Feature Proposal: Run the configure script only after authentication

Motivation

If configuration script is not restricted for authentication under webserver then it displays the internals of TWiki instance. Any body can run the configure and get information like directory structure, authentication method used in the TWiki instance which can be used for exploiting the instance.

Description and Documentation

1. If Administrator(admin account) password is not set in the TWiki, allow configure to set the password.
2. Add cookies/session capability to the script, when configure is accessed-prompt for password.
3. Verify the password with admin password of the TWik-then display the current configuration details. Allow user to modify it.
4. The save operation can be promoted for password and then the TWiki configuration modified.

Examples

Impact

Implementation

-- Contributors: SopanShewale - 2010-01-13

Discussion

Looks like a sensible enhancement. Special case where cookies are not available should be considered.

-- PeterThoeny - 2010-01-15

I have already coded on some private instance of the TWiki - the screens of the changes look similar to the follow:

If no password provided :

If wrong password provided:

Correct Password will show the following screen:

Asking confirmation to save the changes:

Please note here - the password can be changed here..we can move this to the first screen

Finally saved:

-- SopanShewale - 2010-01-19

Good spec, I like it.

As discussed in release meeting, this even works if cookies are disabled. Nice work!

-- PeterThoeny - 2010-02-02

TWikibug:Item6410 for code checkin

-- SopanShewale - 2010-03-31

This is implemented and in TWikiRelease05x00x00. Follow-up for usability enhancement is TWikibug:Item6477

-- PeterThoeny - 2010-06-06

Thanks Peter for raising the issue - we need more brainstorming for improving the look and feel and usability of this tool.

-- SopanShewale - 2010-06-07