Topic on Project:Support desk

How to Create Special Page to Edit LocalSettings.php ?

7
Johnywhy (talkcontribs)

How to Create Special Page to Edit LocalSettings.php ?

2001:16B8:10BB:6300:FC59:22CF:B529:8735 (talkcontribs)

Don't do it. LocalSettings.php is the basic configuration file of a wiki and it contains a bunch of sensitive and private information. You should not make this information public by making it editable by everyone or at least everyone with according MediaWiki user rights.

In order to be able to edit LocalSettings.php, the user has to have file system access and it is good that way. :-)

Johnywhy (talkcontribs)

"user has to have file system access"

and the same rights should be required for that page. The page will require admin login.

星耀晨曦 (talkcontribs)

Technically speaking, you can do this.

2001:16B8:1090:3500:1F3:853A:17F9:9161 (talkcontribs)

Technically speaking you can also give people file system access. The question is: How clever is that? And how clever is it to allow editing the file with the most sensitive content through MediaWiki? There only needs to be a single security issue in MediaWiki and apart from your usual problems in that case, every user will not only be able to see e.g. your complete configuration, but also your DB access data. I am currently not sure, if this is as bad as installing Extension:MaintenanceShell or if it is even worse. Actually, I think it is worse. Not clever if you are asking me.

Johnywhy (talkcontribs)

if done properly, like ANY securely programmed webpage, then it will be secure.

Any webpage can be done security or insecurely.

Eg, multiple layers of authentication, input validation, etc etc

This MediaWiki hosting service intends to create something similar:

https://phabricator.miraheze.org/T194

星耀晨曦 (talkcontribs)

You can develop extension that can edit LocalSettings.php.

Reply to "How to Create Special Page to Edit LocalSettings.php ?"