If one of these options is set to “”, the corresponding header is not set.In the default configuration, no policy is set or enforced, but a header is addedto report CSP violations in the log. The ConfigDicts backend uses dicts defined in the configuration file. The ConfigGroups backend uses groups defined in the configuration file. Use of groups will reduce the administrative effort required to maintain ACL rules,especially in wikis with a large community of users.

• For users configuring GivenAuth on Apache, an example virtual host configurationis included at contrib/deployment/moin-http-basic-auth.conf
• At first, you might wonder why we use Python code for configuration.
• Please note that you must give the correct character set so that moincan decode the username to unicode, if necessary.
• As you might know, many users are bad at choosing reasonable passwords and someare tempted to use easily crackable passwords.

Adding XStatic Packages

If configured like that, moin will request authentication by emitting ahttp header. Each authenticator is an instance of some specific class, configuration ofthe authenticators usually works by giving them keyword arguments. If there is a requirement to changethe MoinMoin base code, please consider submitting a patch. The following example shows how you can enable the additional packageXStatic-MathJax which isused for mathml or latex formulas in an item’s content. A good way to test a stylesheet is to first use it as user CSS beforeconfiguring it for the public.

• With LDAPAuth you can authenticate users against a LDAP directory or MS Active Directory service.
• Secrets are long random strings and not a reuse of any of your passwords.Don’t use the strings shown below, they are NOT secret as they are part of themoin documentation.
• Moin’s default configuration makes use of hard security to prevent unwanted spam.Wiki administrators may soften security by reconfiguring the default ACLs.
• Mywiki may be created as asubdirectory of myvenv or elsewhere.
• Often there will be multiple MoinMoin wikis on one host, so try to enumerate the host to find more.

For many themes, modifying the files noted above will be sufficient. Optionally, moin can display avatar images for the users, using gravatar.comservice. This is recommended to allow your users to immediately recognize which wiki site they are currently on. Simple customizations using CSS can be made by providing a file named custom.cssin the wiki_local subdirectory.

Using the example above, if import19 is usedto convert a moin 1.9 wiki to moin 2.0, then an item foo would be renamed to foo/fooHome. If your wiki will be using custom namespaces then you cannot use thecreate_simple_mapping method. Fs is the type of the store, followed by a specificationthat makes sense for the fs (filesystem) vegas casino apk download store, i.e. a path with placeholders. MoinMoin supports storage backends as different ways of storing wiki items.

Make sure the dimensions of your logo image or text fit into the layout ofthe theme(s) your wiki users are using. If you would like to customize some parts, you have to copy the built-insrc/moin/templates/snippets.html file and save it in the wiki_local directory so moincan use your copy instead of the built-in one. Customizing a wiki usually requires adding a few files that contain custom templates,logo image, CSS, etc. This file will be initially copied to yourwiki path when you create a new wiki and wikiconfig.py is missing. A real-life example of a wikiconfig.py can be found in thesrc/moin/config directory.

wikiconfig.py Layout

%(backend)s placeholder will be replaced by the namespace forthe respective backend. Stores is the name of the backend, followed by a colon, followed by a storespecification. The uri depends on the kind of storage backend and stores you want to use,see below. With the option “content_security_policy_limit_per_day”, admins can limit the numberof reports in the log per day to avoid log overflow. The behavior can be configured with the options“content_security_policy” and “content_security_policy_report_only”.

One advantage of using this directory and following the examples belowis that MoinMoin will serve the files. The preview and sql subdirectories are created when auser edits a wiki item. Mywiki may be created as asubdirectory of myvenv or elsewhere. MoinMoin is able to either use a built-in search engine (rather slow, but no dependencies) or a Xapian-based indexed search engine (faster, and can also search old revisions and attached files).

Password security

Within wikiconfig, ACLs are specifiedper namespace and storage backend (see storage backend docs for details). Hardening security implies that there will be a registration and login process that enablesindividual users to gain privileges. Moin’s default configuration makes use of hard security to prevent unwanted spam.Wiki administrators may soften security by reconfiguring the default ACLs. To help users choose reasonable passwords, Moin has a simple built-inpassword checker that is enabled by default and does some sanity checks,so users don’t choose easily crackable passwords. When using unencrypted connections, wiki users are advised to make sure theyuse unique credentials and not reuse passwords that are used for other purposes.

Why use Python for configuration?

