7 Components: the Function Pages - Developers

···*·Set NOSEARCHALL = on
Otherwise, the web will be included in a full-text search. With regard
to viewing restrictions, remember that a search requires registration
as soon as blocked content is to be displayed. If a visitor does
not have a user name, he or she cannot use the search in this case.
The same applies to viewing topics and editing.
If you decide to protect a web from unauthorized access, you
should also define the permissions of the preferences page. This is
done, as usual, with the parameter ALLOWTOPICCHANGE, since it
pertains to a single page.
This also means that a priority list must be generated for the event
that topic and web settings are different. Normally, topic settings
have priority. Thus, as you can see, decisions regarding access to individual
topics are in the hands of the respective authors.
The only setting that pertains to the entire TWiki is the permission
to generate new webs. It is defined via TWikiPreferences. If you
prefer not to have access limits in your TWiki, you should remove
the following entries:
···*·Set ALLOWWEBMANAGE = User, Groups
···*·Set DENYWEBMANAGE = User, Groups
since you otherwise will not be able to add new webs.
Now, there is still one serious security problem: An inexperienced
user who tries to change settings changes the
ALLOWTOPICCHANGE for a topic. In doing so, he makes a typing
mistake or, if acting malevolently, knowingly enters a non-existent
user. From then on, nobody can edit the page! One would have to lift
the password protection temporarily in order to manually fix the
problem. However, this would lead to considerable problems for users
logged in at the time, because their permission verification only
works through authenticated pages. To avoid such problems, a SuperAdmin
Group can be set up that always has edit permissions for
all topics. This group is activated by default and can be set up at
TWikiAdminGroup. If you do not want such a group, or would like
to grant another group these rights, you need to change the file
Twiki.cfg in the directory lib. The two relevant parameters are
$superAdminGroup = "TWikiAdminGroup"
$doSuperAdminGroup = "1"
Priorities in
issuing
permissions
Wiki-wide
permissions
SuperAdmin
Group
14.4 Access Control �
�
�
211