Topic on Extension talk:Foxway/Flow

Hey, I would love to as my local admin to install this extension. He'll never go for it though due to security concerns. Now, "if" this extension only allowed php in a certain namespace that was only accessible/editable by people with a special user group right, then I could talk him into it. Something like the way that Extension:Widget allows special code to be entered in the "Widget:" namespace and requires editwidgets to edit in that namespace..

Hi, thanks for the feedback!

Why are you concerned about the security with this extension? This extension does not allows run php code! It works the same way as other extensions like Extension:ParserFunctions, but instead of using wiki syntax, uses the syntax of PHP.

I try to make sure that the output of this extension was very similar to the output of PHP. I use own PHP interpreter and never use direct run custom code in PHP interpreter installed on your computer.

Extension:Widget allows the creation of raw HTML pages. Therefore, for safety reasons, are allowed to use this extension is just to name space with limited access. Foxway does not allow creation of raw HTML pages, because MediaWiki parser processes the foxway outputs like any other text.

In any case, I will add the ability to specify the namespaces, which enable the extension foxway.

You can test the safety of extension Foxway in this sandbox

Hi, here's an example for giving permission to use Foxway extension is just a special user group:

(Place it in LocalSettings.php)

// Define new Namespace
define("NS_PHP", 1000);
define("NS_PHP_TALK", 1001);
$wgExtraNamespaces[NS_PHP] = "PHP";
$wgExtraNamespaces[NS_PHP_TALK] = "PHP_Talk";

// Protect this namespace
$wgNamespaceProtection[NS_PHP] = array( 'php_editor' );
$wgGroupPermissions['sysop']['php_editor'] = true;

// Allow Foxway only in this namespace
// Placing it AFTER the inclusion of Foxway!!!
$wgNamespacesWithFoxway = array( NS_PHP );