Passwords

PmWiki has built-in support for password-protecting various areas of the wiki site. Authors generally want to be able to apply passwords to individual pages or to wiki groups. Wiki Administrators can apply passwords to individual pages, to wiki groups, or to the entire site. Setting an edit password on a page or group (or the entire site) is one of the most common ways to stop spam. As with any access control system, the password protection mechanisms described here are only a small part of overall system and wiki security.

As an author editing pages...

An author will generally set 3 types of passwords:

1. to control who can see a page or group, use read passwords
2. to control who can edit a page or group, use edit passwords
3. to control who can alter the passwords used to protect a page or group, use attr passwords

If required most page actions can be password protected.

Protect an individual page

To set a password on an individual wiki page, add the page action

to the page's URL (address) to access its attributes. Using the form on the attributes page, you can set or clear the read, edit, or attr passwords on the page. In the form you enter the passwords as cleartext; PmWiki encrypts them for you automatically when it stores them.

Additional options:

• Leaving a field blank will leave the attribute unchanged.
• To remove a password from a page (reverting back to the group's or site's default), enter
  clear
• To indicate that the page can be read or edited even if a group or site password is set, enter
  @nopass
• To lock a page for everybody but the admin, enter
  @lock
• To assign the site's site-wide passwords to the read, edit, upload, or attr password for the page, enter
  @_site_read, @_site_edit, @_site_upload, @_site_admin, or @_site_attr
• (From 2.3.31) To add passwords, users, or groups to a field without removing the current attributes, enter "+ " (plus, space) then list the new password(s), user(s), group(s):
  + newpasword1 id:NewUser? @newgroup
• (From 2.3.31) To remove specific passwords, users, or groups to a field without removing the other ones, enter "- " (minus, space) then list the deleted password(s), user(s), group(s):
  - oldpasword1 deletedpass2 id:DeletedUser? @disabledgroup

Protect a wiki group of pages

To set a password on a wiki group is slightly more difficult -- you just set the passwords on a special page? in each group called

First, you can get to the attributes page for `GroupAttributes? by entering a URL (address) like

Replace example.com with your domain name, and GroupName? with the name of the group

Then, using the form on the attributes page, you can set or clear the read, edit, or attr passwords for the entire group. In the form you enter the passwords as cleartext; PmWiki encrypts them for you automatically.

Additional options:

• To remove a password from a group (reverting back to the site's default), enter
  clear
• To indicate that the group can be edited even if a site password is set, enter
  @nopass
• To lock a group for everybody but the admin, enter
  @lock
• (Beginning with Ver 2.2.3) To assign the site's site-wide passwords to the read, edit, upload, admin,or attr password for the group, enter
  @_site_read, @_site_edit, @_site_upload, @_site_admin, or @site_attr
• (From 2.3.31) To add or remove passwords or users, type "+ " or "- " (plus or minis, space) then the attributes to be added or removed, like for the page attributes.

Passwords

Passwords may consist of any combination of characters, except double "quotes" or 'apostrophes'. Passwords with spaces or colons must be entered using quotes, eg "foo bar" or "foo:bar". Obviously longer is better, and on some systems passwords need to have 4 or more characters.

Multiple passwords

Multiple passwords for a page, group or site are allowed. Simply enter multiple passwords separated by a space. This allows you to have a read password, a write password, and have the write password allow read/write access. In other words, if the read password is

and the edit password is

then enter

Set new read password: alpha beta
Set new edit password: beta

This says that either

or

can be used to read pages, but only

may edit. Since PmWiki checks the passwords you've entered since the browser has been opened, entering a read password that is also a write password allows both reading and writing.

Protect the site

Passwords can be applied to the entire wiki website in config.php. See passwords administration for details.

administrator

As an administrator ...

You can set passwords on pages and groups exactly as described above for authors. You can also:

1. set site-wide passwords for pages and groups that do not have passwords
2. use attr passwords to control who is able to set passwords on pages
3. use upload passwords to control access to the file upload capabilities (if uploads are enabled)
4. use an admin password to override the passwords set for any individual page or group
5. use SiteAdmin.AuthList to view the permissions settings for pages that have permissions set.

For more information on password options available to administrators, see PasswordsAdmin.

Which password wins?

In PmWiki, page passwords override group passwords, group passwords override the default passwords, and the admin password overrides all passwords. This gives a great deal of flexibility in controlling access to wiki pages in PmWiki.

The special page? SiteAdmin.AuthList is a page list of all pages with access permissions set.

Opening access to pages in protected groups/sites

Sometimes we want to "unprotect" pages in a group or site that is otherwise protected. In these cases, the special password

is used to indicate that access should be allowed to a page without requiring a password.

For example, suppose Main.GroupAttributes has an edit password set, thus restricting the editing of all pages in Main. Now we want Main.WikiSandbox to be editable without a password. Using

for the edit password for Main.WikiSandbox doesn't unprotect the page, because the password is being set by the group. Instead, we set the edit password for Main.WikiSandbox to the special value

which tells PmWiki to ignore any site-wide or group-level passwords for that page.

FAQ

$group = FmtPageName('$Group', $pagename);
$DefaultPasswords['edit'] = 'id:'.$group;
include_once("$FarmD/scripts/authuser.php");