EditContent Protection
Protect=<category>;<users>[;<message>]
This configuration tag will define a wiki category where the content will be displayed only for the defined classes of users. Pages which need their content protected will be assigned to the category defined here.
This tag is particularly useful in controlling the wiki content provided to users who have not logged in, or at an insufficient level. This may include pages of information confidential to administrators or specific users.
This configuration setting can be used more than once - one for each category setting to define
Parameters
| <category> | required | Category which is controlled. Any pages given this category will be protected only for the user classes defined. |
| <users> | required | List of user classes which the pages from the categories will be permitted access. Multiple classes can be specified, comma delimited. |
| <message> | optional | Default message when a user of insufficient rights access the pages allocated to the given category. If a message is not defined, then the page should contain appropriate information for the user. |
Users accessing the page fall into one of the following groups
Admins | Any logged-in user with Admin rights |
Users | Any logged-in user, but without any admin rights |
Guests | Any user who has not logged in |
<userid> | The specific user id of a logged-in user |
Example
Defines two categories which will be protected - 'Only for Admins' for Admins only, 'Workflow' for logged in users
Protect=Only for Admins;Admins;<font color=red>You may not see this</font>←
<STYLE type=text/css>#PageInfoDiv, #EditHistoryLinkDiv, A.editsectionlink { display:none;}</STYLE>
Protect=Workflow;Admins,User
EditAdd Content to pages For Users
AddFor=<users>;<message>
This configuration tag will force the content defined to be added to every standard pages as it is rendered to the user's browser. (System pages, like Sidebar and footer, etc, will not be effected)
This tag is particularly useful in controlling the functionality provided to users who have not logged in, or at an insufficient level.
Parameters
| <users> | required | List of user classes where the content will be appended to the page. Multiple classes can be specified, comma delimited. |
| <message> | required | The content to be added to the page for the specified user class. |
Users accessing the page fall into one of the following groups
Admins | Any logged-in user with Admin rights |
Users | Any logged-in user, but without any admin rights |
Guests | Any user who has not logged in |
<userid> | The specific user id of a logged-in user |
Example
Adds script commands to turn off the edit and history tabs on all pages for Guest users
AddFor=Guests;<STYLE type=text/css>#PageInfoDiv, #EditHistoryLinkDiv, A.editsectionlink { display:none;}</STYLE>
EditRandom Message Page
MessagePage=<page>
This configuration tag defines the default page for Random Messages. The Random Message is inserted into the system or user page with the
{RandomMessage} tag. See
Using ElectricImages.Formatter for details on using the tag.
This tag is only necessary if the {RandomMessage} does not define the Message page specifically.
Parameters
| <page> | required | The page holding the message content. This is for the default page setting only. |
Example
Sets the default Random Message page to the content from the Quotes page
MessagePage=Quotes
EditHints
HintCategory=<category>
The HintCategory configuration tag defines the default category for pulling Hint pages. Each page that is to be presented as hint content, is assigned to the default category given here.
This tag is only necessary if the page {Hint} tag does not define the category specifically.
Parameters
| <category> | required | The category holding the hints pages. This sets the default category only. |
Example
Sets the default pages for Hints to those assigned to the Hints category
HintCategory=Hints
EditNo Changes Message
NoChangesMessage=<content>
The NoChangesMessage configuration tag defines the content to display to the user when the {RecentChanges} and {NewPages} tags would otherwise return no content. This ensures that users are not presented with an otherwise blank page.
Parameters
| <content> | required | The content to be used when no other content would appear with the recent changes tags. |
Example
Sets the default content when {RecentChanges} and {NewPages} return nothing
NoChangesMessage=<small><i>none</i></small>
EditStyle Sheet
The following items
must be added to the style-sheet theme for the site. These should be added to the
Screen_Styles.css file by the administrator.