As you might know, many users are bad at choosing reasonable passwords and someare tempted to use easily crackable passwords. For public wikis with very low security / privacy needs, it might not be neededto encrypt the content transmissions, but there is still an issue for thecredential transmissions. AuthLog is not a real authenticator in the sense that it authenticates (logs in) ordeauthenticates (logs out) users.

Folders and files

If you find sites not included in the list below, please add them. This especially happens with academic wikis. Often there will be multiple MoinMoin wikis on one host, so try to enumerate the host to find more. The original MoinMoin “DesktopEdition” is significantly easier to use, because it uses a built-in Web server to display pages, requiring only Python to be installed on the host machine. The CamelCase is activated by default and MoinMoin does not allow disabling CamelCase links except on a one-off basis. It also uses the idea of separate parsers, e.g., for parsing the wiki syntax, and formatters, e.g., for outputting HTML code, with a SAX-like interface between the two.

The CSP configuration depends on the individual wiki landscape and the capabilitiesof web browsers vary. The wiki server must be restarted to reflect updates made to ConfigGroupsand CompositeGroups. There is a special ACL entry, “Default”, which expands itself in-place to thedefault ACL.

Customize the CMS Theme

As wiki items are created and updated, the default configuration may be overriddenon specific items by setting an ACL on that item. ACLs enable wiki administrators and possibly users to choosebetween soft security and hard security. For users configuring GivenAuth on Apache, an example virtual host configurationis included at contrib/deployment/moin-http-basic-auth.conf Copy an info.json file to your theme directory and edit as needed.Create a file named theme.css in the src/moin/themes//static/css/ directory. To add a new theme, add a new directory under src/moin/themes/ where the directoryname is the name of your theme.

If moin wants to knowwhether he may write, the answer will be “yes”. The write capability includes the authority to delete an item since any user with write authoritymay edit and remove or replace all content. You have to be very careful with permissionchanges happening as a result of changes in the hierarchy, such as when you create,rename or delete items. The default ACLis only used if no ACL is specified in the metadata of the target item. As shown above, before, default and after ACLs are specified.

Moinmoin 2.0, based on Python 3.5, is not yet released (as of November 2023), and “development is very slow going,” according to their Python3 support page. The current release of Moinmoin, 1.9.11, is written in Python 2.7 and is not slated to be ported to Python 3. Dozens of organizations use MoinMoin to run public wikis, including free software projects Ubuntu, Apache, Debian, and FreeBSD. MoinMoin is a wiki engine implemented in Python, initially based on the PikiPiki wiki engine. Much of the informationyou find in the wiki refers to Moin 1.9 and does not apply to Moin2. MoinMoin is an easy-to-use, full-featured, and extensible wiki software packagewritten in Python.

MoinMoin offers a basic functionality for setting CSP headers and logging CSP reportsfrom client browsers. The dict backend provides a means for translating phrases in documentation through theuse of the GetVal macro. To achievemaximum benefit, some advance planning is required to determine the kind and namesof groups suitable for your wiki. If you don’t configure these secrets, moin will detect this and reuse Flask’sSECRET_KEY for all secrets it needs. Secrets are long random strings and not a reuse of any of your passwords.Don’t use the strings shown below, they are NOT secret as they are part of themoin documentation. Because a match has been made,the third entry is not processed.

You can either add some normal css stylesheet or add a choice of alternatestylesheets. At the bottom of your wiki pages, usually some text and image links are shownpointing out that the wiki runs MoinMoin, uses Python, that MoinMoin is GPL licensed, etc. At first, you might wonder why we use Python code for configuration. If you’re not used to the config file format, backup your last working configso you can revert to it in case you make some hard to find typo or other error. Start from one of the sample configs provided with moinand only perform small changes, then try it before testing the next change.

If “Idiot” is currently logged in and moin wants to know whether he may write,it will find no match in the first entry, but the second entry will match. If moin wants to know whether SuperMan may write, the first entry will not matchon both sides, so moin will proceed and look at the second entry. If “SuperMan” is currently logged in and moin wants to know whether he maydestroy, it’ll find a match in the first entry, because the name matches and permissionin question matches. If moin wants to know whether he may destroy,the answer will be “yes”, as destroy is one of the capabilities/rights listedon the right side of this entry. If “SuperMan” is currently logged in and moin processes this ACL, it will finda name match in the first entry. In addition to the groups provided by the group backend(s), there are somespecial group names available within ACLs.