Bug: Invalid ALLOWWEBVIEW

If you set one of the ALLOW preferences (e.g. ALLOWWEBVIEW) to a group that has no members, then twiki treats that as if there were no ALLOWWEBVIEW property -- i.e. all users are allowed access. To me this seems surprising and wrong; I would expect all access to the topic to be denied for all users in this case.

This bug is also in the Debian BTS. The behavior has changed in recent versions; ALLOWTOPICVIEW = Main.AnInvalidUser no longer allows access to the world, but ALLOWTOPICVIEW = Main.AnEmptyGroup and ALLOWTOPICVIEW = AnInvalidGroup still do.

Test case

Set ALLOWTOPICVIEW = Main.AnInvalidGroup in a random topic, and watch as all users can still view the topic.

Patch

I've included a patch against the 01Feb2003 release, which is tested and has been working. I've also included a patch against the DEVELOP head, which I don't even know to be free of syntax errors.

Environment

-- AndrewMoise - 22 Nov 2004

Follow up

This also applies to the situation where the permissions of a Group topic are set to restrict non-group members from viewing it ... secret groups if you will. Basically, allowList was coming back empty due to permissions. Anyway, I made a simple three line change in Access.pm to allow for the this scenario and it's working great.

    139                 if( $allowOrDeny eq "DENYTOPIC" ) {
    140                     @denyList = @tmpList;
    141                 } elsif( @tmpList eq 0 ) {
    142                     return 0;
    143                 } else {
    144                     @allowList = @tmpList;
    145                 }

I haven't thought this all the way through yet, nor have I fully understood the changes contained within the patches attached to this topic. So, let me know if this is the same issue or if I need to submit another bug report.

-- RobKirk - 01 Jan 2005

Fix record

Patch for DEVELOP was almost perfect. When I wrote the testcase for the bug it showed up another undetected bug in View.pm - thanks Andrew!

Checked in to DEVELOP svn rev 3265. testcase is ViewDEVELOP:TestCases/TestCaseEmptyGroupTreatedAsNoGroup.

-- CrawfordCurrie - 22 Nov 2004