoryUserGroup.
Write in all the user login that have to be part of this group inside "+" signs: +UserLogin1+UserLogin2+ is valid as would be:
- +UserLogin1+
- +UserLogin2+.
Modify the ACLs of this ""UserGroupPage"" to reflect who is allowed to manage the group.
Use the ""UserGroupPage"" in any ACLs, they can be can be negated using the "!" character as usual.

===To Do===
My code needs probably to be reviewed by expert coder as I am not at all a developper (I just rely on the above user group).
Any ideas and comments than welcome.
This does not allow to manage Groups of Groups (don't think about using the ""{{include}}"" action!)

----


Revision [4769]

Edited on 2005-01-17 15:02:30 by NilsLindenberg [cat. added]
Additions:
CategoryUserContributions
Deletions:
CategoryDevelopment


Revision [4503]

Edited on 2005-01-12 07:41:10 by JavaWoman [restoring list within comment (takes som fiddling...)]
Additions:
~~1) Call it "isGroupMember" rather than CheckGroupMember: that conveys better that you'll get a TRUE/FALSE answer;
~~1) Make sure the function always returns a boolean (easy by casting the substr_count() to boolen) instead of sometimes a boolean and sometimes a number.
~&Apart from that I think this is a brilliant idea! --JavaWoman
~~& Done as recommended - thanks -- ChristianBarthelemy
Deletions:
~~&1) Call it "isGroupMember" rather than CheckGroupMember: that conveys better that you'll get a TRUE/FALSE answer;
~~&1) Make sure the function always returns a boolean (easy by casting the substr_count() to boolen) instead of sometimes a boolean and sometimes a number. --- Apart from that I think this is a brilliant idea! --JavaWoman
~~~& Done as recommended - thanks -- ChristianBarthelemy


Revision [4476]

Edited on 2005-01-11 18:37:10 by NilsLindenberg [comments (layout)]
Additions:
~&Two suggestions here:
~~&1) Call it "isGroupMember" rather than CheckGroupMember: that conveys better that you'll get a TRUE/FALSE answer;
~~&1) Make sure the function always returns a boolean (easy by casting the substr_count() to boolen) instead of sometimes a boolean and sometimes a number. --- Apart from that I think this is a brilliant idea! --JavaWoman
~~~& Done as recommended - thanks -- ChristianBarthelemy
Deletions:
~''Two suggestions here:
~~1) Call it "isGroupMember" rather than CheckGroupMember: that conveys better that you'll get a TRUE/FALSE answer;
~~1) Make sure the function always returns a boolean (easy by casting the substr_count() to boolen) instead of sometimes a boolean and sometimes a number. --- Apart from that I think this is a brilliant idea! --JavaWoman''
~~~ Done as recommended - thanks -- ChristianBarthelemy


Revision [4111]

Edited on 2005-01-06 21:31:45 by ChristianBarthelemy [JavaWoman's recommendations applied]
Additions:
In wikka.php add the isGroupMember function (after TrimACLs function for example):
function isGroupMember($who, $group)
return (boolean)(substr_count($thegroup["body"], $search));
~~~ Done as recommended - thanks -- ChristianBarthelemy
else if (($this->isGroupMember($user, $line)))
Deletions:
In wikka.php add the CheckGroupMember function (after TrimACLs function for example):
function CheckGroupMember($who, $group)
return substr_count($thegroup["body"], $search);
else if (($this->CheckGroupMember($user, $line)))


Revision [4106]

Edited on 2005-01-06 20:55:55 by JavaWoman [comment]
Additions:
~''Two suggestions here:
~~1) Call it "isGroupMember" rather than CheckGroupMember: that conveys better that you'll get a TRUE/FALSE answer;
~~1) Make sure the function always returns a boolean (easy by casting the substr_count() to boolen) instead of sometimes a boolean and sometimes a number. --- Apart from that I think this is a brilliant idea! --JavaWoman''


Revision [4101]

Edited on 2005-01-06 19:56:44 by ChristianBarthelemy [Update "how to use it"]
Additions:
Modify the ACLs of this ""UserGroupPage"" to reflect who is allowed to manage the group.
Use the ""UserGroupPage"" in any ACLs, they can be can be negated using the "!" character as usual.
Deletions:
Use the ""UserGroupName"" in any ACLs, they can be can be negated using the "!" character as usual.


Revision [4093]

Edited on 2005-01-06 19:44:15 by ChristianBarthelemy [Another way for GroupManagement]
Additions:
- +UserLogin1+
- +UserLogin2+.
Deletions:
- +UserLogin1+
- +UserLogin2+.


Revision [4092]

Edited on 2005-01-06 19:43:53 by ChristianBarthelemy [Another way for GroupManagement]
Additions:
- +UserLogin2+.
Deletions:
- +UserLogin2+.


Revision [4090]

The oldest known version of this page was created on 2005-01-06 19:42:34 by ChristianBarthelemy [Another way for GroupManagement]
Valid XHTML :: Valid CSS: :: Powered by WikkaWiki