How to deny a user/group the right to delete their own pages?

inhji · January 30, 2018, 6:04pm

Hello,

I’ve explicitly denied the right to delete a page on multiple levels (global user rights, global group rights, page user rights, page group rights) but the user is still able to delete the page.

It seems like the right settings are outright ignored…

mflorea · January 30, 2018, 7:41pm

Check http://extensions.xwiki.org/xwiki/bin/view/Extension/Security+Module#HDefaultrightsbeingpredefined . There is a “Creator” right

Internal right provided to document creators

that implies delete right. So the creator of a page automatically gets the right to delete that page. I don’t know if you can deny delete to creators.

Pbas · January 31, 2018, 8:19am

Hello,

to cheat then

you can modify the creator: http://extensions.xwiki.org/xwiki/bin/view/Extension/Change%20creator%2C%20author%20or%20contentAuthor/
, add a SSX (CSS) to hide delete button (but page can be deleted still with URL: bin/delete/xxx). IMO the cleaner way
or set $canDelete in ./flamingo/menus_content.vm (page can be deleted too)

Pascal

inhji · January 31, 2018, 9:24am

Thanks @mflorea for the link and thanks @Pbas for pointing out these “cheats”