Paths
Unix or Linux
Path separator is :
Make sure diff and shell (Bourne or bash type) are found on path.
Typical setting is /bin:/usr/bin
Windows ActiveState Perl, using DOS shell
path separator is ;
The Windows system directory is required.
Use '\' not '/' in pathnames.
Typical setting is C:\windows\system32
Windows Cygwin Perl
path separator is :
The Windows system directory is required.
Use '/' not '\' in pathnames.
Typical setting is /cygdrive/c/windows/system32
Warning: You should set a value for this path if there is any risk at all of your site being hacked.
{SafeEnvPath}
Sessions {WorkingDir}/tmp directory.
{UseClientSessions}
EXPERT Set the session timeout, in seconds. The session will be cleared after this
amount of time without the session being accessed. The default is 6 hours
(21600 seconds).
Note By default, session expiry is done "on the fly" by the same
processes used to
serve TWiki requests. As such it imposes a load on the server. When
there are very large numbers of session files, this load can become
significant. For best performance, you can set {Sessions}{ExpireAfter}
to a negative number, which will mean that TWiki won't try to clean
up expired sessions using CGI processes. Instead you should use a cron
job to clean up expired sessions. The standard maintenance cron script
tools/tick_twiki.pl includes this function.
{Sessions}{ExpireAfter}
EXPERT TemplateLogin only.
Normally the cookie that remembers a user session is set to expire
when the browser exits, but using this value you can make the cookie
expire after a set number of seconds instead. If you set it then
users will be able to tick a 'Remember me' box when logging in, and
their session cookie will be remembered even if the browser exits.
This should always be the same as, or longer than, {Sessions}{ExpireAfter},
otherwise TWiki may delete the session from its memory even though the
cookie is still active.
A value of 0 will cause the cookie to expire when the browser exits.
One month is roughly equal to 2600000 seconds.
{Sessions}{ExpireCookiesAfter}
EXPERT If you have persistent sessions enabled, then TWiki will use a cookie in
the browser to store the session ID. If the client has cookies disabled,
then TWiki will not be able to record the session. As a fallback, TWiki
can rewrite local URLs to pass the session ID as a parameter to the URL.
This is a potential security risk, because it increases the chance of a
session ID being stolen (accidentally or intentionally) by another user.
If this is turned off, users with cookies disabled will have to
re-authenticate for every secure page access (unless you are using
{Sessions}{MapIP2SID}).
{Sessions}{IDsInURLs}
EXPERT It's important to check that the user trying to use a session is the
same user who originally created the session. TWiki does this by making
sure, before initializing a previously stored session, that the IP
address stored in the session matches the IP address of the user asking
for that session. Turn this off if a client IP address may change during
the lifetime of a session (unlikely)
{Sessions}{UseIPMatching}
EXPERT For compatibility with older versions, TWiki supports the mapping of the
clients IP address to a session ID. You can only use this if all
client IP addresses are known to be unique.
If this option is enabled, TWiki will not store cookies in the
browser.
The mapping is held in the file $TWiki::cfg{WorkingDir}/tmp/ip2sid.
If you turn this option on, you can safely turn {Sessions}{IDsInURLs}
off .
{Sessions}{MapIP2SID}
Authentication
none - Don't support logging in, all users have access to everything.
TWiki::LoginManager::TemplateLogin - Redirect to the login template, which
asks for a username and password in a form. Does not cache the ID in
the browser, so requires client sessions to work.
TWiki::LoginManager::ApacheLogin - Redirect to an '...auth' script for which
Apache can be configured to ask for authorization information. Does
not require client sessions, but works best with them enabled.
{LoginManager}
TWiki::LoginManager::TemplateLogin none TWiki::LoginManager::ApacheLogin EXPERT The perl regular expression used to constrain user login names. Some
environments may require funny characters in login names, such as \.
This is a filter in expression i.e. a login name must match this
expression or an error will be thrown and the login denied.
