[pmwiki-users] Install with modules

[Johan Bengtsson]

The whole idea for "Modules" sounds great, that would be an improvement!

We don't have pmwiki & wp on the same server, they have their own dedicated servers.

-Johan Bengtsson

________________________________________
From: Petko Yotov <5ko at 5ko.fr>
Sent: Wednesday, April 5, 2023 16:03
To: Johan Bengtsson
Cc: PmWiki Users
Subject: Re: [pmwiki-users] Install with modules

On 05/04/2023 14:36, Johan Bengtsson wrote:
> In the release notes for 2.3.19 you talk about adding the possibility
> to add recipes through "Modules".
> Would it be possible to add recipes without having access to the
> webserver?

Sorry, it will not be possible from within the wiki to download
executable PHP files in writable directories (much less writable,
executable PHP files in writable directories), it is too much a security
risk -- e.g. WordPress.

This is more about making easier the life of individual webmasters, and
of sysadmins only as a side effect. Simply drop a zip archive via FTP,
then visit a module panel on the wiki to enable and configure the new
module, without having to edit pmwiki/local/config.php.

So you will be able to download all PmWiki modules and skins that you
are comfortable with, and let users in individual wikis (in a farm) or
in WikiGroups enable them or not.

There will be an interface to easily enable and configure modules from
within the wiki, and even a module to configure some core variables like
$WikiTitle, $Skin, possibly $UploadMaxSize.

Updating modules to a new version should be easier/simpler for you than
it is now (some files in cookbook, others in pub), but again not
automatic from the wiki. But these could be pulled from version control,
and it should be possible, but not required, to use the module from a
ZIP archive without extracting it.

While the API will be slightly different from what it is today, it will
have some helper functions to make it easy for module authors. For
example, detection of custom wikilib.d, easier integration of JS/CSS
files.

Don't hold your breath though. I have started but I am under a lot of
work/stress and I haven't advanced as fast as I want.

So far I have only prototyped the parts "easier integration of JS/CSS"
and "easier to update from version control" and some custom modules.

I'll be working on a large project that will be using this, so it will
eventually happen. :-)


> Where I work we now have two smaller webplatforms, pmwiki & wordpress.
> They are set up like this:
> -no access to the server for users
> -wp users get an admin account for the wp instance
>
> wp users can install plugins & themes themselves which is:
> -good - much less work for sysadmin during initial setup
> -bad - they can install crappy insecure plugins etc...

And a crappy WP plugin can compromise the whole website including the
PmWiki installations. And these exploits are uncovered at the rate of
about 30-60 per week.

> So pmwiki users cannot install any recipes or skins by themselves which
> is:
> -good - they can't screw things up
> -bad - means a lot of work for admin when doing the initial setup.

Normally I would offer my services for PmWiki administration, but not
when there is a WP installation on the same hosting account.

> I think the ideal solution for our site would be if users could
> install recipes themselves
> via the wiki interface. As a sysadmin I would like to limit what kind
> of recipes they could
> install, to set a limit like "only stable recipes, only PHP8
> compatible, only responsive skins..."

When the "Modules" module is operational, and when there are compatible
modules and skins, you could download all those you approve, and let
users in the wikis enable the ones they want/need. You could automate
the updates, not from the wiki but maybe write a cron script to do it
for you.

Petko