Skip to content

XWIKI-19779: Bad display of non-viewable users in the likers page#5057

Open
Sereza7 wants to merge 3 commits intoxwiki:masterfrom
Sereza7:XWIKI-19779
Open

XWIKI-19779: Bad display of non-viewable users in the likers page#5057
Sereza7 wants to merge 3 commits intoxwiki:masterfrom
Sereza7:XWIKI-19779

Conversation

@Sereza7
Copy link
Contributor

@Sereza7 Sereza7 commented Jan 16, 2026

Jira URL

https://jira.xwiki.org/browse/XWIKI-19779

Changes

Description

  • Removed the two custom macro definitions from likers.vm and getusers.vm
  • Introduced a (non API) alternative directly in the global velocity macros in macros.vm
  • Added an option to the displayUser macro to account for the one thing that was missing.

Clarifications

  • The like template doesn't even use the "$disabled" parameter... I left it in because it doesn't hurt and it allows to factorize the velocity macro with getusers.

Screenshots & Video

After the PR:
The getusers.vm template still works as intended.
Screenshot From 2026-01-16 11-27-58

I liked the page with two accounts. The administrator sees both as expected, and the users that doesn't have rights sees "Guest user" with links pointing towards the pages they don't have access to. This is the standard way to handle user display when the current user doesn't have view permission (IMO it could be better, but it's not the point of the ticket.)
Screenshot From 2026-01-16 11-28-26

Executed Tests

Manual tests on local instance, see above.
Successfully built changes with:

  • mvn clean install -f xwiki-platform-core/xwiki-platform-like/xwiki-platform-like-api -Pquality
  • mvn clean install -f xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates -Pquality

Expected merging strategy

  • Prefers squash: Yes
  • Backport on branches:
    • None.

* Removed the two custom macro definitions from likers.vm and getusers.vm
* Introduced a (non API) alternative directly in the global velocity macros in macros.vm
* Added an option to the displayUser macro to account for the one thing that was missing.
* Removed the two custom macro definitions from likers.vm and getusers.vm
* Introduced a (non API) alternative directly in the global velocity macros in macros.vm
* Added an option to the displayUser macro to account for the one thing that was missing.
Copy link
Member

@mflorea mflorea left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Displaying "XWikiGuest" is very confusing. We cannot fix the "bad display of non-viewable users" by showing incorrect information. Moreover, I don't understand how you can have "User: XWikiGuest" and "First Name: Administrator" on the second row of your screenshot. How can you have access to the first name but not the user reference?

the users that doesn't have rights sees "Guest user" with links pointing towards the pages they don't have access to.

If you have the link to the user profile page then I assume you have the user reference. If you have the user reference then why display "XWikiGuest" instead of the user alias (user reference name)?

The way I see it, there are two cases:

  1. You have access to the user reference but not the user profile page => you should display the user alias (user reference name), linked to the user profile page (you can obtain the URL from the user reference). The First Name and Last Name columns should be empty, because you need access to the user profile to get this information.
  2. You don't have access to the user reference, i.e. the user reference is null => in this case the user displayer can display "XWikiGuest" without any link, but IMO an API that returns a list of user references with null values has a design problem (it should filter out those null values).

My understanding is that you are in the first case, otherwise you wouldn't have the link to the user profile page.

This is the standard way to handle user display when the current user doesn't have view permission (IMO it could be better, but it's not the point of the ticket)

I don't agree. As an end user I don't care how the code is organized under the hood to reduce duplication. I expect the UI to provide useful and accurate information.

## We avoid the whitespace because the users are displayed as inline blocks.
#set ($discard = $output.addAll([
"<$userTag class=""$type"" data-reference=""$escapetool.xml($userReference)"">",
"<$userTag class=""$userClasses"" data-reference=""$escapetool.xml($userReference)"">",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"<$userTag class=""$userClasses"" data-reference=""$escapetool.xml($userReference)"">",
"<$userTag class=""$escapetool.xml($userClasses)"" data-reference=""$escapetool.xml($userReference)"">",

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants