CreditorDebtor.com | PmWiki / SecurityVariables

$AllowPassword

This variable used to contain the special "nopass" password which was used in the past to leave pages or groups accessible without a password. Recent PmWiki versions use "@nopass" instead, and this variable is set to false and PmWiki no longer checks if pages have a special "allowed password". If your wiki is old and/or may contain pages with the "nopass" password, you should locate them and replace them with "@nopass", or if you cannot, set this variable to "nopass".

$PmCryptAlgo

Allows to select a hashing algorithm for new password hashes created in pmcrypt(), other than the default one for your PHP version. Existing hashes with a different algorithm can still be checked.

$PmCryptAlgo = PASSWORD_ARGON2ID;

$RehashedPassword

[Removed] This variable contained a new hash for the last checked password, if the existing hash was less secure. It was removed in PmWiki 2.5.0 but a new helper function was added for addons to call:

## previous usage, before 2.5.0
#  global $RehashedPassword;
#  if ($RehashedPassword) { /* store $RehashedPassword for the current user*/ }
## current usage, since 2.5.0
$newhash = rehash_password($pass, $hash);
if ($newhash) { /* store $newhash for the current user*/ }

$AuthUserPageFmt

Specifies page names in which the authuser script should check for account names and passwords. See AuthUser#accountsfromotherpages.

$DefaultPasswords

Specifies default passwords for user admin or actions (edit, read, upload). See PasswordsAdmin#settingsitewidepasswords.

$DenyHtaccessContent

Specifies the default content for .htaccess files created by PmWiki in new directories under wiki.d. The Apache server changed these directives in version 2.4. The default value should work for both new and older server versions.

$EnablePostAttrClearSession

A switch to control whether or not changing a page's attributes causes any existing passwords to be forgotten. The default is that changing attributes forgets any passwords entered; this can be changed by setting $EnablePostAttrClearSession to zero.

$EnableSessionPasswords

Control whether passwords are saved as part of the session. If set to zero, then session passwords are never saved (although any AuthUser authentications are still remembered).

$SetCookieFunction

A custom function name to send cookies to the browser, instead of pmsetcookie(). Should accept the same arguments as pmsetcookie().

$EnableCookieSecure

Set to 1 to enable the "Secure" flag for core PmWiki cookies (will only be transmitted via HTTPS). This includes author, preference, and cache core cookies and any custom cookies set via pmsetcookie().
Note: the session cookie and all other PmWiki cookies are affected.

$EnableCookieHTTPOnly

Set to 1 to enable the "HttpOnly" flag for core PmWiki cookies (will not be made available to JavaScript). This includes author, preference, and cache core cookies and any custom cookies set via pmsetcookie().
Note: the session cookie and all other PmWiki cookies are affected.

$CookieSameSite

The "SameSite" flag for cookies sent via pmsetcookie(), default to 'Lax'. See article about the implications.

$SessionEncode

Function to use to encode sensitive information in sessions. Set this to NULL if you want to not use any encoding. (See also $SessionDecode below.)

$SessionDecode

Function to reverse the decoding given by $SessionEncode above. Set this to NULL if sensitive session values are not encoded.

$HandleAuth

This sets the required authentication Level that is necessary to perform an action. When using the following example in your config.php you need to be authenticated as editor in order to view the page history:

$HandleAuth['diff'] = 'edit';

$PageAttributes

Set the string shown on the attributes page when entering a password for an action.

$AuthLDAPBindDN

For sites using AuthUser with LDAP authentication, this specifies the distinguished name (DN) to be used to bind to the LDAP server to check identity.

$AuthLDAPBindPassword

For AuthUser with LDAP authentication, this specifies the password used for binding (in conjunction with $AuthLDAPBindDN above).

$AuthLDAPReferrals

Specifies whether to automatically follow referrals returned by the LDAP server, set 1 to enable or 0 to disable. By default this variable is unset, and the connection follows referrals if they are enabled on the server side (they usually are).

$MultiFactorAuthFunction

(AuthUser only) A custom function to perform a check for multi-factor-authentication (MFA, 2FA). Called by AuthUserId() if the password authentication has succeeded. This function is called with arguments the username and password, and should return true if the 2FA has succeeded, false otherwise.

$FailedLoginsFunction

(AuthUser only) A custom function to perform a check for multiple failed logins, see Cookbook:FailedLoginFunction.

$EnablePublishAttr

Adds a new "publish" authorization level to distinguish editing of drafts from publishing - See $EnableDrafts.

$EnablePageVarAuth

In PmWiki versions 2.2.22 and 2.2.23 this variable should be set to 0. In 2.2.24 it will no longer be used.

$RobotActions

An array controlling which actions can be reached by web bots. The array keys are the actions, if the value is 1 or true then the action is reachable. If an action is not defined as a key, or if the value for that key evaluates to false or zero, when a bot requests this action it will be refused. By default, only the actions "browse", "rss" and "dc" are reachable by bots. For example:
$RobotActions['download'] = 1; # allow bots to download files with disabled $EnableDirectDownload (page permissions are respected)
$RobotActions['rss'] = 0; # disallow bots from getting the RSS feed
$RobotActions['print'] = 1; # allow bots to get the print view
The variable can have custom actions used by cookbook recipes as keys.

$RobotPattern

A regular expression pattern with known user-agent strings for bots.

$EnableRobotCloakActions

Setting this flag to 1 will eliminate any forbidden ?action= values from page links returned to robots, which will reduce bandwidth loads from robots even further.

$AuthFormRespCode

A custom HTTP response status code to be sent to the browser with the Authentication form. The form is still displayed and the user can type the password to access the restricted page of file. For example, to send "403 Forbidden" status code for restricted downloads (see $EnableDirectDownload), you can set in config.php:

if ($action == 'download')
  $AuthFormRespCode = 403;

From CreditorDebtor.com

PmWiki: SecurityVariables