/* styles for references */
#ReferenceDiv {
font-size: 10px;
color: silver;
}
li.RefStyle {
}
/* styles for hints (page embedding} */
#HintDiv {
background-color:#f0f0f0;
border:1px solid black;
margin-left:40px;
margin-right:40px;
padding:5px;
}
#HintDiv a.editsectionlink {
display:none;
}
/* styles for tabs bar */
div.ei_tabs_holder {
width:99%;
}
div.ei_tabs {
}
ul.ei_tabs {
background: url(images/tabborder.gif) repeat-x left bottom;
float: left;
width:100%;
list-style-type: none;
padding: 0px;
}
ul.ei_tabs li {
float: left;
margin: 0px 2px 0px 0px;
list-style-image:none;
}
ul.ei_tabs a {
border: #CBD9E0 1px solid;
border-bottom: none;
background:#eee;
float: left;
display: block;
font-weight: bold;
padding: 4px 8px 4px 8px ;
color: #888;
text-decoration: none
}
ul.ei_tabs a:hover {
background: #f8f8f8;
color: #1c6b8a;
text-decoration:none;
}
ul.ei_tabs a.active {
background: white;
padding-bottom: 5px;
cursor: default;
color: #728c40;
}
.ei_tabs_frame {
clear: left;
border: #CBD9E0 1px solid;
border-top: none;
padding: 4px 8px 4px 8px;
}
/* code highlighting */
.ei_code, .ei_code pre
{
font-family: Consolas, Monospace;
font-size: small;
color: black;
white-space: pre;
}
.ei_code .ei_altline
{
background-color: #f4f4f4;
width: 100%;
margin: 0em;
}
.ei_code .ei_linenum
{
color:dimgray;
}
.ei_code .ei_rem
{
color:green;
}
.ei_code .ei_key
{
color:blue;
}
.ei_code .ei_subkey
{
color: #0000c0;
}
.ei_code .ei_string
{
color: rgb(163,21,21);
}
.ei_code .ei_preproc
{
color: #cc6633;
}
.ei_code .ei_asp
{
background-color:yellow;
}
.ei_code .ei_tag
{
color: #800000;
}
.ei_code .ei_attr
{
color:red;
}
| | Page Tabs also requires a 1 pixel image containing the border for the bottom of the tabs. In the above styles example, the image is called tabborder.gif | |
EditScrewturn Wiki Engine Changes
The following 2 changes must be made to the Wiki Engine to provide complete protection from backdoor attacks to view the restricted wiki markup.
Find
Edit.aspx.cs file in the virtual root of your site and take a copy, putting it somewhere else (a good idea, but not critical as you can just reload from ScrewTurn site again)
Using a text editor, open
Edit.aspx.cs, and
ADD the following highlighted line of code (at around line 196) You should end up with the following (don't worry about about the exact formatting/layout, only the content)
...
if((!Settings.UsersCanUploadFiles && (SessionFacade.LoginKey != null && !SessionFacade.Admin)) ||
(!Settings.UsersCanUploadFiles && SessionFacade.LoginKey == null)) {
// Disable Quick Upload
updFile.Enabled = false;
}
if(pageInfo != null) {
if(pageInfo.Provider.ReadOnly) Response.Redirect(pageInfo.Name + Settings.PageExtension);
Content.GetFormattedPageContent(pageInfo, true);
if(pageInfo.Status == PageStatus.Locked) {
if(SessionFacade.LoginKey == null || (SessionFacade.LoginKey != null
&& (SessionFacade.LoginKey == null || !SessionFacade.Admin))) {
Response.Redirect("AccessDenied.aspx");
}
}
// Login/Authorization check
...
Save the
Edit.aspx.cs file, overwriting the original.
Find
History.aspx.cs file in the virtual root of your site and take a copy, putting it somewhere else (again, not a critical step)
Using a text editor, open
History.aspx.cs, and
ADD the following highlighted line of code (at around line 34). You should end up with the following (again don't worry about about the exact formatting)
...
pages = Pages.Instance;
users = Users.Instance;
page = pages.FindPage(Request"Page");
if(page != null) {
Content.GetFormattedPageContent(page, true);
content = Content.GetPageContent(page, true);
lblTitle.Text = Resources.Messages.PageHistory + ": " + content.Title;
}
else {
lblTitle.Text = Resources.Messages.PageNotFound;
}
if(!IsPostBack && page != null) {
...
Save the
History.aspx.cs file, overwriting the original.