Motivation
You may want to allow or deny access to a topic in addition to the users allowed or denied with ALLOWWEB* or DENYWEB*.
It would be nice if a change to ALLOWEB* or DENYWEB* is reflected to the topic level restriction.
This is achievable if ALLOWWEB* or DENYWEB* consists only of a TWiki group.
Let's assume the following line is there on WebPreferences.
* Set ALLOWWEBVIEW = AccessGroup
Then the following line on a topic makes the topic viewable to the users having web level access plus CronieGroup members.
* Set ALLOWTOPICVIEW = AccessGroup, CronieGroup
But this is not flexible.
And there is no guarantee that something is not added to ALLOWWEBVIEW.
Description and Documentation
If ALLOWTOPIC* or DENYTOPIC* starts with +, it's treated as if the corresponding ALLOWWEB* or DENYWEB* is inserted there.
Examples
Let's say the following line is there on WebPreferences.
* Set ALLOWWEBVIEW = AccessGroup
Also assume that the topic ForCronies needs to be viewable by CroniesGroup in addition to AccessGroup.
Then, ForCronies would have the following line.
* Set ALLOWTOPICVIEW = + CroniesGroup
Even if ALLOWWEBVIEW is changed, ForCronies topic is always viewable by the users allowed by ALLOWWEBVIEW plus GroniesGroup.
Maybe the above example is not so compelling.
Think about a large organization having a lot of LDAP groups and there is a TWiki installation configured to be able to use LDAP groups.
Let's assume LDAPGROUP:group-name is the way to specify an LDAP group for access control.
Then you may have the line below on WebPreferences.
* Set ALLOWWEBVIEW = LDAPGROUP:team-tango, LDAPGROUP:team-foxtrot, LDAPGROUP:team-waltz
In that case, duplicating those three on ALLOWTOPICVIEW and put something in addition is cumbersome and may cause inconsistency in the future.
Writing as follows is much cleaner.
* Set ALLOWTOPICVIEW = + LDAPGROUP:team-samba
Impact
Implementation
--
Contributors: Hideyo Imazu - 2016年12月09日
Discussion
Looks good to me!
--
Peter Thoeny - 2017年01月05日