In setting up our XWiki farm, I came across a couple of bugs.
In general, should we always bring up bugs on the mailing list first before 
entry into jira?

I deleted the account named "Admin" after setting up other individuals as 
administrators.  A user with "admin" rights (or even "delete" rights) could no 
longer create or delete wikis from the "wikis" page of the XEM.  However, if I 
recreated an account named "Admin", then a user with "admin" rights *could* 
create/delete wikis from that page, even though they're not logged in as user 
"Admin".  

The rights checking on that page must be hardcoded to check if user "Admin" has 
the rights, instead of checking the user who's actually logged in and making 
the page request.

XEM 1.9.3

Trevor
_______________________________________________
users mailing list
users@xwiki.org
http://lists.xwiki.org/mailman/listinfo/users

Reply via email to