Item9104: ACLs are not properly interpreting data from a %FORMFIELD%

When setting an ACL, one may want to use a value contained in a form to specify the users or groups allowed according to the ACL. Trying to do so with a %FORMFIELD% macro fails, and does not use the returned value, despite the fact that the viewed page renders the setting.

For reproducing the problem, do the following :

• create a form with a "text" field
  • TestForm:
    
• create a page, attach the form to it
• type a WikiName in the "text" field of the form
• edit the page to include an ACL, for instance ALLOWTOPICCHANGE, using the value of the form, like this :
  • TML for the created page:
    

• save the page - the rendered page looks like this, showing that the user is allowed topic change :
  • Rendered page showing the value for the ALLOWTOPICCHANGE directive:
    

• login as that user designated in ALLOWTOPICCHANGE and try to modify
• you get an "Access Denied" error

-- RaulFRodriguez - 04 Jun 2010

Indeed. However, you can't, and have never been able to, use a macro in an ACL. There's a fairly obvious reason for this, if you think about it.

No action.

-- CrawfordCurrie - 24 Jun 2010

Commenting is disabled while not logged in