[pmwiki-users] Using a pagelist to display PTVs from wikipages with read passwd set

Petko Yotov 5ko at 5ko.fr
Sun May 15 07:42:22 CDT 2011


On Sunday 15 May 2011 13:16:59, Lars Grau wrote :
> We're displaying data with a pagelist directive. The data is stored as PTVs
> in wikipages that have a read password set ("id:*"). The entire site uses
> AuthUser, by default users that are not logged in can only see a couple
> "public" pages. Now, displaying some of the "protected" data on a "public"
> page obviously doesn't work.
> 
> We do NOT want to make the pages that hold the PTVs "public" and we CANNOT
> put the PTVs into the public pages.

You can probably edit-protect the data pages ("id:*"), let them readable 
without a password, but wrap the contents in (:if auth edit:). This way it 
will only be shown to users that can edit the page:

(:if auth edit:)
SomePageTextVariable:1
AnotherPTV:2

(:else:)
Please [[{*$FullName}?action=login|login]] to see this content.
(:if:)

This is not recommended if you have publicly editable pages, as someone could 
do OpenPage?action=edit&template=Data.ProtectedPage or (:include lines=2..:).

Note, you may also want to protect the diff and source actions in config.php:

  $HandleAuth['diff'] = $HandleAuth['source'] = 'edit';

Petko



More information about the pmwiki-users mailing list