Control whether Foswiki will use persistent sessions.

Set the session timeout, in seconds. The session will be cleared after this amount of time without the session being accessed. The default is 6 hours (21600 seconds).

Note By default, session expiry is done "on the fly" by the same processes used to serve Foswiki requests. As such it imposes a load on the server. When there are very large numbers of session files, this load can become significant. For best performance, you can set {Sessions}{ExpireAfter} to a negative number, which will mean that Foswiki won't try to clean up expired sessions using CGI processes. Instead you should use a cron job to clean up expired sessions. The standard maintenance cron script tools/tick_foswiki.pl includes this function.

Session files are stored in the {WorkingDir}/tmp directory.

This setting is also used to set a lifetime for passthru redirect requests.

By default Foswiki uses Javascript to perform "double submission" validation of browser requests. This technique, called "strikeone", is highly recommended for the prevention of cross-site request forgery (CSRF). See also Why am I being asked to confirm?.

If Javascript is known not to be available in browsers that use the site, or cookies are disabled, but you still want validation of submissions, then you can fall back on a embedded-key validation technique that is less secure, but still offers some protection against CSRF. Both validation techniques rely on user verification of "suspicious" transactions.

This option allows you to select which validation technique will be used.
If it is set to "strikeone", or is undefined, 0, or the empty string, then double-submission using Javascript will be used.
If it is set to "embedded", then embedded validation keys will be used.
If it is set to "none", then no validation of posted requests will be performed.

1. none - Don't support logging in, all users have access to everything.
2. Foswiki::LoginManager::TemplateLogin - Redirect to the login template, which asks for a username and password in a form. Does not cache the ID in the browser, so requires client sessions to work.
3. Foswiki::LoginManager::ApacheLogin - Redirect to an '...auth' script for which Apache can be configured to ask for authorization information. Does not require client sessions, but works best with them enabled.

Comma-separated list of scripts in the bin directory that require the user to authenticate. This setting is used with TemplateLogin; any time an unauthenticated user attempts to access one of these scripts, they will be required to authenticate. With ApacheLogin, the web server must be configured to require a valid user for access to these scripts. edit and save should be removed from this list if the guest user is permitted to edit topics without authentication.

The user mapping is used to equate login names, used with external authentication systems, with Foswiki user identities. By default only two mappings are available, though other mappings *may* be installed to support authentication providers.

1. Foswiki::Users::TopicUserMapping - uses Foswiki user and group topics to determine user information, and group memberships.
2. Foswiki::Users::BaseUserMapping - has only pseudo users such as {AdminUser} and {DefaultUserWikiName}, with the Admins login and password being set from this configure script. Does not support User registration, and only works with TemplateLogin.

Name of the password handler implementation. Foswiki ships with two alternative implementations:

1. Foswiki::Users::HtPasswdUser - handles 'htpasswd' format files, with passwords encoded as per the HtpasswdEncoding
2. Foswiki::Users::ApacheHtpasswdUser - should behave identically to HtpasswdUser for crypt encoding, but uses the CPAN:Apache::Htpasswd package to interact with Apache. It is shipped mainly as a demonstration of how to write a new password manager. It is not recommended for production.

You can provide your own alternative by implementing a new subclass of Foswiki::Users::Password, and pointing {PasswordManager} at it in lib/LocalSite.cfg.

If 'none' is selected, users will not be able to change passwords and TemplateLogin manager then will always succeed, regardless of what username or password they enter. This may be useful when you want to enable logins so Foswiki can identify contributors, but you don't care about passwords. Using ApacheLogin and PassordManager set to 'none' (and AllowLoginName = true) is a common Enterprise SSO configuration, in which any logged in user can then register to create their Foswiki Based identity.

Minimum length for a password, for new registrations and password changes. If you want to allow null passwords, set this to 0.

Path to the file that stores passwords, for the Foswiki::Users::HtPasswdUser password manager. You can use the htpasswd Apache program to create a new password file with the right encoding, however use caution, as it will remove email addresses from an existing file.

Password encryption, for the Foswiki::Users::HtPasswdUser password manager. This specifies the type of password hash to generate when writing entries to .htpasswd It is also used when reading password entries unless the parameter {Htpasswd}{AutoDetect} is enabled.

