Please help me (and others with a similar situation) secure my Dokuwiki.
I've studied
http://wiki.splitbrain.org/wiki:install:permissions and
http://wiki.splitbrain.org/wiki:security and am having trouble understanding how to apply the information to my situation. I struggle with Unix and would create needed files in Windows (notepad2) and ftp them to the server and use Windows tools or hosting plan's control panel to change permissions.
My understanding for the general case is as follows.
DokuWiki directory structure as installed is not secure:
www
mywiki (renamed from dokuwiki)
bin
conf
data
inc
lib
doku.php
secure would be:
dokuwiki (new directory created at same level as www)
(bin deleted)
data (change savedir config setting from ./data to what?) <--Question 1
conf
inc
lib
www
mywiki
doku.php
prepend.php
php.ini
Is the above understanding correct? <--Question 2
BUT...
My situation is a shared server, with DokuWiki installed in a subdomain of my existing website built with a php cms.
Current directory structure as installed is not secure:
mywiki (renamed from dokuwiki)
html
bin
conf
data
inc
lib
doku.php
html
index.php (for mydomain.com cms)
php.ini (existing)
current configuration settings:
baseurl is
http://mywiki.mydomain.com
basedir is /
secure would be:
dokuwiki (new directory created at same level as html for existing website)
(bin deleted)
data (change savedir config setting from ./data to what?) <--Question 3
conf
inc
lib
mywiki
html
doku.php
prepend.php
html
index.php (for mydomain.com cms)
php.ini
baseurl is still
http://mywiki.mydomain.com (path to doku.php)
basedir is still /
is this correct? <--Question 4
per phpinfo, currently (not secure) document_root = /home/com/mydomain/mywiki/html
therefore prepend.php should contain:
<?php
define('DOKU_CONF','/home/com/mydomain/dokuwiki/conf/');
define('DOKU_INC','/home/com/mydomain/dokuwiki/');
is this correct? <--Question 5
per phpinfo, auto_prepend_file local value is not set
set via php.ini:
auto_prepend_file = "prepend.php"
is this correct? <--Question 6
will prepend.php have any effect on the existing php cms? (my guess is no) <--Question 7
per
http://forum.dokuwiki.org/thread/1566,
fmode and dmode should be set to 600/700
permissions on dokuwiki and subfolders/files also set to 600/700
mywiki and subfolders/files permissions should also be 600/700
is the above correct? <--Question 8