<HTML dir=ltr><HEAD><TITLE>Re: [pmwiki-users] concerning GroupAttributes a potential security risk</TITLE>
<META http-equiv=Content-Type content="text/html; charset=unicode">
<META content="MSHTML 6.00.2900.5626" name=GENERATOR></HEAD>
<BODY>
<DIV id=idOWAReplyText80988 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>Hans,</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial size=2>Good point! Sorry, I should have added this last part, which would make the problem clearer. Basically, I have the entire set with <FONT face="Times New Roman">$DefaultPasswords['attr'] = crypt('secret_password'); as you said, however, I want people to be able to create pages within a group where they can set their own attributes. That's what complicated things. So, I first set in Example.GroupAttributes all of them to @nopass, so people can set their own passwords just for that group. What I didn't realize is that this automatically makes the Example.GroupAttributes page open to anyone, because its within the Example.GroupAttributes range...if that makes sense. ;-)</FONT></FONT></DIV>
<DIV dir=ltr><FONT size=2></FONT> </DIV>
<DIV dir=ltr><FONT size=2>Anyway, the only way that I could still allow people to set their own attributes within that group (via the Example.GroupAttributes) was to setup an autorestore (maybe to run every 15 seconds or so). I have already installed autorestore for my wikisandbox page, so that's why I posted the other point before.</FONT></DIV>
<DIV dir=ltr><FONT size=2></FONT> </DIV>
<DIV dir=ltr><FONT size=2>Do you think the idea of using autorestore for the Example.GroupAttributes is a good method of fixing the problem concerning the openness of Example.GroupAttributes, or do you (or anyone else) recommend a different approach?</FONT></DIV><FONT size=2>
<DIV dir=ltr><BR>Thanks,</DIV>
<DIV dir=ltr> </DIV>
<DIV dir=ltr>Chris</FONT></DIV></DIV>
<DIV dir=ltr><BR>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Hans [mailto:design5@softflow.co.uk]<BR><B>Sent:</B> Tue 11/4/2008 11:51 AM<BR><B>To:</B> Swift, Chris<BR><B>Cc:</B> PmWiki Users<BR><B>Subject:</B> Re: [pmwiki-users] concerning GroupAttributes a potential security risk<BR></FONT><BR></DIV>
<DIV>
<P><FONT size=2>Tuesday, November 4, 2008, 9:18:40 AM, Swift, Chris wrote:<BR><BR>> I'm using the www.pmwiki.org/wiki/Cookbook/AutoRestore<BR>> <<A href="http://www.pmwiki.org/wiki/Cookbook/AutoRestore">http://www.pmwiki.org/wiki/Cookbook/AutoRestore</A>> (autorestore)<BR>> function, which will automatically restore my example.GroupAttributes<BR>> page, the only issue with that is that someone in the system could<BR>> potentially lock different groups for a few minutes until autorestore<BR>> has made its way back into the system. If anyone has a better<BR>> suggestion, please let me know.<BR><BR>can you not just prevent meddling of page attributes by setting a<BR>sitewide attr password in config.php?<BR><BR>$DefaultPasswords['attr'] = crypt('secret_password');<BR><BR><A href="http://www.pmwiki.org/wiki/PmWiki/PasswordsAdmin">http://www.pmwiki.org/wiki/PmWiki/PasswordsAdmin</A><BR><BR><BR> ~Hans<BR><BR></FONT></P></DIV></BODY></HTML>