The choices in order of strongest to lowest strength:

(HTTPS)

Any below encoding over an HTTPS SSL connection. (Not a selection here.)

htdigest-md5

Strongest only when combined with the Foswiki::LoginManager::ApacheLogin Useful on sites where password files are required to be portable. The {AuthRealm} value is used with the username and password to generate the hashed form of the password, thus: user:{AuthRealm}:hash. This encoding is generated by the Apache htdigest command.

bcrypt

Hash based upon blowfish algorithm, strength of hash controlled by a cost parameter. Not compatible with Apache Authentication

apache-md5

Enable an Apache-specific algorithm using an iterated (1,000 times) MD5 digest of various combinations of a random 32-bit salt and the password (userid:$apr1$salt$hash). This is the default. This is the encoding generated by the htpasswd -m command.

sha1

It has the strongest hash however does not use salt and is therefor more vulnerable to dictionary attacks. This is the encoding generated by the htpasswd -s command (userid:{SHA}hash).

crypt-md5

Enable use of standard libc (/etc/shadow) crypt-md5 password (like user:$1$salt$hash:email). Unlike crypt encoding, it does not suffer from password truncation. Passwords are salted, and the salt is stored in the encrypted password string as in normal crypt passwords. This encoding is understood by Apache but cannot be generated by the htpasswd command.

crypt

Not Recommended. crypt encoding only uses the first 8 characters of the password. Extra characters are silently discarded. This is the default generated by the Apache htpasswd command (user:hash:email)

plain

stores passwords as plain text (no encryption). Useful for testing. Not compatible with {AutoDetect} option.

If you need to create entries in .htpasswd before Foswiki is operational, you can use the htpasswd or htdigest Apache program to create a new password file with the correct encoding. Use caution however as these programs do not support the email addresses stored by Foswiki in the .htpasswd file.

Allow the Foswiki::Users::HtPasswdUserpassword check routines to auto-detect the stored encoding type. Enable this to allow migration from one encoding format to another format. Note that this does add a small overhead to the parsing of the .htpasswd file. Tests show approximately 1ms per 1000 entries. It should be used with caution unless you are using CGI acceleration such as FastCGI or mod_perl. This option is not compatible with plain text passwords.

Specify the cost that should be incured when computing the hash of a password. This number should be increased as CPU speeds increase. The iterations of the hash is roughly 2^cost - default is 8, or 256 iterations.

If you want users to be able to use a login ID other than their wikiname, you need to turn this on. It controls whether the 'LoginName' box appears during the user registration process, and is used to tell the User Mapping module whether to map login names to wikinames or not (if it supports mappings, that is).

Controls whether new user registration is available. It will have no effect on existing users.

Whether registrations must be verified by the user, by following a link sent in an email to the user's registered email address

Set the pending registration timeout, in seconds. The pending registration will be cleared after this amount of time. The default is 6 hours (21600 seconds). This is only used if {Register}{NeedVerification} is enabled.

Note By default, registration expiry is done "on the fly" during the registration process. For best performance, you can set {Register}{ExpireAfter} to a negative number, which will mean that Foswiki won't try to clean up expired registrations durning registration. Instead you should use a cron job to clean up expired sessions. The standard maintenance cron script tools/tick_foswiki.pl includes this function.

Note that if you are using registration approval by 3rd party reviewers, this timer should most likely be significantly increased. 24 hours = 86400, 3 days = 259200.

Pending registration requests are stored in the {WorkingDir}/registration_approvals directory.

Normally users can register multiple WikiNames using the same email address. Enable this parameter to prevent multiple registrations using the same email address.

Array of the names of configuration items that are available when using %IF, %SEARCH and %QUERY{}%. Extensions can push into this array to extend the set. This is done as a filter in because while the bulk of configuration items are quite innocent, it's better to be a bit paranoid.

Allow %INCLUDE of URLs. This is disabled by default, because it is possible to mount a denial-of-service (DoS) attack on a Foswiki site using INCLUDE and URLs. Only enable it if you are in an environment where a DoS attack is not a high risk.

You may also need to configure the proxy settings ({PROXY}{HOST} and {PROXY}{PORT}) if your server is behind a firewall and you allow %INCLUDE of external webpages (see Proxies).

