Category: 2.x

{THUMB(id=20)/}

There are some problems with mail notifications in tracker:

- mail sent by tw is in the wrong language and the "from" header field is empty when deleting a tracker item,
- mail sent by tw is (only) in the wrong language when the notification is about a comment or a file attachment
- everything is ok when the notification is about an item changing

{sign user="pascalstjean" datetime="2013-08-25T21:32:40+00:00"}
Problem still seems to exist. Merging this case with Bug #4681

I tried to upload a 230MB media file to a file gallery, and the site didn't have progress bar, and it sent the request for 25 minutes, then stopped and the file never uploaded.

Marc Laporte adds:
"A progress bar, and maybe a test/check first that file is smaller than
what is permitted by server config. In image gallery, tiki tells you
who much you can upload. This is needed for file gallery as well."

last_insert_id() is used in SQL in a couple of places in TikiWIki. This is a mysql-specific function that breaks functionality when other databases are used.

For TikiWiki CVS HEAD (1.10):

lib/articles/artlib.php:152: $query = "select `subId` from `tiki_submissions` where `subId`=last_insert_id()";

lib/multilingual/multilinguallib.php:28: $query = "insert into `tiki_translated_objects` (`type`,`objId`,`traId`,`lang`) values (?,?,last_insert_id(),?)";

Also present in TikiWiki 1.9.x

Reported by Thrain - thanks.

Hello all.

Almost by chance I noticed a behavior which seems wrong regarding the LDAP authentication on TikiWiki 2.0. I'm not sure if it was already present in 1.9.11 but I don't think so. We migrated last week.

Regarding the TW configuration:

- authentication method is "Tiki+PEAR::Auth"
- users cannot register and cannot change password
- "Create user if not in Tiki?" is on
- "Create user if not in Auth?" is off
- "Just use Tiki auth for admin?" is on
- The LDAP auth configuration paramters are correct, the auth itself works well, as it worked in 1.9.11. When TW connects to the LDAP server (OpenLDAP 2.1.30) the authentication works as expected.

This means that a Tiki account is created when LDAP users login for the first time. As expected, in presence of such a user, TW connects to LDAP, authenticates, creates Tiki account and logs the user in (I have some doubts in this last item though). However, when users log in again after this, I would expect that authentication is still delegated completely to the LDAP and is not done through Tiki. Instead, I have confirmed by looking at my LDAP logs that when TW finds a Tiki account, it authenticates the user through Tiki and never connects to the LDAP. This is not the expected behavior, because it means that passwords are being stored on the TW database and actually used for authentication. As a consequence, when a user changes his password on the LDAP, this is not "seen" by TW.

I'm pretty sure this is not the intended behavior also because if I go to Admin Users, both the "edit user" and the "add user" boxes show the following:

"No password is required
Tikiwiki is configured to delegate the password managment to LDAP through PEAR Auth."

And actually, the "edit user" box also says "Warning: changing the username will require the user to change his password" which is a contradiction since the password should be managed by LDAP and my TW is configured to disallow users from being able to change their passwords.

Paulo

Our Active Directory is configured not to allow arbitrary LDAP searches for unprivileged users. However, these users can successfully bind to AD's LDAP interface. This would be enough for authentication and we would not need a special account for checking authentication.

I therefore removed parts of the function fetchData in /lib/pear/Auth/Container/LDAP.php:

{img src=images/code.png}%%% {CODE()}
function fetchData($username, $password)
{
$this->log('Auth_Container_LDAP::fetchData() called.', AUTH_LOG_DEBUG);
$err = $this->_prepare();
if ($err !== true) {
return PEAR::raiseError($err->getMessage(), $err->getCode());
}

$err = $this->_getBaseDN();
if ($err !== true) {
return PEAR::raiseError($err->getMessage(), $err->getCode());
}

// UTF8 Encode username for LDAPv3
if (@ldap_get_option($this->conn_id, LDAP_OPT_PROTOCOL_VERSION, $ver) && $ver == 3) {
$this->log('UTF8 encoding username for LDAPv3', AUTH_LOG_DEBUG);
$username = utf8_encode($username);
}

