Problem

How are webs protected from vandalism, especially considering the existence of the TWikiGuest account?

.

Solution

In TWikiPreferences:
  ALLOWTOPICCHANGE and ALLOWTOPICRENAME to AdminGroup

In WebPreferences for the Main web:
  ALLOWTOPICCHANGE and ALLOWTOPICRENAME to AdminGroup
  ALLOWWEBCHANGE and ALLOWWEBRENAME to AdminGroup

In WebPreferences for the Know and TWiki webs:
  ALLOWTOPICCHANGE and ALLOWTOPICRENAME to AdminGroup
  DENYWEBCHANGE and DENYWEBRENAME to TWikiGuest

In WebPreferences for the Test web:
  ALLOWTOPICCHANGE and ALLOWTOPICRENAME to AdminGroup
  DENYWEBRENAME to TWikiGuest

Note that any site can enable "superAdminGroup" settings, so that members of the TWikiAdminGroup can change all topics in all webs. With this exception, changes in other webs should be allowed only to specific groups/individuals.

For each new web, the TWiki administrator will define a corresponding new group whose members will have change access. There is no limit on the number of groups to which a user can belong, but all groups and users are defined by the Main web.

In WebPreferences for the New web:
  ALLOWTOPICCHANGE and ALLOWTOPICRENAME to NewGroup
  ALLOWWEBCHANGE and ALLOWWEBRENAME to NewGroup

Optionally, a NewWebAdminGroup can also be defined for new webs if required. Of course, topics which define groups must have restrictions defined by ALLOWTOPICCHANGE and ALLOWTOPICRENAME, in order to prevent unauthorized modification of the group settings and membership lists.

Of course, the TWikiGuest user account should be deleted if it proves to be a problem for security.

.

-- TWikiGuest - 24 Oct 2002