Item6595: Notifications fail when ALLOWWEBVIEW is used and users follow the example to subscribe

Notification does not work when ALLOWWEBVIEW is set and email addresses are given

Symptom: We found that on webs where I have ALLOWWEBVIEW set to something (i.e. non-null) users were never notified of any changes. Investigation found that mailnotify properly figures out what the changes are, but failed to send any emails. checkAccessPermission in Access.pm returns 0 (so no mail is sent) because "access not allowed on web" for any user, even if the user was allowed to access the web.

We found that the following was the problem:

The users followed the example from the TWiki documentation for the WebNotify topic):

   * Main.TWikiGuest - guest@example.com
   * Main.RayMikkelson - Ray.Mikkelson@example.com

It turns out that if you do this, the code looks for the email address as a user, and obviously, it cannot find that user in the access list (It ignores the part of the line that actually gave the user wiki name and uses the email instead.)

The following, however works: On the WebNotify page, you must put the entries like so:

   * Main.TWikiGuest 
   * Main.RayMikkelson

It is not clear whether this is a bug or a problem with the documentation. But either the code or the documentation has to change, as a beginning user following precisely the documentation will be disappointed not receiving any notifications.

In fact, at the bottom of the WebChangesAlert (not the WebNotify topic) topic, there is a warning message:

Warning: Because an email address is not linked to a user name, there is no way for TWiki to check access controls for subscribers identified by email addresses. A subscriber identified by an email address alone will only be sent change notifications if the topic they are subscribed to is readable by guest users.

In any case, the suggestion is:

• Add an example to the documentation without the email address which works in any case.
• Then either
  • fix the notification code so that it checks for access permissions using the wiki name indicated and uses the email indicated for mailing, or
  • state in the documentation that if the email address is given, this only works for topics that TWikiGuest has read access to.

TWiki:Main/RayMikkelson

Thanks Ray. Originally posted at TWiki:Support.SID-00994.

-- TWiki:Main.PeterThoeny - 2010-10-12

Simplified the original bug report to be clearer understandable.

-- ThomasWeigert - 2010-12-29