[pmwiki-users] Install with modules

[Petko Yotov]

On 05/04/2023 14:36, Johan Bengtsson wrote:
> In the release notes for 2.3.19 you talk about adding the possibility
> to add recipes through "Modules".
> Would it be possible to add recipes without having access to the 
> webserver?

Sorry, it will not be possible from within the wiki to download 
executable PHP files in writable directories (much less writable, 
executable PHP files in writable directories), it is too much a security 
risk -- e.g. WordPress.

This is more about making easier the life of individual webmasters, and 
of sysadmins only as a side effect. Simply drop a zip archive via FTP, 
then visit a module panel on the wiki to enable and configure the new 
module, without having to edit pmwiki/local/config.php.

So you will be able to download all PmWiki modules and skins that you 
are comfortable with, and let users in individual wikis (in a farm) or 
in WikiGroups enable them or not.

There will be an interface to easily enable and configure modules from 
within the wiki, and even a module to configure some core variables like 
$WikiTitle, $Skin, possibly $UploadMaxSize.

Updating modules to a new version should be easier/simpler for you than 
it is now (some files in cookbook, others in pub), but again not 
automatic from the wiki. But these could be pulled from version control, 
and it should be possible, but not required, to use the module from a 
ZIP archive without extracting it.

While the API will be slightly different from what it is today, it will 
have some helper functions to make it easy for module authors. For 
example, detection of custom wikilib.d, easier integration of JS/CSS 
files.

Don't hold your breath though. I have started but I am under a lot of 
work/stress and I haven't advanced as fast as I want.

So far I have only prototyped the parts "easier integration of JS/CSS" 
and "easier to update from version control" and some custom modules.

I'll be working on a large project that will be using this, so it will 
eventually happen. :-)


> Where I work we now have two smaller webplatforms, pmwiki & wordpress.
> They are set up like this:
> -no access to the server for users
> -wp users get an admin account for the wp instance
> 
> wp users can install plugins & themes themselves which is:
> -good - much less work for sysadmin during initial setup
> -bad - they can install crappy insecure plugins etc...

And a crappy WP plugin can compromise the whole website including the 
PmWiki installations. And these exploits are uncovered at the rate of 
about 30-60 per week.

> So pmwiki users cannot install any recipes or skins by themselves which 
> is:
> -good - they can't screw things up
> -bad - means a lot of work for admin when doing the initial setup.

Normally I would offer my services for PmWiki administration, but not 
when there is a WP installation on the same hosting account.

> I think the ideal solution for our site would be if users could
> install recipes themselves
> via the wiki interface. As a sysadmin I would like to limit what kind
> of recipes they could
> install, to set a limit like "only stable recipes, only PHP8
> compatible, only responsive skins..."

When the "Modules" module is operational, and when there are compatible 
modules and skins, you could download all those you approve, and let 
users in the wikis enable the ones they want/need. You could automate 
the updates, not from the wiki but maybe write a cron script to do it 
for you.

Petko