/* // make search filter
$filter = sprintf('(&(%s=%s)%s)',
$this->options['userattr'],
$this->_quoteFilterString($username),
$this->options['userfilter']);

// make search base dn
$search_basedn = $this->options['userdn'];
if ($search_basedn != '' && substr($search_basedn, -1) != ',') {
$search_basedn .= ',';
}
$search_basedn .= $this->options['basedn'];

// attributes
$searchAttributes = $this->options['attributes'];

// make functions params array
$func_params = array($this->conn_id, $search_basedn, $filter, $searchAttributes);

// search function to use
$func_name = $this->_scope2function($this->options['userscope']);

$this->log("Searching with $func_name and filter $filter in $search_basedn", AUTH_LOG_DEBUG);

// search
if (($result_id = @call_user_func_array($func_name, $func_params)) === false) {
$this->log('User not found', AUTH_LOG_DEBUG);
} elseif (@ldap_count_entries($this->conn_id, $result_id) >= 1) { // did we get some possible results?

$this->log('User(s) found', AUTH_LOG_DEBUG);

$first = true;
$entry_id = null;

do {

// then get the user dn
if ($first) {
$entry_id = @ldap_first_entry($this->conn_id, $result_id);
$first = false;
} else {
$entry_id = @ldap_next_entry($this->conn_id, $entry_id);
if ($entry_id === false)
break;
}
$user_dn = @ldap_get_dn($this->conn_id, $entry_id);

// as the dn is not fetched as an attribute, we save it anyway
if (is_array($searchAttributes) && in_array('dn', $searchAttributes)) {
$this->log('Saving DN to AuthData', AUTH_LOG_DEBUG);
$this->_auth_obj->setAuthData('dn', $user_dn);
}

// fetch attributes
if ($attributes = @ldap_get_attributes($this->conn_id, $entry_id)) {

if (is_array($attributes) && isset($attributes['count']) &&
$attributes['count'] > 0) {

// ldap_get_attributes() returns a specific multi dimensional array
// format containing all the attributes and where each array starts
// with a 'count' element providing the number of attributes in the
// entry, or the number of values for attribute. For compatibility
// reasons, it remains the default format returned by LDAP container
// setAuthData().
// The code below optionally returns attributes in another format,
// more compliant with other Auth containers, where each attribute
// element are directly set in the 'authData' list. This option is
// enabled by setting 'attrformat' to
// 'AUTH' in the 'options' array.
// eg. $this->options['attrformat'] = 'AUTH'

if ( strtoupper($this->options['attrformat']) == 'AUTH' ) {
$this->log('Saving attributes to Auth data in AUTH format', AUTH_LOG_DEBUG);
unset ($attributes['count']);
foreach ($attributes as $attributeName => $attributeValue ) {
if (is_int($attributeName)) continue;
if (is_array($attributeValue) && isset($attributeValue['count'])) {
unset ($attributeValue['count']);
}
if (count($attributeValue)<=1) $attributeValue = $attributeValue[0];
$this->log('Storing additional field: '.$attributeName, AUTH_LOG_DEBUG);
$this->_auth_obj->setAuthData($attributeName, $attributeValue);
}
}
else
{
$this->log('Saving attributes to Auth data in LDAP format', AUTH_LOG_DEBUG);
$this->_auth_obj->setAuthData('attributes', $attributes);
}
}
}
@ldap_free_result($result_id);


// need to catch an empty password as openldap seems to return TRUE
// if anonymous binding is allowed
*/ $user_dn = $username;
if ($password != "") {
$this->log("Bind as $user_dn", AUTH_LOG_DEBUG);

// try binding as this user with the supplied password
if (@ldap_bind($this->conn_id, $user_dn, $password)) {
$this->log('Bind successful', AUTH_LOG_DEBUG);
// check group if appropiate
if (strlen($this->options['group'])) {
// decide whether memberattr value is a dn or the username
$this->log('Checking group membership', AUTH_LOG_DEBUG);
$return = $this->checkGroup(($this->options['memberisdn']) ? $user_dn : $username);
$this->_disconnect();
return $return;
} else {
$this->log('Authenticated', AUTH_LOG_DEBUG);
$this->_disconnect();
return true; // user authenticated
} // checkGroup
} // bind
} // non-empty password
// } while ($this->options['try_all'] == true); // interate through entries
// } // get results
// default
$this->log('NOT authenticated!', AUTH_LOG_DEBUG);
$this->_disconnect();
return false;
}
{CODE}

If would be nice to have a checkbox in the LDAP part of the admin page for selecting this behaviour.