Used to disallow the use of SCRIPT and LITERAL tags in topics by removing them from the body of topics during rendering. This setting is fundamentally unsafe and is now DEPRECATED - use SafeWikiPlugin instead.

Hostname or address of the proxy server. CAUTION This setting can be overridden by a PROXYHOST setting in SitePreferences. Make sure you delete the setting from there if you are using a SitePreferences topic from a previous release of Foswiki. If your proxy requires authentication, simply put it in the URL, as in: http://username:password@proxy.your.company.

Some environments require outbound HTTP traffic to go through a proxy server. Set the port number here (e.g: 8080). CAUTION This setting can be overridden by a PROXYPORT setting in SitePreferences. Make sure you delete the setting from there if you are using a SitePreferences topic from a previous release of Foswiki.

Text added to e-mail addresses to prevent spambots from grabbing addresses e.g. set to 'NOSPAM' to get fred@user.co.ru rendered as fred@user.coNOSPAM.ru

Normally Foswiki stores the user's sensitive information (such as their e-mail address) in a database out of public view. This is to help prevent e-mail spam and identity fraud.

This setting controls whether or not the %USERINFO% macro will reveal details about users other than the current logged in user. It does not control how Foswiki actually stores email addresses.

If disclosure of emails is not a risk for you (e.g. you are behind a firewall) and you are happy for e-mails to be made public to all Foswiki users, then you can disable this option. If you prefer to store email addresses directly in user topics, see the TopicUserMapping expert setting under the UserMapping tab.

Note that if this option is set, then the user parameter to %USERINFO is ignored for non-admin users.

By default Foswiki will also manipulate e-mail addresses to reduce the harvesting of e-mail addresses. Foswiki will encode all non-alphanumeric characters to their HTML entity equivalent. e.g. @ becomes @ This is not completely effective, however it can prevent some primitive spambots from seeing the addresses. More advanced bots will still collect addresses.

By default, Foswiki doesn't do anything to stop robots, such as those used by search engines, from visiting "normal view" pages. If you disable this option, Foswiki will generate a META tag to tell robots not to index pages.
Inappropriate pages (like the raw and edit views) are always protected from being indexed.
Note that for full protection from robots you should also use robots.txt (there is an example in the root of your Foswiki installation).

Foswiki supports different implementations of log files. It can be useful to be able to plug in a database implementation, for example, for a large site, or even provide your own custom logger. Select the implementation to be used here. Most sites should be OK with the PlainFile logger, which automatically rotates the logs every month.

Note that on very busy systems, this logfile rotation can be disruptive and the Compatibility logger might perform better.

The PlainFile::Obfuscating logger is identical to the PlainFile logger except that IP addresses are either obfuscated by replacing the IP Address with a MD5 Hash, or by completely masking it to x.x.x.x. If your regulatory domain prohibits tracking of IP Addresses, use the Obfuscating logger. Note that Authentication Errors are never obfuscated.

Note: the Foswiki 1.0 implementation of logfiles is still supported, through use of the Foswiki::Logger::Compatibility logger. Foswiki will automatically select the Compatibility logger if it detects a setting for {WarningFileName} in your LocalSite.cfg.

Directory where log files will be written. Note that the Compatibility Logger does not use this setting by default.

Log file for debug messages when using the Compatibility logger. (Usually very low volume.) If %DATE% is included in the file name, it gets expanded to YYYYMM (year, month), causing a new log to be written each month.

To use the Compatibility logger, set this to a valid file path and name.
Foswiki 1.0.x default: $Foswiki::cfg{DataDir}/debug.txt
or Foswiki 1.1 logging directory $Foswiki::cfg{Log}{Dir}/debug%DATE%.txt

Log file for Warnings when using the Compatibility logger. (Usually low volume) If %DATE% is included in the file name, it gets expanded to YYYYMM (year, month), causing a new log to be written each month.

To use the Compatibility logger, set this to a valid file path and name.
Foswiki 1.0.x default: $Foswiki::cfg{DataDir}/warn%DATE%.txt
or Foswiki 1.1 logging directory $Foswiki::cfg{Log}{Dir}/warn%DATE%.txt

Log file recording web activity when using the Compatibility logger. (High volume). If %DATE% is included in the file name, it gets expanded to YYYYMM (year, month), causing a new log to be written each month.

