Seeing restricted pages. - DokuWiki User Forum

ptruchon

2008-07-02, 16:13 #1

Member for 2 months · 4 posts
Group memberships: Members

Show profile ·

Link to this post

Subject: Seeing restricted pages.

Hi,

I just set up dokuwiki on my OS X computer for testing before putting it on our server at school, and I'm having problems setting the permission right. I've read as much as I could on this forum and on the wiki about permission and I couldn't find anything to help. Here's my problem.

I set the "start" page so that only registered users can read it. So far, everything works as expected. However, I found that I can still read the source page without login in by going to the following URL:

http://<dokuwiki>/data/pages/start.txt

The permissions of both my data/ and conf/ folder are set to 750 (640 for *txt files)
with the owner:group set to myusername:www

That is, I did:

sudo chown -R myusername:www data conf
sudo chmod -R 750 data conf

When I tweaked the permissions to 740, I could only read, but not write, and to 730 I could no longer see the source page (which was good), but when I tried to edit the page from the wiki, I could not see the text there either.

My question is:

How can doku wiki have permission to see and use the text files without the browser having permission to display them directly?

Thanks a lot,

Cheers,
Pat

ach 2008-07-02, 21:23 #2

Member since May 2006 · 139 posts
Group memberships: Members

Show profile ·

Link to this post

There should be a .htaccess file in your data folder to prevent that. If your webserver is not apache, you could probably add something similar ...
Or another possibility is moving the data folder somewhere else. See http://wiki.splitbrain.org/wiki:security#the_._data_direct…

ptruchon

2008-07-05, 06:52 #3

Member for 2 months · 4 posts
Group memberships: Members

Show profile ·

Link to this post

Hi ach,

Thank you for the pointers. I ended up moving the data folder out of the public directory since there was already an .htaccess file, but it doesn't seem to be working. Out of curiosity, what should it contain? Right now, the one I have contains:

order allow,deny
deny from all

Cheers!
Pat

ptruchon

2008-07-05, 07:54 #4

Member for 2 months · 4 posts
Group memberships: Members

Show profile ·

Link to this post

Subject: Seeing restricted pages.

I figured out that on OS X (10.4) the Apache Web server doesn't look at the .htaccess files by default. This blog entry explains how to fix that problem: http://clagnut.com/blog/350/

Summarized here:

Edit the httpd.conf file:

cd /private/etc/httpd/
sudo pico httpd.conf

Find the lines:

# This controls which options the .htaccess files in directories can
# override. Can also be "All", or any combination of "Options", "FileInfo",
# "AuthConfig", and "Limit"
#
AllowOverride None

and edit the last line so it reads:

AllowOverride All AuthConfig

Then go into the users subdirectory and edit the <username>.conf file:

cd /private/etc/httpd/users/
sudo pico edit <username>.conf

so it has the following line:

AllowOverride All

I haven't yet seen how this is going to translate for the OS X Server we have... I'll update this later when I start moving our wiki on it.

Cheers!