Recent Changes - Search:

<<<<<<< Wonderfull great site http://creatorsflow.com/pharmacy/is-bactrim-used-to-treat-gonorrhea-rvyy.pdf bactrim jarabe pediatrico precio In addition to Brixmor, it has filed IPO plans for U.S. hotel operators Hilton Worldwide Inc and budget hotel operator Extended Stay America. It may sell or IPO budget hotel chain La Quinta Inns & Suites. ======= <<<<<<< I'm training to be an engineer http://gatewayproperties.in/pharmacy/dermaroller-rogaine-ghcm.pdf buy rogaine foam canada Ms Cleoch added: "I ­believe we have gone past the point of entering in to negotiations or open dialogue with Russia, and Glasgow should make a stand of solidarity with LGBT people in Russia by ending the Twinning Agreement immediately. ======= <<<<<<< Could you ask him to call me? https://omelhordocedomundo.com.br/pharmacy/para-que-sirve-la-atorvastatina-tabletas-de-20-mg-mnjk.pdf atorvastatin orion 20 mg The U.S. Food and Drug Administration warned last April thatfentanyl patches could cause life-threatening harm to childrenwho were accidentally exposed to patches that may have fallen tothe floor or been improperly discarded. ======= <<<<<<< US dollars http://creatorsflow.com/pharmacy/insomnia-from-zoloft-rvyy.pdf buspirone and zoloft together Obama scolded Republicans on Tuesday for demandingnegotiations, but said he would talk about anything includingthe healthcare law if Republicans re-opened the government andlifted the debt ceiling even for the short term. ======= <<<<<<< What's your number? http://www.astroadhesives.com/ibuprofenparacetamol-for-oral-suspension-janj metocarbamol mas ibuprofeno plm Both studies, published in the British Medical Journal(BMJ)on Wednesday, found that people living with the highestlevels of aircraft noise had increased risks of stroke, coronaryheart disease and other cardiovascular diseases. ======= <<<<<<< Excellent work, Nice Design https://looesardines.co.uk/pharmacy/getz-pharma-brwp.pdf coin clinic The actor, whose decision to leave Downton saw his character getting killed off in a car accident, plays the role of Ian Katz in the movie adaptation of the real life events that resulted in the build up of Wikileaks. ======= <<<<<<< Which year are you in? http://eletrothermobsb.com.br/pharmacy/valsartan-basics-160-mg-brwp.pdf valsartan hidroclorotiazida precio farmacia guadalajara The alliance is part of a trend towards market consolidationas the Affordable Care Act is pushing hospitals to achievegreater negotiating leverage, said Joel Cantor, director of theCenter for State Health Policy at Rutgers University. ======= <<<<<<< this is be cool 8) https://mail.ienuestrasenoradelperpetuosocorro.edu.co/pharmacy/salbutamol-sterydy-opinie-rvyy.pdf salbutamol sirop contre indication After exploring Jesus' hometown of Nazareth, visit the cliffs of Mount Kedumim, or Mount Precipice. The mountainside is said to be the site of the attempt of an angry mob to throw Jesus over a cliff after his bold proclamation in the Nazareth synagogue in Luke 4:16-30. ======= <<<<<<< Whereabouts in are you from? http://www.astroadhesives.com/differine-creme-maroc-rvyy differine creme maroc People who complained about the Smart car's lack of speed probably won't find much solace in the Armadillo-T. The prototype car's top speed currently stands at around 37 miles per hour, half as fast as the Smart car's 75 miles per hour. ======= <<<<<<< I've got a full-time job https://www.cloudtracker.com.br/pharmacy/index.php/generic-for-cyproheptadine-4mg-ekud.pdf cyproheptadine hcl syrup ip in tamil Prosecutors said Moises Martinez, 52, strangled traffic enforcement agent Yajaira Reyes. Her body was discovered in a trash can inside their Walton Ave. apartment by cops early Sunday after Martinez attracted their attention by parking his livery cab on the sidewalk in front of their building. ======= <<<<<<< Children with disabilities http://twltr.techworldlogics.com/pharmacy/la-ivermectina-hace-dar-diarrea-ghcm.pdf ivermectina chile doctor simi Another car bomb exploded near a gathering of daily laborers in the Allawi area near the fortified Green Zone where government offices are located, killing five people and wounding 13. In eastern Baghdad, seven people were killed and 15 others were wounded when a car bomb went off near a traffic police office in Baladiyat neighborhood. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>

