Re: [Tiki-devel] Security, Extra Smarty functions, Extra Smarty modifiers, Extra Smarty directories are gone ?

Hello all (Marc),

Based on sample found here: http://doc.tiki.org/System-Configuration#Protecting_ini_file_content_when_stored_in_a_location_accessible_from_the_web

I created a file to store configuration here: db/tiki.php

<?php
// This script may only be included - so it is better to die if called directly.
// Keep this block to avoid the content to be read from the internet.
if (strpos($_SERVER['SCRIPT_NAME'], basename(__FILE__)) !== false) {
   header('location: index.php');
   exit;
}
?>
rules.0 = show smarty_security_functions
rules.1 = show smarty_security_modifiers
It worked for a day or two (or may be some cache where hiding a problem).
But today this is what I got:

Fatal error: Uncaught Laminas\Config\Exception\RuntimeException: Error reading INI file "db/tiki.php": syntax error, unexpected '(' in db/tiki.php on line 4 in /Users/Bernard/Documents/Shocksite/www/htdocs/xxx/vendor_bundled/vendor/laminas/laminas-config/src/Reader/Ini.php on line 128

( ! ) Laminas\Config\Exception\RuntimeException: Error reading INI file "db/tiki.php": syntax error, unexpected '(' in db/tiki.php on line 4 in /Users/Bernard/Documents/Shocksite/www/htdocs/xxx/vendor_bundled/vendor/laminas/laminas-config/src/Reader/Ini.php on line 128


If I remove the <?php … ?> it work fine.
Something to update in the doc sample ?

B

> On 17 Feb 2021, at 21:00 , Bsfez Tiki via TikiWiki-devel <[email protected]> wrote:
> 
> Thanks for the time you take to explain.
> 
> As it was in my way I surely feel frustrated but… I’m always ok to be convinced.
> 
> 
> Still, while strongly believe we made huge effort in that area, consistency is a real issue in my opinion.
> If we have a "protection/authentication" mechanism we should try to reuse it as much as possible.
> So things look consistant.
> 
> Hope I can improve the doc for the less techies of us.
> 
> Bernard
> 
> PS: no root, no power 😂
> 
> 
>> On 16 Feb 2021, at 16:12 , [email protected] wrote:
>> 
>> "It should have been optional."
>> 
>> It is optional. You can still opt in to these risky features.
>> 
>> Stop thinking that a person that has tiki_p_admin should also have SFTP/SSH access. This may be your case as a Tiki consultant, but there are other use cases (ex.: enterprise setting, a Tiki SaaS offering, Multi-Tiki, etc.) where this is a serious vulnerability.
>> 
>> We need to limit these powerful features to someone who already has SSH/SFTP access.  And we have a way to do this since Tiki8:
>> https://doc.tiki.org/System-Configuration
>> 
>> 
>> Also:
>> 
>> When a security audit happens, they search until they find something, and then they stop. Why go deeper when I already hacked the system?
>> 
>> And then, the security team wastes time with security audit reports because researchers find issues that we already know about. Yes, you can hack your Tiki. It's a feature, not a bug (depending on your use case)
>> 
>> Even worse, this is a lost opportunity. By making it not possible to hack your own Tiki via the GUI, security researchers will dig deeper and find other stuff which are real problems that we will solve.
>> 
>> 
>> Merge requests to improve the UI are most welcome. Ex.: The UI could tell tiki_p_admin what to tell his/her sysadmin.
>> 
>> Documentation can be improved.
>> 
>> But please keep in mind that tiki_p_admin user is not the same person as sysadmin.
>> 
>> Best regards,
>> 
>> Marc
>> 
>> 
>> 
>> On Tue, 16 Feb 2021 13:24:30 +0200 Tiki developers [email protected] said
>> 
>>> A few weeks later…
>>> While I rarely change such settings and I understand why risky stuff should
>>> be hidden (may be more than everyone here 😂) I have the feeling it has
>>> been done based on individual usage and not really for any "Expert/" of the
>>> Tiki community.
>>> Not every admin use Tiki with configuration files, parameters in local.php or
>>> tiki.ini.
>>> The Doc is thin.
>>> It should have been optional.
>>> We could have reused other simpler mechanism we use on other places.
>>> For example the "Enter admin password" double authentication like to assign a
>>> user to a group.
>>> "You are about to save a risky thing, please enter your admin password to
>>> confirm… bla bla".
>>> I added some information on the documentation page to help others:
>>> https://doc.tiki.org/Risky-Preferences
>>> Bernard
>>>> On 26 Jan 2021, at 17:20 , [email protected] wrote:
>>>>> Below
>>>>>> On Tue, 26 Jan 2021 08:53:44 +0200 Tiki developers
>>>> [email protected] said
>>>>>> I see… (thanks Marc) While I understand the reasons and don’t really
>>>> have an opinion on this
>>>>> yet, I think the tooltip should be then adapted to the new situation so
>>>>> people knows where to look. At tiki-admin.php?page=security Smarty security
>>>> Under the I (information) Tooltip : Do not allow PHP code in Smarty
>>>>> templates. To : Do not allow PHP code in Smarty templates. Specific settings
>>>> can be
>>>>> overridden and modifiers or functions added by the system administrator
>>>>> through Tiki's system configuration file. Then the link would go to : > https://doc.tiki.org/Risky-Preferences > > This is how to add a help link:
>>>> http://dev.tiki.org/Create-a-new-preference#help
>>>>> But https://doc.tiki.org/Risky-Preferences is a different concept.
>>>>> There should be another page.
>>>>>>> Bernard On 26 Jan 2021, at 04:55 , [email protected] wrote:
>>>> https://doc.tiki.org/Risky-Preferences On Mon, 25 Jan 2021 18:01:53 +0200 Tiki
>>>> developers
>>>>> [email protected] said Hello, On Tiki 22 I can’t find
>>>> the Extra Smarty functions, Extra Smarty
>>>>> modifiers, Extra Smarty directories fields on the security control panel  By
>>>> the look
>>>>> of the code I have doubt it was voluntary… Was it ? Bernard
>>>> _______________________________________________ TikiWiki-devel mailing list
>>>> [email protected]
>>>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
>>>>>>>> _______________________________________________
>>>> TikiWiki-devel mailing list
>>>> [email protected]
>>>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
>>> _______________________________________________
>>> TikiWiki-devel mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
>>> 
>> 
>> 
>> 
>> 
>> _______________________________________________
>> TikiWiki-devel mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel
> 
> 
> 
> _______________________________________________
> TikiWiki-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel

_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel