Deprecated: function_exists(): Passing null to parameter #1 ($function) of type string is deprecated in /home/astro/public_html/pmwiki/pmwiki.php on line 1309

Deprecated: preg_replace_callback(): Passing null to parameter #3 ($subject) of type array|string is deprecated in /home/astro/public_html/pmwiki/pmwiki.php on line 1475

Deprecated: preg_replace_callback(): Passing null to parameter #3 ($subject) of type array|string is deprecated in /home/astro/public_html/pmwiki/pmwiki.php on line 460

Deprecated: preg_match(): Passing null to parameter #2 ($subject) of type string is deprecated in /home/astro/public_html/pmwiki/scripts/wikistyles.php on line 130

Deprecated: preg_replace_callback(): Passing null to parameter #3 ($subject) of type array|string is deprecated in /home/astro/public_html/pmwiki/pmwiki.php on line 1475

Deprecated: preg_match(): Passing null to parameter #2 ($subject) of type string is deprecated in /home/astro/public_html/pmwiki/scripts/wikistyles.php on line 130

Deprecated: preg_replace_callback(): Passing null to parameter #3 ($subject) of type array|string is deprecated in /home/astro/public_html/pmwiki/pmwiki.php on line 1475

Deprecated: preg_match(): Passing null to parameter #2 ($subject) of type string is deprecated in /home/astro/public_html/pmwiki/scripts/wikistyles.php on line 130

Deprecated: preg_replace_callback(): Passing null to parameter #3 ($subject) of type array|string is deprecated in /home/astro/public_html/pmwiki/pmwiki.php on line 1475

Deprecated: preg_match(): Passing null to parameter #2 ($subject) of type string is deprecated in /home/astro/public_html/pmwiki/scripts/wikistyles.php on line 130

Deprecated: preg_replace_callback(): Passing null to parameter #3 ($subject) of type array|string is deprecated in /home/astro/public_html/pmwiki/pmwiki.php on line 1475

Deprecated: preg_match(): Passing null to parameter #2 ($subject) of type string is deprecated in /home/astro/public_html/pmwiki/scripts/wikistyles.php on line 130

Deprecated: strlen(): Passing null to parameter #1 ($string) of type string is deprecated in /home/astro/public_html/pmwiki/pmwiki.php on line 1633

Deprecated: strlen(): Passing null to parameter #1 ($string) of type string is deprecated in /home/astro/public_html/pmwiki/pmwiki.php on line 1634

• View
• Edit
• History
• Print
• Backlinks

Security Variables

%apply=item id=Allow Password?%$AllowPassword

This variable contains the special "nopass" password which was used in the past to leave pages or groups accessible without a password. Recent Pm Wiki versions use "@nopass" instead. If your wiki is old and/or may contain pages with the "nopass" password, you should not change it. If that variable is empty or set to false, Pm Wiki will not check if pages have a special "allowed password".

%apply=item id=Default Passwords?%$DefaultPasswords

Specifies default passwords for user admin or actions (edit, read, upload). See PasswordsAdmin#settingsitewidepasswords.

%apply=item id=Deny Htaccess Content?%$DenyHtaccessContent

Specifies the default content for .htaccess files created by Pm Wiki in new directories under wiki.d. The Apache server changed these directives in version 2.4. The default value should work for both new and older server versions.

%apply=item id=Enable Post Attr Clear Session?%$EnablePostAttrClearSession

A switch to control whether or not changing a page's attributes causes any existing passwords to be forgotten. The default is that changing attributes forgets any passwords entered; this can be changed by setting $EnablePostAttrClearSession to zero.

%apply=item id=Enable Session Passwords?%$EnableSessionPasswords

Control whether passwords are saved as part of the session. If set to zero, then session passwords are never saved (although any AuthUser authentications are still remembered).

%apply=item id=Set Cookie Function?%$SetCookieFunction

A custom function name to send cookies to the browser, instead of pmsetcookie(). Should accept the same arguments as pmsetcookie().

%apply=item id=Enable Cookie Secure?%$EnableCookieSecure

Set to 1 to enable the "Secure" flag for core Pm Wiki cookies (will only be transmitted via HTTPS). This includes author, preference, and cache core cookies and any custom cookies set via pmsetcookie().
Note: for the session cookie, you need to also add this line: @ini_set('session.cookie_secure', true);
Add these lines near the beginning of config.php.

%apply=item id=Enable Cookie HTTP Only?%$EnableCookieHTTPOnly

Set to 1 to enable the "HttpOnly" flag for core Pm Wiki cookies (will not be made available to Java Script?). This includes author, preference, and cache core cookies and any custom cookies set via pmsetcookie().
Note: for the session cookie, you need to also add this line: @ini_set('session.cookie_httponly', true);
Add these lines near the beginning of config.php.

%apply=item id=Session Encode?%$SessionEncode

Function to use to encode sensitive information in sessions. Set this to NULL if you want to not use any encoding. (See also $SessionDecode below.)

%apply=item id=Session Decode?%$SessionDecode

Function to reverse the decoding given by $SessionEncode above. Set this to NULL if sensitive session values are not encoded.

%apply=item id=Handle Auth?%$HandleAuth

This sets the required authentication Level that is necessary to perform an action. When using the following example in your config.php you need to be authenticated as editor in order to view the page history:

        $HandleAuth['diff'] = 'edit';

%apply=item id=Page Attributes?%$PageAttributes

Set the string shown on the attributes page when entering a password for an action.

%apply=item id=Auth LDAP Bind DN?%$AuthLDAPBindDN

For sites using AuthUser with LDAP authentication, this specifies the distinguished name (DN) to be used to bind to the LDAP server to check identity.

%apply=item id=Auth LDAP Bind Password?%$AuthLDAPBindPassword

For AuthUser with LDAP authentication, this specifies the password used for binding (in conjunction with $AuthLDAPBindDN above).

%apply=item id=Auth LDAP Referrals?%$AuthLDAPReferrals

Specifies whether to automatically follow referrals returned by the LDAP server, set 1 to enable or 0 to disable. By default this variable is unset, and the connection follows referrals if they are enabled on the server side (they usually are).

%apply=item id=Enable Publish Attr?%$EnablePublishAttr

Adds a new "publish" authorization level to distinguish editing of drafts from publishing - See $EnableDrafts.

%apply=item id=Enable Page Var Auth?%$EnablePageVarAuth

In Pm Wiki versions 2.2.22 and 2.2.23 this variable should be set to 0. In 2.2.24 it will no longer be used.

%apply=item id=Robot Actions?%$RobotActions

An array controlling which actions can be reached by web bots. The array keys are the actions, if the value is 1 or true then the action is reachable. If an action is not defined as a key, or if the value for that key evaluates to false or zero, when a bot requests this action it will be refused. By default, only the actions "browse", "rss" and "dc" are reachable by bots. For example:
$RobotActions['download'] = 1; # allow bots to download files with disabled $EnableDirectDownload (page permissions are respected)
$RobotActions['rss'] = 0; # disallow bots from getting the RSS feed
$RobotActions['print'] = 1; # allow bots to get the print view
The variable can have custom actions used by cookbook recipes as keys.

%apply=item id=Robot Pattern?%$RobotPattern

A regular expression pattern with known user-agent strings for bots.

%apply=item id=Enable Robot Cloak Actions?%$EnableRobotCloakActions

Setting this flag to 1 will eliminate any forbidden ?action= values from page links returned to robots, which will reduce bandwidth loads from robots even further.

See also:

• Security
• $EnablePageListProtect
• $EnableDirectDownload