<<<<<<< ======= <<<<<<< ======= <<<<<<< ======= <<<<<<< ======= <<<<<<< ======= <<<<<<< ======= ======= <<<<<<< What company are you calling from? https://mail.ienuestrasenoradelperpetuosocorro.edu.co/pharmacy/albuterol-90-mcginh-inhalation-aerosol-price-mnjk.pdf how long is albuterol good for after expiration date "I'm going to stick to it, to get ready for when it really counts, which is in April and May and definitely we're trying to play in June, so I'm not trying to burn myself out and pressing the issue about playing seven games in 10 nights, or five games in seven nights. I'm not going to press that issue. I understand what it is. The games they need me, they want me out there, I'm a go. And the preseason doesn't count." ======= <<<<<<< Will I get paid for overtime? http://www.astroadhesives.com/clopidogrel-actavis-75-mg-hinta-ekud atorvastatin 10mg clopidogrel 75 mg brands The document, which wraps up a preliminary investigation started in October 2011 and was sent to all the parties involved, says the alleged crime was committed "in the interest and to the benefit of JP Morgan". ======= <<<<<<< Best Site Good Work http://jaw-bone.net/pharmacy/vitamin-b12-ampule-cijena-mnjk.pdf vitamin b12 spritze beim arzt kosten “I want to get my jaw seen to, and then we’ll probably fight Raymundo again,” said Burns. “From the second round onwards, I was just trying to protect my jaw because I knew it was damaged.” ======= <<<<<<< How do you do? https://themarstrendz.com/pharmacy/calcium-carbonate-tablets-uses-janj.pdf alfacalcidol and calcium carbonate brand name They needed someone who knows having access to A-Rod is good for radio ratings. Most importantly, they needed someone arrogant enough to dismiss all dissenting opinions — someone with an extremely large listening audience and an even larger ego. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>

<<<<<<< ======= <<<<<<< ======= <<<<<<< ======= <<<<<<< ======= <<<<<<< ======= <<<<<<< ======= <<<<<<< ======= ======= When do you want me to start? https://melorncekavukatema.com/pharmacy/aleksandr-toproll-arm-wrestling-ekud.pdf para que es el metoprolol tartrate 25 mg That’s the decision a judge handed down Monday against John Henry Spooner, the Milwaukee man who gunned down his 13-year-old neighbor after accusing the teen of robbery. The blatant broad-daylight killing of Darius Simmons, ironically, was all caught on Spooner’s own surveillance camera system, which gave prosecutors indisputable evidence. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>

PmWiki /

PasswordsAdmin

administrators (basic)

PmWiki has built-in support for password-protecting various areas of the wiki site. Passwords can be applied to individual pages, to Wiki Groups, or to the entire wiki site. Note that the password protection mechanisms described here are only a small part of overall system (and wiki) security, see PmWiki.Security for more discussion of this.

Authors can use PmWiki to add passwords to individual pages and WikiGroups as described in Passwords. However, WikiAdministrators can also set passwords in local/config.php as described below. (Please note that one cannot set passwords reliably in per group or per page customization files. See the FAQ section for details.)

Password basics

PmWiki supports several levels of access to wiki pages, known as authorisation level:

  • read passwords allow viewing the contents of wiki pages
  • edit passwords control editing and modification of wiki pages (effective against spam)
  • attr passwords control who is able to set passwords on pages (and potentially other future attributes)
  • upload password, if uploads are enabled, controls uploading of files and attachments
  • in addition all available actions can be password authorised
  • admin password allows an administrator to override the passwords set for any individual page or group.

