From 7d9dd4e4a9811f711edb4a7ee9fe984460bf0caa Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 7 Nov 2026 13:32:56 +0000
Subject: [PATCH] site/org: installed; rights before pages; objects as XML

The first run on starshipos-f18.org created the dashboards, then XWiki
refused the group and rights objects: a form-encoded POST needs XWiki's
form token (CSRF), an XML one does not. For about two minutes Admin.WebHome
and Contributors.WebHome were readable by guests (links and the names of
secrets, no values). Objects now go as XML, and the spaces' rights are made
before the pages, so a failed run cannot leave a dashboard open. Installed:
Main 200, Admin and Contributors 401 as a guest, 200 as rajames; a second
run changes nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2
---
 site/org/install.sh | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/site/org/install.sh b/site/org/install.sh
index 3d241faf..2310315a 100755
--- a/site/org/install.sh
+++ b/site/org/install.sh
@@ -46,18 +46,20 @@ objects() {     # objects <space> <page> <class>: how many the page has
         python3 -c 'import json,sys; print(len(json.load(sys.stdin).get("objectSummaries") or []))'
 }
 object() {      # object <space> <page> <class> <property=value>...: add one
+    # as XML: XWiki refuses a form-encoded POST without its form token (CSRF), not an XML one
     local s=$1 p=$2 c=$3; shift 3
-    local args=(--data-urlencode "className=$c")
-    for kv in "$@"; do args+=(--data-urlencode "property#$kv"); done
-    curl -fsS -o /dev/null -w "  $s.$p: $c added (%{http_code})\n" "${auth[@]}" -X POST "${args[@]}" \
-        "$rest/spaces/$s/pages/$p/objects"
+    local body
+    body=$(python3 -c '
+import sys
+from xml.sax.saxutils import escape
+props = "".join("<property name=\"%s\"><value>%s</value></property>" % (escape(k), escape(v))
+                for k, v in (a.split("=", 1) for a in sys.argv[2:]))
+print("<object xmlns=\"http://www.xwiki.org\"><className>%s</className>%s</object>" % (escape(sys.argv[1]), props))' "$c" "$@")
+    curl -fsS -o /dev/null -w "  $s.$p: $c added (%{http_code})\n" "${auth[@]}" -X POST \
+        -H 'Content-Type: application/xml' --data-binary "$body" "$rest/spaces/$s/pages/$p/objects"
 }
 
 echo "=== $base, as $user"
-page Main WebHome "StarshipOS" Main.WebHome.xwiki
-page Admin WebHome "Admin Dashboard" Admin.WebHome.xwiki
-page Contributors WebHome "Contributors' Dashboard" Contributors.WebHome.xwiki
-
 echo "=== the group $group"
 page XWiki StarshipContributors "Starship Contributors"
 if [ "$(objects XWiki StarshipContributors XWiki.XWikiGroups)" = 0 ]; then
@@ -84,6 +86,11 @@ else
     echo "  Contributors: rights there already, left as they are"
 fi
 
+echo "=== the pages -- after their spaces' rights, so a dashboard is never readable without them"
+page Main WebHome "StarshipOS" Main.WebHome.xwiki
+page Admin WebHome "Admin Dashboard" Admin.WebHome.xwiki
+page Contributors WebHome "Contributors' Dashboard" Contributors.WebHome.xwiki
+
 echo "=== as a guest"
 bad=
 for p in Main Admin Contributors; do