{LoginNameFilterIn}
EXPERT Guest user's login name. You are recommended not to change this.
{DefaultUserLogin}
EXPERT Guest user's wiki name. You are recommended not to change this.
{DefaultUserWikiName}
EXPERT An internal admin user login name (matched with the configure password, if set)
which can be used as a temporary Admin login (see: Main.TWikiAdminUser).
This login name is additionally required by the install script for some addons
and plugins, usually to gain write access to the TWiki web.
If you change this you risk making topics uneditable.
{AdminUserLogin}
EXPERT An admin user WikiName what is displayed for actions done by the AdminUserLogin
You should normally not need to change this. (you will need to move the
%USERSWEB%.TWikiAdminUser topic to match)
{AdminUserWikiName}
EXPERT Group of users that can use special action=repRev and action=delRev
on =save= and ALWAYS have edit powers. See TWiki.TWikiDocumentation
for an explanation of twiki groups. This user will also run all the
standard cron jobs, such as statistics and mail notification.
The default value "TWikiAdminGroup" is used everywhere in TWiki to
protect important settings so you would need a really special reason to
change this setting.
{SuperAdminGroup}
EXPERT Name of topic in the {UsersWebName} web where registered users
are listed. Automatically maintained by the standard
registration scripts. If you change this setting you will have to
use TWiki to manually rename the existing topic
{UsersTopicName}
EXPERT Comma-separated list of scripts that require the user to authenticate.
With TemplateLogin, any time an unauthenticated user attempts to access
one of these scripts, they will be redirected to the login script. With
ApacheLogin, they will be redirected to the logon script (note
login and logon; they are different scripts). This approach means that
only the logon script needs to be specified as require valid-user when
using Apache authentication.
If you want finer access control (e.g. authorised users only in one web
but open access in another) then you should *clear* this list, and use
TWiki Permissions to control access. Users wishing to make changes will
have to log in by clicking a "log in" link instead of being automatically
redirected when they try to edit.
{AuthScripts}
EXPERT Authentication realm. This is
normally only used in md5 password encoding. You may need to change it
if you are sharing a password file with another application.
{AuthRealm}
User Mapping
TWiki::Users::TWikiUserMapping - uses TWiki user and group topics to
determine user information, and group memberships.
TWiki::Users::BaseUserMapping - has only 2 users, {TWikiAdminUser} and
{TWikiGuestUser}, with the Admins login and password being set from this
configure script. Does not support User registration , and
only works with TemplateLogin.
{UserMappingManager}
TWiki::Users::TWikiUserMapping TWiki::Users::BaseUserMapping Registration {Register}{AllowLoginName}
EXPERT If Logins are managed from outside TWiki, and their TWikiName
mapping does not exist, You can highlight this (for security reasons)
by setting this to true
adds UnknownUser ($cUID)
{RenderLoggedInButUnknownUsers}
{Register}{EnableNewUserRegistration}
EXPERT Hide password in registration email to the *user*
Note that TWiki sends admins a separate confirmation.
{Register}{HidePasswd}
{Register}{NeedVerification}
Passwords
TWiki::Users::HtPasswdUser - handles 'htpasswd' format files, with
passwords encoded as per the HtpasswdEncoding
TWiki::Users::ApacheHtpasswdUser - should behave identically to
HtpasswdUser, but uses the CPAN:Apache::Htpasswd package to interact
with Apache. It is shipped mainly as a demonstration of how to write
a new password manager.
If 'none' is selected, users will not be able to change passwords
and TemplateLogin manager then will always succeed, regardless of
what username or password they enter. This may be useful when you want to
enable logins so TWiki can identify contributors, but you don't care about
passwords. Using ApacheLogin and PassordManager set to 'none' (and
AllowLoginName = true) is a common Enterprise SSO configuration, in which
any logged in user can then register to create their TWiki Based identity.
