Re: [Tiki-devel] Security, Extra Smarty functions, Extra Smarty modifiers, Extra Smarty directories are gone ?

I don't know. Since it's intermittent, sounds like the best would be for a dev to troubleshoot your system.

Marc


On Tue, 2 Mar 2021 10:21:36 +0200 Tiki developers [email protected] said

> Hello all (Marc), 
> 
> Based on sample found here:
> http://doc.tiki.org/System-Configuration#Protecting_ini_file_content_when_stored_in_a_location_accessible_from_the_web
> 
> 
> I created a file to store configuration here: db/tiki.php 
> 
> 
> rules.0 = show smarty_security_functions 
> rules.1 = show smarty_security_modifiers 
> It worked for a day or two (or may be some cache where hiding a problem). 
> But today this is what I got: 
> 
> Fatal error: Uncaught Laminas\Config\Exception\RuntimeException:
> Error reading INI file "db/tiki.php": syntax error, unexpected '('
> in db/tiki.php on line
> 4 in /Users/Bernard/Documents/Shocksite/www/htdocs/xxx/vendor_bundled/vendor/laminas/laminas-config/src/Reader/Ini.php on
> line 128 
> 
> ( ! ) Laminas\Config\Exception\RuntimeException: Error reading INI
> file "db/tiki.php": syntax error, unexpected '(' in db/tiki.php on line
> 4 in /Users/Bernard/Documents/Shocksite/www/htdocs/xxx/vendor_bundled/vendor/laminas/laminas-config/src/Reader/Ini.php on
> line 128 
> 
> If I remove the  it work fine. 
> Something to update in the doc sample ? 
> 
> B 
> 
> On 17 Feb 2021, at 21:00 , Bsfez Tiki via TikiWiki-devel <
> [email protected] > wrote: 
> 
> Thanks for the time you take to explain. 
> As it was in my way I surely feel frustrated but… I’m always ok to be
> convinced. 
> Still, while strongly believe we made huge effort in that area, consistency
> is a real issue in my opinion. 
> If we have a "protection/authentication" mechanism we should try to reuse it
> as much as possible. 
> So things look consistant. 
> Hope I can improve the doc for the less techies of us. 
> Bernard 
> PS: no root, no power 😂 
> On 16 Feb 2021, at 16:12 , [email protected] wrote: 
> "It should have been optional." 
> It is optional. You can still opt in to these risky features. 
> Stop thinking that a person that has tiki_p_admin should also have SFTP/SSH
> access. This may be your case as a Tiki consultant, but there are other use
> cases (ex.: enterprise setting, a Tiki SaaS offering, Multi-Tiki, etc.) where
> this is a serious vulnerability. 
> We need to limit these powerful features to someone who already has SSH/SFTP
> access.  And we have a way to do this since Tiki8: 
> https://doc.tiki.org/System-Configuration 
> Also: 
> When a security audit happens, they search until they find something, and
> then they stop. Why go deeper when I already hacked the system? 
> And then, the security team wastes time with security audit reports because
> researchers find issues that we already know about. Yes, you can hack your
> Tiki. It's a feature, not a bug (depending on your use case) 
> Even worse, this is a lost opportunity. By making it not possible to hack
> your own Tiki via the GUI, security researchers will dig deeper and find
> other stuff which are real problems that we will solve. 
> Merge requests to improve the UI are most welcome. Ex.: The UI could tell
> tiki_p_admin what to tell his/her sysadmin. 
> Documentation can be improved. 
> But please keep in mind that tiki_p_admin user is not the same person as
> sysadmin. 
> Best regards, 
> Marc 
> On Tue, 16 Feb 2021 13:24:30 +0200 Tiki developers
> [email protected] said 
> A few weeks later… 
> While I rarely change such settings and I understand why risky stuff should 
> be hidden (may be more than everyone here 😂) I have the feeling it has 
> been done based on individual usage and not really for any "Expert/" of the 
> Tiki community. 
> Not every admin use Tiki with configuration files, parameters in local.php or
> 
> tiki.ini. 
> The Doc is thin. 
> It should have been optional. 
> We could have reused other simpler mechanism we use on other places. 
> For example the "Enter admin password" double authentication like to assign a
> 
> user to a group. 
> "You are about to save a risky thing, please enter your admin password to 
> confirm… bla bla". 
> I added some information on the documentation page to help others: 
> https://doc.tiki.org/Risky-Preferences 
> Bernard 
> On 26 Jan 2021, at 17:20 , [email protected] wrote: 
> Below 
> On Tue, 26 Jan 2021 08:53:44 +0200 Tiki developers 
> [email protected] said 
> I see… (thanks Marc) While I understand the reasons and don’t really 
> have an opinion on this 
> yet, I think the tooltip should be then adapted to the new situation so 
> people knows where to look. At tiki-admin.php?page=security Smarty security 
> Under the I (information) Tooltip : Do not allow PHP code in Smarty 
> templates. To : Do not allow PHP code in Smarty templates. Specific settings 
> can be 
> overridden and modifiers or functions added by the system administrator 
> through Tiki's system configuration file. Then the link would go to : >
> https://doc.tiki.org/Risky-Preferences > > This is how to add a help link: 
> http://dev.tiki.org/Create-a-new-preference#help 
> But https://doc.tiki.org/Risky-Preferences is a different concept. 
> There should be another page. 
> Bernard On 26 Jan 2021, at 04:55 , [email protected] wrote: 
> https://doc.tiki.org/Risky-Preferences On Mon, 25 Jan 2021 18:01:53 +0200
> Tiki 
> developers 
> [email protected] said Hello, On Tiki 22 I can’t find 
> the Extra Smarty functions, Extra Smarty 
> modifiers, Extra Smarty directories fields on the security control panel  By
> 
> the look 
> of the code I have doubt it was voluntary… Was it ? Bernard 
> _______________________________________________ TikiWiki-devel mailing list 
> [email protected] 
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel 
> _______________________________________________ 
> TikiWiki-devel mailing list 
> [email protected] 
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel 
> _______________________________________________ 
> TikiWiki-devel mailing list 
> [email protected] 
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel 
> _______________________________________________ 
> TikiWiki-devel mailing list 
> [email protected] 
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel 
> _______________________________________________ 
> TikiWiki-devel mailing list 
> [email protected] 
> https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel




_______________________________________________
TikiWiki-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-devel