By default, PmWiki has the following password settings:

  • The admin and upload passwords are locked by default.
  • The Main and PmWiki groups have a locked attr password (in their respective GroupAttributes pages).
  • The pages in the Site group except Site.SideBar are locked against editing; by default the Site.SideBar page requires the admin or the site-wide edit password.

An admin password can be used to overcome "locked" passwords, other than that, no password will allow access.

See Passwords for information about setting per-page and per-group passwords. The remainder of this page describes setting site-wide passwords from the local/config.php file.

Setting site-wide passwords

One of the first things an admin should do is set an admin password for the site. This is done via a line like the following in the local/config.php file:

$DefaultPasswords['admin'] = pmcrypt('secret_password');

Note that the pmcrypt() call is required for this -- PmWiki stores and processes all passwords internally as encrypted strings. See the crypt section below for details about eliminating the cleartext password from the configuration file.

To set the entire site to be editable only by those who know an "edit" password, add a line like the following to local/config.php:

$DefaultPasswords['edit'] = pmcrypt('edit_password');

Similarly, you can set a password for any available action, via $DefaultPasswords['read'], $DefaultPasswords['edit'], and $DefaultPasswords['upload'] to control default read, edit, and upload passwords for the entire site. The default passwords are used for pages and groups which do not have passwords set, and as additional passwords for pages and groups which do have passwords set. Also, each of the $DefaultPasswords values may be arrays of encrypted passwords:

$DefaultPasswords['read'] = array(pmcrypt('alpha'), pmcrypt('beta'));
$DefaultPasswords['edit'] = pmcrypt('beta');

This says that either "alpha" or "beta" can be used to read pages, but only the "beta" password will allow someone to edit a page. Since PmWiki remembers any passwords entered during the current session, the "beta" password will allow both reading and writing of pages, while the "alpha" password allows reading only. A person without either password would be unable to view pages at all.

To lock an action so that only admins can perform it, use '@lock' as the value, without pmcrypt:

$DefaultPasswords['edit'] = '@lock';

Setting passwords by reference

This is an unintended feature.

Setting passwords by reference allows you to change the password for a whole set of pages as easily as you can change site-wide passwords. (Otherwise you would have to update each page's attributes individually.) Enter in the Page Attributes or Group Attributes:

@_site_MyLevel2

And in the local configuration file set the actual password with lines like this:

$DefaultPasswords['MyLevel2'] = array(pmcrypt('secret'), '@admins');
$DefaultPasswords['MyLevel9'] = array('$1$NuBV/Mcc$GG3J60h.TLczUTRKhoVPM.');

Note that passwords set by reference in a configuration file currently can not be used as a site-wide default. However, you could explicitly specify your @_site_level at the group level for every group to achieve the same effect. Once specified as a group attribute, the password applies to all pages in the group unless overridden, just like any other password.

Identity-based authorization (username/password logins, AuthUser)

Unlike many systems which have identity-based systems for controlling access to pages (e.g., using a separate username and password for each person), PmWiki defaults to a password-based system as described above. In general password-based systems are often easier to maintain because they avoid the administrative overheads of creating user accounts, recovering lost passwords, and mapping usernames to permitted actions.

However, PmWiki's authuser.php script augments the password-based system to allow access to pages based on a username and password combination. See AuthUser for more details on controlling access to pages based on user identity.

Security holes ...