{PasswordManager}
TWiki::Users::HtPasswdUser none TWiki::Users::ApacheHtpasswdUser {MinPasswordLength}
htpasswd Apache program to create a new
password file with the right encoding.
{Htpasswd}{FileName}δ
htpasswd Apache program to create a new
password file with the right encoding.
crypt is the default, and should be used on Linux/Unix.
sha1 is recommended for use on Windows.
md5 may be useful on sites where password files are required
to be portable. In this case, the {AuthRealm} is used with the username
and password to generate the encrypted form of the password, thus:
user:{AuthRealm}:password . Take note of this, because it means that
if the {AuthRealm} changes, any existing MD5 encoded passwords will be
invalidated by the change!
plain stores passwords as plain text (no encryption).
{Htpasswd}{Encoding}
crypt sha1 md5 plain EXPERT {OS} and {DetailedOS} are calculated in the TWiki code. You
should only need to override if there is something badly wrong with
those calculations. {OS}
EXPERT The value of Perl $OS
{DetailedOS}
EXPERT Remove .. from %INCLUDE{filename}%, to stop includes
of relative paths.
{DenyDotDotInclude}
EXPERT
Allow %INCLUDE of URLs. This is disabled by default, because it is possible
to mount a denial-of-service (DoS) attack on a TWiki site using INCLUDE and
URLs. Only enable it if you are in an environment where a DoS attack is not
a high risk.
{INCLUDE}{AllowURLs}
EXPERT Allow the use of SCRIPT and LITERAL tags in content. If this is set false,
all SCRIPT and LITERAL sections will be removed from the body of topics.
SCRIPT can still be used in the HEAD section, though. Note that this may
prevent some plugins from functioning correctly.
{AllowInlineScript}
EXPERT Filter-in regex for uploaded (attached) file names. This is a filter
in , so any files that match this filter will be renamed on upload
to prevent upload of files with the same file extensions as executables.
NOTE: Be sure to update
this list with any configuration or script filetypes that are
automatically run by your web server.
{UploadFilter}
EXPERT Filter-out regex for webnames, topic names, usernames, include paths
and skin names. This is a filter out , so if any of the
characters matched by this expression are seen in names, they will be
removed.
{NameFilter}
EXPERT If this is set, the the search module will use more relaxed
rules governing regular expressions searches.
{ForceUnsafeRegexes}
EXPERT Build the path to /twiki/bin from the URL that was used to get this
far. This can be useful when rewriting rules or redirection are used
to shorten URLs. Note that displayed links are incorrect after failed
authentication if this is set, so unless you really know what you are
doing, leave it alone.
{GetScriptUrlFromCgi}
EXPERT Draining STDIN may be necessary if the script is called due to a
redirect and the original query was a POST. In this case the web
server is waiting to write the POST data to this script's STDIN,
but CGI.pm won't drain STDIN as it is seeing a GET because of the
redirect, not a POST. Enable this only in case a TWiki script
hangs.
{DrainStdin}
EXPERT Remove port number from URL. If set, and a URL is given with a port
number e.g. http://my.server.com:8080/twiki/bin/view, this will strip
off the port number before using the url in links.
{RemovePortNumber}
EXPERT Allow the use of URLs in the redirectto parameter to the
save script, and in topic parameter to the
view script. WARNING: Enabling this feature makes it
very easy to build phishing pages using the wiki, so in general,
public sites should not enable it. Note: It is possible to
redirect to a topic regardless of this setting, such as
topic=OtherTopic or redirectto=Web.OtherTopic .
To enable redirection to a just list of trusted URLs keep this setting
disabled and add a list of trusted URL to the {PermittedRedirectHostUrls}
setting in the General path settings section.
{AllowRedirectUrl}
EXPERT Defines the filter-in regexp that must match the names of environment
variables that can be seen using the %ENV{}% TWiki variable. Set it to
'^.*$' to allow all environment variables to be seen (not recommended).
{AccessibleENV}
