<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=koi8-r">
<META content="MSHTML 6.00.2900.2627" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV align=left><FONT face=Arial>Hi all,</FONT></DIV>
<DIV align=left><FONT face=Arial>we want to set up an information webpage based
on pmwiki.</FONT></DIV>
<DIV align=left><FONT face=Arial>We are using an striped down version of pmwiki
to disable all actions except browsing:</FONT></DIV>
<DIV align=left><FONT face=Arial>$HandleActions = array('browse' =>
'HandleBrowse','diff' => 'HandleBrowse','crypt' => 'HandleBrowse','login'
=> 'HandleBrowse','upload' => 'HandleBrowse'); (in
pmwiki.php)</FONT></DIV>
<DIV align=left><FONT face=Arial>We are also using the userauth script for
authentication.</FONT></DIV>
<DIV align=left><FONT face=Arial></FONT> </DIV>
<DIV align=left><FONT face=Arial>Are there any security faults known, which may
lead to direct access to the servers filesystem through pmwiki? </FONT><FONT
face=Arial>Is it possible to submit page changes without authentification
?</FONT></DIV>
<DIV align=left><FONT face=Arial>Any obvious problems existent ?</FONT></DIV>
<DIV align=left><FONT face=Arial></FONT> </DIV>
<DIV align=left><FONT face=Arial>Thanks for your time.</FONT></DIV>
<DIV align=left><FONT face=Arial></FONT> </DIV>
<DIV align=left><FONT face=Arial>Sincerely, Dimitrij
Krepis.</FONT></DIV></BODY></HTML>