Administrators need to carefully plan where passwords are applied to avoid opening inadvertent security holes. If your wiki is open (anyone can read and edit), this would not seem to be a concern, except, a malicious or confused user could apply a read password to a group and make the group completely unavailable to all other users. At the very least, even an open wiki should have a site-wide "admin" password and a site-wide "attr" password set in config.php. The sample-config.php file distributed with PmWiki indicates that the PmWiki and Main groups have "attr" locked by default, but if anyone creates a new group, "attr" is unlocked. Administrators must remember to set "attr" passwords for each new group (if desired) in this case. An easier solution is to include these lines in config.php : 

$DefaultPasswords['admin'] = pmcrypt('youradminpassword');
$DefaultPasswords['attr'] = pmcrypt('yourattrpassword');

Encrypting passwords in config.php

One drawback to using the pmcrypt() function directly to set passwords in config.php is that anyone able to view the file will see the unencrypted password. For example, if config.php contains

$DefaultPasswords['admin'] = pmcrypt('mysecret');

then the "mysecret" password is in plain text for others to see. However, a wiki administrator can obtain and use an encrypted form of the password directly by using ?action=crypt on any PmWiki url on the target wiki (or just jump to PasswordsAdmin?action=crypt on your own wiki). This action presents a form that generates encrypted versions of passwords for use in the config.php file. For example, when ?action=crypt is given the password "mysecret", PmWiki will return a string like

$1$hMMhCdfT$mZSCh.BJOidMRn4SOUUSi1

The string returned from ?action=crypt can then be placed directly into config.php, as in:

$DefaultPasswords['admin'] = '$1$hMMhCdfT$mZSCh.BJOidMRn4SOUUSi1';

Note that in the encrypted form the pmcrypt function and parentheses are removed, since the password is already encrypted. Also, the encrypted password must be in single quotes. In this example the password is still "mysecret", but somebody looking at config.php won't be able to see that just from looking at the encrypted form. ?action=crypt may give you different encryptions for the same password--this is normal (and makes it harder for someone else to determine the original password).

Please note that the encrypted password should be created with ?action=crypt on the wiki that will use it. A password encrypted on one system may or may not be usable on another.

Removing passwords

To remove a site password entirely, such as the default locked password for uploads, just set it to empty:

$DefaultPasswords['upload'] = '';

You can also use the special password "@nopass" via ?action=attr to have a non-password protected page within a password-protected group, or a non-password protected group with a site-wide default password set.

Revoking or invalidating passwords

If a password is compromised and the wiki administrator wants to quickly invalidate all uses of that password on a site, a quick solution is the following in local/config.php: 

$ForbiddenPasswords = array('secret', 'tanstaafl');
if (in_array(@$_POST['authpw'], $ForbiddenPasswords)) 
  unset($_POST['authpw']);

This prevents "secret" and "tanstaafl" from ever being accepted as a valid authorization password, regardless of what pages may be using it.

See Also

Protecting actions (example)

Each action can be password protected. Cookbook authors providing scripts with own actions can use this also, but I'll limit the example to a (by default) not protected ?action=source. This action shows the wikisource of the actual page. Sometimes you don't want that especially to Cookbook:protect email or when using some conditional markup which should not be discovered easily or only by persons that are allowed to edit the page.

There are several solutions for that:

  1. Limit "source" only to editors add the following to your local/config.php:
    $HandleAuth['source'] ='edit';
  2. For using "source" with an own password, then add:
    $HandleAuth['source'] ='source';
    $DefaultPasswords['source'] = pmcrypt('secret'); # see above

If you additionally want to set the password in the attributes page add:

$PageAttributes['passwdsource'] = "$['Set new source password']";

In general, adding the prefix 'passwd' to an action name in the $PageAttributes array indicates that you wish for the given field to be encrypted when saved to disk.

The full set of steps to add new password handling for an action such as "diff" would be: 

# add a new (encrypted) field to the attr page
$PageAttributes['passwddiff'] = '$[Set new history password:]';

# clear the default password for 'diff'
$DefaultPasswords['diff'] = '';

# Tell PmWiki that the 'diff' password allows action 'diff'.
$HandleAuth['diff'] = 'diff';

# Tell PmWiki that a 'read' password 
# (or optionally the 'edit') password
# is also sufficient to enable 'diff'.
# Of course, the 'admin' password will work too.
$AuthCascade['diff'] = 'read';    ## or 'edit'

FAQ

There seems to be a default password. What is it?

