SID-00570: Topic Attachement ACL

Status:	Answered	TWiki version:	4.3.1	Perl version:	5.8.8
Category:	CategoryAttachments	Server OS:	RedHat Linux 5.3, Kernel 2.6.18	Last update:	16 years ago

Hi,

I wanted to have Access control to all the attachement as per the access given to webs topics.

Basically I followed the instruction given as per in the following URL:

TWikiAccessControl

I have pasted the code in the twiki.conf (which is located in the /etc/httpd/conf.d). I followed the steps like this:

!ScriptAlias /twiki/bin "/var/www/twiki/bin" <<<After this line >>>

Alias /twiki/pub "/var/www/twiki/pub" <<<<inserted this line >>>>

Included another 3 lines of code under the following location:

<Directory "/var/www/twiki/pub"> * * 

<<<<<<inserted this piece of code >>>>>>>>

RewriteEngine on 
RewriteCond %{REQUEST_URI} !^/+twiki/+pub/+TWiki/+.+ 
RewriteRule ^/+twiki/+pub/+([^/]+)/+((([^/]+)/+)+)(.+) /twiki/bin/viewfile/$1/$4?filename=$5 [L,PT] 

I have restarted the apache service after this.

But this blocks all the images from the "pub" directory even though I have permission to view the webs and the TWiki topics. I cannot view / open the attachment ! I have given permission to view, change Web from my Login but all the images are not visible. This includes all the images like the background images, side liink bars etc, becomes invisible. It comes with plain html page with un-aligned way.

Where am I going wrong? Any guidelines for this. I want to accomplish what this URL says: TWikiAccessControl

Thanks for all,

-- SubhashSrinivasamurthy - 2009-10-14

Discussion and Answer

Right-click on a broken image and view the image in your browser. What error message do you get? Is /twiki/bin/view the URL path to your view script? Same for viewfile script. If not, fix the RewriteRule. Check also the Apache error_log.

-- PeterThoeny - 2009-10-14

Hi Peter,

Thanks alot for your reply.

I checked the Apache error_log. It has some errors:

********Error Log extraction*********

[Thu Oct 15 10:05:35 2009] [error] [client <IP-Add Twiki server>] [Thu Oct 15 10:05:35 2009] view: Use of uninitialized value in string eq at /var/www/twiki/lib/TWiki/Users/TWikiUserMapping.pm line 471., referer: <IP-Add Twiki server>/twiki/bin/view/ClearCase/WebHome

[Thu Oct 15 10:04:49 2009] [error] [client <IP-Add Twiki server>] [Thu Oct 15 10:04:49 2009] view: Use of uninitialized value in substitution iterator at /var/www/twiki/lib/TWiki/Render.pm line 515., referer: <IP-Add Twiki server>/twiki/bin/login/Main/WebHome?origurl=/twiki/bin/view/Main/WebHome

[Thu Oct 15 10:03:06 2009] [error] [client <IP-Add Twiki server>] Options FollowSymLinks or SymLinksIfOwnerMatch is off which implies that RewriteRule directive is forbidden: /var/www/twiki/pub/TWiki/TWikiJavascripts/twikiHTML.js, referer: <IP-Add Twiki server>/twiki/bin/view/Main/WebHome

***Topic specific error****

[Thu Oct 15 10:05:36 2009] [error] [client <IP-Add Twiki server>] Options FollowSymLinks or SymLinksIfOwnerMatch is off which implies that RewriteRule directive is forbidden: /var/www/twiki/pub/TWiki/PatternSkin/TWiki_header.gif, referer: <IP-Add Twiki server>/twiki/bin/view/MyTopic/abc-topic

[Thu Oct 15 10:05:42 2009] [error] [client <IP-Add Twiki server>] Options FollowSymLinks or SymLinksIfOwnerMatch is off which implies that RewriteRule directive is forbidden: /var/www/twiki/pub/TWiki/TWikiDocGraphics/swf.gif, referer: <IP-Add Twiki server>/twiki/bin/view/MyTopic/abc-topic

***********************************************************************

/MyTopic/abc-topic means MyTopic = web under this web abc-topic is a topic inside this web.

Any workaround this issue. Is it necessary to modify the files TWikiUserMapping.pm and Render.pm?

Please guide me.

If I right click and click on the show picture it will show almost all the images without error message. But this is not possible to do on every image (Have so many images / icons in a page). Some of the images just do not load after clicking "show picture".

Warm Regards

-- SubhashSrinivasamurthy - 2009-10-15

Add this before RewriteEngine on and you should be OK:

Options +FollowSymLinks

-- PeterThoeny - 2009-10-15

Hi Peter,

I tried the above mentioned. But again without login I can access the attachements by just pasting the URL. I am not sure what went wrong. ACLs are not getting applied to the attachments.

I have only the following error message in the apache error-log:

[Wed Oct 21 12:02:51 2009] [error] [client xxx.xx.xx.xx] [Wed Oct 21 12:02:51 2009] view: Use of uninitialized value in substitution iterator at /var/www/twiki/lib/TWiki/Render.pm line 515., referer: http://xxx.xx.xx.xx/twiki/bin/view/TWiki/WebHome

This means the "FollowSymLinks" have been applied...

I have given the web proper permission for certain users and group to view which takes place accordingly and if guest users tries to view the web it asks user to login. The same I was expecting for the attachments. But If I paste the URL without logging in I can view the attachement.

pls help me.

Regards

-- SubhashSrinivasamurthy - 2009-10-21

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.