diff options
| author | Chris Smith <chris@jalakai.co.uk> | 2007-05-28 21:47:47 +0200 |
|---|---|---|
| committer | Chris Smith <chris@jalakai.co.uk> | 2007-05-28 21:47:47 +0200 |
| commit | 4c9890379da4188edae519d126c315ce93c4e593 (patch) | |
| tree | 84b78ac3b49031084e146d9549084b5e1b10dae4 /conf/dokuwiki.php | |
| parent | 3848a0ddedff8fb591bec112b4494ef277dd4737 (diff) | |
| download | rpg-4c9890379da4188edae519d126c315ce93c4e593.tar.gz rpg-4c9890379da4188edae519d126c315ce93c4e593.tar.bz2 | |
Partial Fix FS#1085
This fix adds a new configuration setting, 'auth_security_timeout', which controls the duration (seconds) before authentication
information is rechecked. The default value is set to 900 seconds (15 minutes). Wiki installations particularly concerned
about security should set this value to 0.
DokuWiki maintains a copy of the most recent authentication details in both a browser cookie and server session. Normally these
values are compared on each page visit. If the comparison passes the user is accepted. The same data will be used over and
over until either the cookie or the session expires. FS#1085 is concerned with updates to the original authentication data not
being able to affect this comparison. The new 'auth_security_timeout' setting will force expiration of the saved data after the
specified period has elapsed.
Re-authentication may affect page response, especially on systems which use remote authentication systems.
This fix is considered partial and should be reviewed after the next release with a view to extending the authentication class
to allow those mechanisms which are able to control when DW should revoke authentication.
darcs-hash:20070528194747-d26fc-f471004da604eb66f7131c470e446b98c29d801b.gz
Diffstat (limited to 'conf/dokuwiki.php')
| -rw-r--r-- | conf/dokuwiki.php | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/conf/dokuwiki.php b/conf/dokuwiki.php index f6c595e18..d0ad4f4f7 100644 --- a/conf/dokuwiki.php +++ b/conf/dokuwiki.php @@ -68,6 +68,7 @@ $conf['manager'] = '!!not set!!'; //The manager can be user or @group $conf['profileconfirm'] = '1'; //Require current password to confirm changes to user profile $conf['disableactions'] = ''; //comma separated list of actions to disable $conf['sneaky_index'] = 0; //check for namespace read permission in index view (0|1) (1 might cause unexpected behavior) +$conf['auth_security_timeout'] = 900; //time (seconds) auth data is considered valid, set to 0 to recheck on every page view /* Advanced Options */ |