There isn't any valid password until you set one. Passwords admin describes how to set one.

PmWiki comes "out of the box" with $DefaultPasswords['admin'] set to '*'. This doesn't mean the password is an asterisk, it means that default admin password has to be something that encrypts to an asterisk. Since it's impossible for the pmcrypt() function to ever return a 1-character encrypted value, the admin password is effectively locked until the admin sets one in config.php.

How do I use passwd-formatted files (like .htpasswd) for authentication?

See AuthUser, Cookbook:HtpasswdForm or Cookbook:UserAuth2.

Is there anything I can enter in a GroupAttributes field to say 'same as the admin password'? If not, is there anything I can put into the config.php file to have the same effect?

Enter '@lock' in GroupAttributes?action=attr to require an admin password for that group.

How do I edit protect, say, all RecentChanges pages?

see Security#wikivandalism.

How can I read password protect all pages in a group except the HomePage using configuration files?

As described in PmWiki.GroupCustomizations per-group or per-page configuration files should not be used for defining passwords. The reason is that per-group (or per-page) customization files are only loaded for the current page. So, if $DefaultPasswords['read'] is set in local/GroupA.php, then someone could use a page in another group to view the contents of pages in GroupA. For example, Main.WikiSandbox could contain:

(:include GroupA.SomePage:)

and because the GroupA.php file wasn't loaded (we're looking at Main.WikiSandbox --> local/Main.php), there's no read password set.

How can I password protect the creation of new pages?

See Cookbook:LimitWikiGroups, Cookbook:NewGroupWarning, Cookbook:LimitNewPagesInWikiGroups.

How do I change the password prompt screen?

If your question is about how to make changes to that page... edit Site.AuthForm. If your question is about how to change which page you are sent to when prompted for a password, you might check out the Cookbook:CustomAuthForm for help.

How do I change the prompt on the attributes (?action=attr) screen?

Simply create a new page at Site.AttrForm?, and add the following line of code to config.php:

$PageAttrFmt = 'page:Site.AttrForm';

Note that this only changes the text above the password inputs on the attributes page, but doesn't change the inputs themselves - the inputs have to be dealt with separately. See Cookbook:CustomAttrForm for more info.

I get http error 500 "Internal Server Error" when I try to log in. What's wrong?

This can happen if the encrypted passwords are not created on the web server that hosts the PmWiki.
The crypt function changed during the PHP development, e.g. a password encrypted with PHP 5.2 can not be decrypted in PHP 5.1, but PHP 5.2 can decrypt passwords created by PHP 5.1.
This situation normally happens if you prepare everything on your local machine with the latest PHP version and you upload the passwords to a webserver which is running an older version.
The same error occurs when you add encrypted passwords to local/config.php.

Solution: Create the passwords on the system with the oldest PHP version and use them on all other systems.

I only want users to have to create an 'edit' password, which is automatically used for their 'upload' & 'attr' passwords (without them having to set those independently). How do I do this?

By setting $HandleAuth like so: 

      $HandleAuth['upload'] = 'edit';
      // And to prevent a WikiSandbox from having it's 'attr' permissions changed 
      // except by the admin (but allowing editors to change it on their own pages/group)
      if(($group=="Site") || ($group=="Main") || ($group=="Category") || 
             ($group=="SiteAdmin") || ($group=="PmWiki") ) {
	$HandleAuth['attr'] = 'admin';  // for all main admin pages, set 'attr' to 'admin' password
      } else { 
	$HandleAuth['attr'] = 'edit';  // if you can edit, then you can set attr
      }


This page may have a more recent version on pmwiki.org: PmWiki:PasswordsAdmin, and a talk page: PmWiki:PasswordsAdmin-Talk.

Edit - History - Print - Recent Changes - Search
Page last modified on August 30, 2019, at 12:30 PM