PmWiki has built-in support for password-protecting various areas of the wiki site. Authors generally want to be able to apply passwords to individual pages or to WikiGroups. Wiki Administrators can apply passwords to individual pages, to WikiGroups, or to the entire wiki site. As with any access control system, the password protection mechanisms described here are only a small part of overall system and wiki security. PmWiki.Security will contain a more thorough discussion of possible issues.
You will generally use 3 types of passwords:
Note that if an
attr password isn't set, then anyone can alter the
edit passwords. (See "security holes" below.)
To set a password on an individual wiki page, add
?action=attr to the page's URL (address) to access its attributes. (You may be prompted for a username and password; the username field usually isn't used by PmWiki.) Using the small form on the attributes page, you can set or clear the
attr passwords on the page. In the form you enter the passwords as cleartext; PmWiki encrypts them for you automatically.
To set a password on a wiki group is slightly more difficult--you just set the passwords on a special page in each group called "GroupAttributes". You can get to the attributes page for GroupAttributes by entering a URL (address) like
http://www.example.com/pmwiki?n=GroupName.GroupAttributes?action=attr. Then, using the small form on the attributes page, you can set or clear the
attr passwords for the entire group. In the form you enter the passwords as cleartext; PmWiki encrypts them for you automatically.
You can set passwords on pages and groups exactly as described above for authors. You can also:
attrpasswords to control who is able to set passwords on pages (and potentially other future attributes)
uploadpasswords to control access to the file upload capabilities (if uploads are enabled)
adminpassword to override the passwords set for any individual page or group
For more information on password options available to administrators, see PmWiki.PasswordsAdmin.
In PmWiki, page passwords override group passwords, group passwords override the default passwords, and the
admin password overrides all passwords. This gives a great deal of flexibility in controlling access to wiki pages in PmWiki.
Administrators need to carefully plan where passwords are applied to avoid opening inadvertent security holes. If your wiki is open (anyone can read and edit), this would not seem to be a concern, except, a malicious or confused user could apply a read password to a group and make the group completely unavailable to all other users. At the very least, even an open wiki should have a site-wide "admin" password and a site-wide "attr" password set in config.php. The sample-config.php file distributed with PmWiki indicates that the PmWiki and Main groups have "attr" locked by default, but if anyone creates a new group, "attr" is unlocked. Administrators must remember to set "attr" passwords for each new group (if desired) in this case. An easier solution is to include these lines in config.php :
$DefaultPasswords['admin'] = crypt('youradminpassword'); $DefaultPasswords['attr'] = crypt('yourattrpassword');
This sets your "admin" and "attr" passwords and ensures that any new group will have this "attr" password automaticcally applied to it.
To protect all of the pages in a group from editing, enter a URL (address) like
http://www.example.com/pmwiki?n=GroupName.GroupAttributes?action=attr. Then, use the small form on the attributes page to set an
edit password for all pages in the group. To "unprotect" one page, you cannot simply "clear" the password for that page, because the page itself does not have a password - the group does. Enter a URL like
http://www.example.com/pmwiki?n=GroupName.PageName?action=attr. Then, use the small form on the attributes page to set the
edit password to the special value "nopass". This tells PmWiki to ignore any site-wide or group-level edit passwords that apply to the page. You can repeat this operation to unprotect other pages in the group.