Hi All,

I’m working on the Tikiwiki 2.2 with a LDAP authentication.

In the login option, I see it is possible to automatically give someone access in the Tiki if this person is in LDAP directory.

My question is: Is it possible to define access with a Distribution List group and not with the entire LDAP directory?

On another note, do you know why “LDAP Member is DN” can not be set to “yes?”

Thanks for your response

Legacy mod theme Akwa causes blank screen on 2.0.

When using phplayer menu system, using a sorted level 0 menu item - the msnu options under that sorted level are not sorted. This option works fine if your menu is not using phplayer, but once phplayer is used, it does not sort.

When Tiki creates an RSS feed for a tracker, it will include __all__ items from that tracker, regardless of status. Tiki will ignore all status-related permissions, too.

For example, if Anonymous cannot view pending items, Tiki will ''still'' include pending items in the tracker's RSS feed.

I want a way to limit the tracker items that appear in a feed, based on status.

Go to a wiki page and edit it using the WYSIWYG editor.
Click the button to create a Wiki link.
Select a Wiki page to link to and type the text as its name.
Click OK
Save page and click on link.
Link is broken doesn't go to Wiki page selected from Wiki Link "Generator"

I am using TikiWiki as a community "news/info" website. Part of this project will be to interview local people, government officials. Specifically, I will be inviting the Elderly in on weekends to share their life stories.

I need a tikiwiki feature similar to picture gallery or file gallery that can handle "media" in general. The audio and video recordings are hosted on a streaming server, so the entry would not necessarily be a file, but could also be a LINK to the location, eg: [mms://www.milescityvoice.com/2007JUL04Parade.asf]

I Could someone help develop a "MultiMedia" gallery feature?
Then i could write up the person's story as a tiki page, and embed the video or audio (or anything else) just like we insert images with the img tag.

I have successfully embedded the media with the URL directly, but I wanted a searchable gallery that can categorize as well to make the process more user friendly.

Thanks,

Eric

"Look and Feel" feature is activated on install. In the more links section of the Administration ::General page there is a label for this feature, but no link.

{syntax type="tiki" editor="plain"}
When files are attached to a gallery which have dependents <files galeries> the list of destinations don't makes appear these dependants galeries.

So when you have a too much populated gallery if you create sub-galeries you cannot move files to these sub-galeries and split your population.

This is a small quirk/inconsistency when using "List pages". You can set the display rows parameter but if the user has access to some pages restricted because of categorisation the actual display row limit used is the number of pages in the system and not the number of pages available to the user.

This means that the listing can be spread over several pages with perhaps only 1 or 2 pages shown per page even if the display rows parameter is set to (say) 30.

It would be much better if this could always show 'up to' the limit set no matter if some pages are restricted.

{syntax type="tiki" editor="plain"}
Locking a wiki page causes the "Translate" link to not display. As a user (baijianpeng) pointed out, there's no connection between wanting|not wanting original page changes and translations of that page.

Unless I'm missing something, it seems the Translate link should display regardless of whether the page is locked or not.

The 'best language' logic only applies if no wiki page is specified, i.e. it only applies to the default wiki page.

Suppose that you select a translated version of a wiki page, and then follow a link to another wiki page, which has also been translated (into the same language).

As is stands, you will probably see the original language version of the second wiki page, and not the translated version. On the face of it, this is an error.

You could, of course, fix this behaviour, by modifying the link in the translated version of the first page, so that it referred directly to the translated version of the second page. In this case, you could argue that the current functionality is in fact correct.

I would disagree, because it makes the process of translating wiki pages too difficult. It would mean, that when you translate a single wiki page, you must locate all other wiki pages in that language, which link to the page, and update the links in those pages. Although the backlinks feature would help find the relevant pages, I don't think that you can reasonably expect a translator to perform this task.

Hi there,

I want to nkow if it is possible to integrate the tikiwiki login process with another page, I want to create another secure page using the tikiwiki login process, Do you guys have any hint for doing that?

My page will be in php also, I know that I will probably have to do some inclusion but don't which file to include in my code and which function.

Any help will be much apreciated.

Thanks

When Intertiki is on, mod-login_box.tpl should show some info on the login box reporting where to register in order to log into that site. Example: edu.tw.o., with tw.o registration.
I've done this by hand:

^Intertiki is enabled. Log in with your account at <a href="http://tikiwiki.org">http://tikiwiki.org</a>. <br><b>New?</b>: <a href="http://tikiwiki.org/tiki-register.php">register at tw.o</a> and come back to log in here.
^
{CODE(wrap=>1)}
Intertiki is enabled. Log in with your account at <a href="http://tikiwiki.org">http://tikiwiki.org</a>. <br><b>New?</b>: <a href="http://tikiwiki.org/tiki-register.php">register at tw.o</a> and come back to log in here.
{CODE}

But this could be added more general on tiki, so that it checks whether intertiki feature is on, and get's the name of the intertiki server from some value at your tiki isntallation, and then, the message is customized on the login box.

Related:
((MemoryConsumption))


Here is a very famous error: "Fatal error: Allowed memory size of 8388608 bytes exhausted"
http://tikiwiki.org/art82

And they often cause blank pages. How can we can catch them and render a simple & descriptive error page (not enough memory) instead of a blank page?


__Maybe useful?__
Smarty validation class
http://www.phpriot.com/d/code/smarty/smarty-validator/index.html



Related:
Better protection against accidental site breakage with improper use of code in modules + template
http://dev.tikiwiki.org/tiki-view_tracker_item.php?itemId=1065

We can already send in content to Tiki via email:

add/edit wiki
add articles
via tiki-admin_mailin.php

and add forum posts via
tiki-admin_forums.php


joe@joe.com sends an email. The system recognizes that joe@joe.com belongs to the user "joe" and adds the tracker/wiki edit/forum post/article as if the user joe had logged in and added it via the web form.


Make this optional for security reasons. If someone spoofs the email address, he could send in content for someone else.

I'd like to have a way to comment on an item from GET by replying to it.

For example, right now an email with the subject:

GET:BigIdea

will send the user the BigIdea page.

A reply with the subject:

RE:GET:BigIdea

would generates a comment on the BigIdea page.

This use is different from appending or prepending. It's meant for a note in the margin not a modification of the original text.

See this topic in the forum:

http://tikiwiki.org/tiki-view_forum_thread.php?forumId=6&comments_parentId=32076&thread_sort_mode=commentDate_asc&was_queued=n

Short: Missing \r before each \n prevents sending of mail with tikiwiki installation on windows server.

This feature isn't internationalized.

The usage of quicktags is hardcoded in the PHP, like

$quicktags = $quicktagslib->list_quicktags(0,-1,'taglabel_desc','','trackers');

for the trackers. The french translation e.g. reads

Catégorie : wiki, formulaires, etc.

So a french user would enter "formulaires", but never see his Quicktags in the Trackers feature.

The e-mail notifications of watches (wiki, tracker, article, etc.) are sent out when changes are made. This means that the user submitting the change has to wait for the PHP-Code to send out all the mails before he can continue browsing. This is annoying and even...

... more evil is that with thousands of users to notify of the change the PHP-script will tend to time out and not all the notifications are sent!

One possibility would be to set the timeout higher, but that isn't really a solution at all. So the sending of mails needs to happen asynchronously. One simple solution would be to have a daemon running on the same system, which sends out the mails and the PHP-script just notifies the daemon of what to do. This would make installation a lot harder though and can't really be a desired solution.

Any possibilities to solve this in PHP directly?