7 Components: the Function Pages - Developers

The easiest way to add a new group is by filling out the form on the
TWikiGroups page. Here, you just have to enter a fitting name.
Make sure that the name ends with “Group.” A new page is generated
that already contains all of the elements the group needs. Importantly,
you are already listed as a registered user in the GROUP variable.
You will also see a second variable here, ALLOWTOPICCHANGE.
This determines who can modify entries on a page. Admittedly, it
would be rather ridiculous to limit certain actions to the Admin
Group while at the same time allowing everyone the opportunity to
make themselves admins.
This brings us to the access authorizations. There are two ways to
define them. Either you explicitly define who may not execute an
action, which makes it accessible to all the rest. This is an open security
strategy with which you can exclude certain persons who, for
example, have become conspicuous due to vandalism. The other
method is to indicate who may execute certain actions. This is useful
in actions critical to security, where you would like the circle of authorized
persons is to be known by name. The two key words are
“DENY” for the exclusive strategy and “ALLOW” for the inclusive
approach.
The two most frequent limitations relate to changing and renaming
topics. The corresponding variables are:
···*·Set ALLOWTOPICCHANGE = User, Groups
···*·Set DENYTOPICCHANGE = User, Groups
···*·Set ALLOWTOPICRENAME = User, Groups
···*·Set DENYTOPICRENAME = User, Groups
Of course, you only have to make the entries that you need. If you
only wish to enable inclusive access, you do not need to make any
DENY entries. The first two variables relate to the editing of a topic
and also include the option of attaching files. Thus, users prohibited
from editing a topic may also not upload anything to that topic. The
second pair of variables relates to renaming or moving a topic.
If you do not want to make it possible for everyone to immediately
see who has access to a page and who does not, you can place
the settings in HTML comments that begin in the line above the
variable settings and end in the line below it. By doing this, you
won't prevent users experienced in HTML source text from reading
and nevertheless finding out this information. However, it is also a
question of aesthetics to refrain from making such technical information
immediately obvious to everyone in normal browser viewing.
Creating new
groups
Allow vs. deny
Protecting
individual pages
Hiding access
variables
14.4 Access Control �
�
�
209