xwiki/xwiki-platform — comment on commit 50ca22247b53e1b22cca7d49ab38abbfbe25d13a
File:  line 0
By Enygma2002:

IMO, there is no right solution for the workspaces usecase. At least not a complete one.

The problem is that the workspace template should not contain any local users. This means that you can not include a user in the xar template, make him admin and make him the author of certain pages. You can not do this with a global user either, since you have no way of knowing the names of global users at build time.

Also, the solution I proposed on the mailing list is not good either since it gives PR to every page in the template. This means that, on a workspace, the pages will have PR as well and any user of a workspace (with edit rights) could compromise the security of the entire XWiki instance.

So I chose to solve problems as they are discovered, trying to have the least impact on security. This is, IMO, the best we can do for now from the application's point of view.

The best way to go is still for the admin to carefully craft his workspace base xar template or at least to edit the workspace template (subwiki) to a state that is not causing problems.