Projects More |
PmWikiJa /
管理者パスワードadministrators (basic) PmWiki has built-in support for password-protecting? various areas of the wiki site. Passwords can be applied to individual pages, to Wiki Groups?, or to the entire wiki site. Note that the password protection mechanisms described here are only a small part of overall system (and wiki) security, see PmWiki.Security for more discussion of this. Authors can use PmWiki to add passwords to individual pages and WikiGroups as described in Passwords?. However, WikiAdministrators? can also set passwords in local/config.php as described below. PmWiki は、wiki サイトの様々なエリアでパスワード保護?を組込みサポートしています。 パスワードは、個々のページ、Wiki Group?、または、wikiサイト全体に適用することができます。 ここで説明されたパスワード保護メカニズムがシステム全体(そして、wiki)に対するセキュリティの一部分であるにすぎないことに注意してください、そして、この事に関するより多くの議論については、PmWiki.Securityを参照してください。 Passwords? で解説されるように、作者はパスワードを個々のページとWikiGroupsに加えるためにPmWikiを使うことができます。ただし、wiki管理者?は、下記のようにパスワードを local/config.php でセットすることもできます。 Password basics パスワードの基本PmWiki supports several levels of access to wiki pages: read passwords allow viewing the contents of wiki pages
edit passwords control editing and modification of wiki pages
attr passwords control who is able to set passwords on pages (and potentially other future attributes)
if uploads are enabled, upload passwords control uploading of files and attachments
Finally, there is an PmWikiは、wikiページへのいくつかのレベルのアクセスをサポートします: read パスワードは、wikiページコンテンツの表示を可能にします。
edit パスワードは、wikiページの編集と変更を制御します。
attr パスワードは、だれがページにパスワードを設定することができるかを制御します。(および、他の将来の属性への可能性)
もし、アップロードが可能であれば、 upload パスワードは、ファイルと付属のアップロードを制御します。
最終的には、管理者が個々のページかグループのために置かれるパスワードを打ち消すことを可能にする By default, PmWiki has the following password settings:
An See Passwords? for information about setting per-page and per-group passwords. The remainder of this page describes setting site-wide passwords from the local/config.php file. PmWiki は、デフォルトで以下のパスワード設定を持っています:
それ以外のどんなパスワードもアクセスを許さない"ロックされた"パスワードに打ち勝つのために、 グループ毎、ページ毎のパスワード設定に関する情報のため、Passwords? を参照してください。このページの残りの部分は、local/config.php ファイルからサイトワイドにパスワードをセットすることについて記述します。 Setting site-wide passwords サイトワイドパスワードの設定One of the first things an admin should do is set an Note that the crypt() call is required for this -- PmWiki stores and processes all passwords internally as encrypted strings. See the crypt section below for details about eliminating the cleartext password from the configuration file. To set the entire site to be editable only by those who know an "edit" password, add a line like the following to local/config.php: Similarly, you can set
This says that either "alpha" or "beta" can be used to read pages, but only the "beta" password will allow someone to edit a page. Since PmWiki remembers any passwords entered during the current session, the "beta" password will allow both reading and writing of pages, while the "alpha" password allows reading only. A person without either password would be unable to view pages at all. Identity-based authorization (username/password logins, AuthUser?)Unlike many systems which have identity-based systems for controlling access to pages (e.g., using a separate username and password for each person), PmWiki defaults to a password-based system as described above. In general password-based systems are often easier to maintain because they avoid the administrative overheads of creating user accounts, recovering lost passwords, and mapping usernames to permitted actions. However, PmWiki's authuser.php script augments the password-based system to allow access to pages based on a username and password combination. See AuthUser? for more details on controlling access to pages based on user identity. Security holes ...Administrators need to carefully plan where passwords are applied to avoid opening inadvertent security holes. If your wiki is open (anyone can read and edit), this would not seem to be a concern, except, a malicious or confused user could apply a read password to a group and make the group completely unavailable to all other users. At the very least, even an open wiki should have a site-wide "admin" password and a site-wide "attr" password set in config.php. The sample-config.php file distributed with PmWiki indicates that the PmWiki and Main groups have "attr" locked by default, but if anyone creates a new group, "attr" is unlocked. Administrators must remember to set "attr" passwords for each new group (if desired) in this case. An easier solution is to include these lines in config.php : $DefaultPasswords['admin'] = crypt('youradminpassword'); $DefaultPasswords['attr'] = crypt('yourattrpassword'); Encrypting passwords in config.phpOne drawback to using the crypt() function directly to set passwords in config.php is that anyone able to view the file will see the unencrypted password. For example, if config.php contains then the "mysecret" password is in plain text for others to see. However, a wiki administrator can obtain and use an encrypted form of the password directly by using The string returned from Note that in the encrypted form the crypt keyword and parentheses are removed, since the password is already encrypted. Also, the encrypted password must be in single quotes. In this example the password is still " Removing passwordsTo remove a site password entirely, such as the default locked password for uploads, just set it to empty: You can also use the special password "@nopass" via Revoking or invalidating passwordsIf a password is compromised and the wiki administrator wants to quickly invalidate all uses of that password on a site, a quick solution is the following in local/config.php: $ForbiddenPasswords = array('secret', 'tanstaafl'); if (in_array(@$_POST['authpw'], $ForbiddenPasswords)) unset($_POST['authpw']); This prevents "secret" and "tanstaafl" from ever being accepted as a valid authorization password, regardless of what pages may be using it. See Also
Protecting actions (example)Each action can be password protected. Cookbook authors providing scripts with own actions can use this also, but I'll limit the example to a (by default) not protected There are several solutions for that:
In general, adding the prefix 'passwd' to an action name in the The full set of steps to add new password handling for an action such as "diff" would be: # add a new (encrypted) field to the attr page $PageAttributes['passwddiff'] = '$[Set new history password]'; # clear the default password for 'diff' $DefaultPasswords['diff'] = ''; # Tell PmWiki that the 'diff' password allows action 'diff'. $HandleAuth['diff'] = 'diff'; # Tell PmWiki that a 'read' password # (or optionally the 'edit') password # is also sufficient to enable 'diff'. # Of course, the 'admin' password will work too. $AuthCascade['diff'] = 'read'; ## or 'edit' << | DocumentationIndex? | >> There seems to be a default password. What is it? There isn't any valid password until you set one. PasswordsAdmin? describes how to set one. PmWiki comes "out of the box" with How do I use passwd-formatted files (like .htpasswd) for authentication? See AuthUser? or Cookbook:UserAuth Is there anything I can enter in a GroupAttributes field to say 'same as the admin password'? If not, is there anything I can put into the config.php file to have the same effect? For the sitewide edit password (in config.php), use '@_site_edit'. I haven't tested this, but I think one can also use '@_site_admin', '@_site_read', '@_site_attr', etc. for the other site-wide passwords set in config.php. '@admin' is used to specify the site admin password. How do I edit protect, say, all RecentChanges pages? (needs answer) |