Overview #

WIKI-ACLs (PagePermission) is an Access Control List on a page that allow users to refine (typically, reduce) the privileges for particular pages.
WIKI-ACLs cannot elevate privileges above those already granted by the WIKI-Security Policy allows.

WIKI-ACLs is simply special wiki markup that defines who should be able to perform what actions on a particular page.

  • Who: User WikiNames or full names can be used; either will work just fine. Built-in Roles and wiki groups work, too.
  • What: Valid permissions are:
    • VIEW
    • UPLOAD - implies VIEW
    • EDIT - implies VIEW and COMMENT
    • MODIFY - implies EDIT and UPLOAD
    • COMMENT - implies VIEW
    • RENAME - implies EDIT
    • DELETE - implies EDIT

The syntax is ALLOW permission userOrRole1, userOrRole2, userOrRole3, enclosed in brackets.

For example, suppose you've just created a confidential page that only users Janne and Mike Morris should be able to view. Just add this to the top of the wiki page markup:

[{ALLOW view Janne,Mike Morris}] 

This allows Janne and Mike to view the page, but nobody else can view it. Note that this particular ACL does not contain any "edit" privileges. If you wanted Janne to be able to edit the page as well, you would add this line:

[{ALLOW edit Janne}] 

Access control lists can contain entries for WIKI-Roles and WIKI-Groups. Suppose we wanted to broaden access to the wiki page so that all authenticated users could view the page, and all members of the wiki group "Managers" could edit it:

[{ALLOW view Janne,Mike Morris,Authenticated}] 
[{ALLOW edit Janne,Managers}] 

Roles, wiki groups and user/wiki names can sometimes have the same names. For security reasons, built-in Roles and container-defined Roles always take priority over wiki groups with the same name. Likewise, wiki groups override user names or wiki names. Thus, although it's technically possible to register a new user with the name "Authenticated", they won't magically receive access to everything that the role Authenticated is entitled to.

Note: there is no support for "deny" access control entries. That is a deliberate, philosophical design choice — it is far easier to deny by default than to worry about whether grants or denies take precedence.

By default, wiki pages do not have access control lists. When a page doesn't have an ACL, the default security policy for the page applies.

More Information #

There might be more information for this subject on one of the following: