X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/1fc3f034191d3eec78b4d5da343e282092a221be..2b1857135def154369e4ee33a565861272643b43:/doc/setup/byhand/discussion.mdwn diff --git a/doc/setup/byhand/discussion.mdwn b/doc/setup/byhand/discussion.mdwn index 941976789..deb79a8db 100644 --- a/doc/setup/byhand/discussion.mdwn +++ b/doc/setup/byhand/discussion.mdwn @@ -5,3 +5,18 @@ What directory is the 'working copy'? There can be two interpretations: the curr > copies of all the versioned files, and whatever VCS-specific cruft that > entails. So, a working copy is everything you get when you `git clone` > a repository. --[[Joey]] + +------------------- + +The page says *"Note that this file should **not** be put in your wiki's directory with the rest of the files."* Why is that? + +One possible thing is security: Is it just a precaution or would anyone with "write" access to wiki be able to replace the file? + + --[[Martian]] + +> Anyone with the ability to delete/replace attachments via the web UI, or the ability +> to commit directly to the VCS, would be able to replace it. That breaks ikiwiki's +> security model, because replacing the setup file is sufficient to achieve +> arbitrary code execution as the user running the CGI and VCS hooks. --[[smcv]] + +>> Thanks. After all found it here: [[security]]. Now I wonder if I always use a file from the master branch, while limiting users to staging, it might fly...