ACL - Author Delete Problem

HCL Domino Domino Forum
1

I have created a domino directory group called OOO-Users. This group is within the ACL with following properties:

User Type: Person Group

Access: Author

Create Docs, Write Public Docs, Replicate or Copy Docs

The problem is users listed in this group are able to delete other users’ documents, when in fact they should not be able to delete any documents.

The documents they are deleting have the following form properties:

Authors Field: Computed When Composed, Allow Multiple values, Choices - ACL, Multi-Value Options - Comma

Default value of: @UserName : “[Manager]”

This is the only authors field on the form. The ACL is enforced on all replicas and there are no Local or OtherDomainServers listed in the ACL. There is an Admn server listed with Manager rights. There are no agents that delete documents.

Any ideas how these users have the ability to delete documents?

Thanks - Tim

2

Subject: ACL - Author Delete Problem

Are they Public documents ? The ability to write gives them the ability to delete them.

3

Subject: RE: ACL - Author Delete Problem

The form does have the field $PublicAccess = 1. However, I thought this only allowed users with No Access or Depositor access to read and view the documents.

Authors should only be able to delete documents that they create, not another person’s document. If an Author field is on the form, the user’s name must appear in that field and then they would be able to delete the document.

The group doesn’t even have the right to delete documents (Delete Documents - Not Checked) in the ACL.

4

Subject: RE: ACL - Author Delete Problem

Public documents need to be used with care, as the normal rules can’t really be applied to them.

First off, the access right (No access, depositor, editor, etc.) has no bearing on Public documents - the only ACL controls that effect them are the Read and Write flags, and Write allows delete. This is what allows you to let people see your calendar (as meetings are public) without them having any access to your e-mail.

Author fields don’t trump public access (to the best of my knowledge) - if a document is public, then it’s open to anyone who can write public documents. (i.e. You can’t have a semi-public document)

I’m unsure if Reader fields would be effective - I rather think they would, but that’s a guess.

5

Subject: RE: ACL - Author Delete Problem

Thanks Graham. That did fix the problem.

Tim

6

Subject: RE: ACL - Author Delete Problem

Hi Tim,

Could you please tell me how you fixed the problem? I am trying to do the same thing for my shared calendar but have been unsuccessful so far.

I want users to be able to view and create documents but restrict them from deleting same.

Unchecking the ‘Write public documents’ removes the right to even create documents and I need that.

Thank you.