To use the Compatibility logger, set this to a valid file path and name.

Foswiki 1.0.x default: $Foswiki::cfg{DataDir}/log%DATE%.txt
or Foswiki 1.1 logging directory $Foswiki::cfg{Log}{Dir}/log%DATE%.txt

Number of top viewed topics to show in statistics topic

Number of top contributors to show in statistics topic

Set this parameter to Allowed if you want the statistics script to create a missing WebStatistics topic only when the parameter autocreate=1 is supplied. Set it to Always if a missing WebStatistics topic should be created unless overridden by URL parameter 'autocreate=0'. Prohibited is the previous behavior and is the default.

If this is set to the name of a Group, then the statistics script will only run for members of the specified and the AdminGroup. Ex. Set to AdminGroup to restrict statistics to administrators. Default is un-set. Anyone can run statistics.

Enable user interface internationalisation, i.e. presenting the user interface in the users own language(s). Some languages require the Locale::Maketext::Lexicon and Encode/MapUTF8 Perl modules to be installed.

Enable the use of {Site}{Locale}.

Site-wide locale - used by Foswiki and external programs such as grep, and to specify the character set in which content must be presented for the user's web browser.
Note that {Site}{Locale} is ignored unless {UseLocale} is set.
Locale names are not standardised. On Unix/Linux check 'locale -a' on your system to see which locales are supported by your system. You may also need to check what charsets your browsers accept - the 'preferred MIME names' at http://www.iana.org/assignments/character-sets are a good starting point.
WARNING: Topics are stored in site character set format, so data conversion of file names and contents will be needed if you change locales after creating topics whose names or contents include 8-bit characters.
Examples:
en.utf8 - English encoded using UTF8
en_US.ISO-8859-1 - US english with ISO-8859-1 encoding
de_AT.ISO-8859-15 - Austria with ISO-8859-15 for Euro
ru_RU.KOI8-R - Russian encoded using KOI8-R
ja_JP.eucjp - Japan
C - English only; no I18N features regarding character encodings and external programs.

Set this to match your chosen {Site}{Locale} (from 'locale -a') whose character set is not supported by your available perl conversion module (i.e. Encode for Perl 5.8 or higher, or Unicode::MapUTF8 for other Perl versions). For example, if the locale 'ja_JP.eucjp' exists on your system but only 'euc-jp' is supported by Unicode::MapUTF8, set this to 'euc-jp'. If you don't define it, it will automatically be defaulted to iso-8859-1
UTF-8 support is still considered experimental. Use the value 'utf-8' to try it.

Set the timezone (this only effects the display of times, all internal storage is still in GMT). May be gmtime or servertimeA

This item is also used by configure to test if your perl supports early dates. Foswiki will still work fine on older versions of perl, but wiki applications that use dates somewhere prior to 1970 might encounter issues. 'configure' tests if 1901-01-01 is handled by the perl localtime function. Note, full support of early dates will not be available until Foswiki 1.2.

Set the default format for dates. The traditional Foswiki format is '$day $month $year' (31 Dec 2007). The ISO format '$year-$mo-$day' (2007-12-31) is recommended for non English language Foswikis. Note that $mo is the month as a two digit number. $month is the three first letters of English name of the month

Enable email globally. Un-check this option to disable all outgoing email from Foswiki

Wiki administrator's e-mail address e.g. webmaster@example.com (used in %WIKIWEBMASTER%) NOTE: must be a single valid email address

Wiki administrator's name address, for use in mails (first name and last name, e.g. Fred Smith) (used in %WIKIWEBMASTERNAME%)

Select the method Foswiki will use for sending email. On Unix/Linux hosts "MailProgram" is generally acceptable. Otherwise choose one of the Email methods required by your ISP or Email server.

• Net::SMTP sends in cleartext.
• Net::SMTP::SSL sends using a secure encrypted connection.

Both of the above methods will perform authentication if a Username and password are provided below.

• MailProgram uses the program configured below to send email. Authentication and encryption is done externally to Foswiki and the remainder of the below fields are not used.

This needs to be a command-line program that accepts MIME format mail messages on standard input, and mails them.

Mail host for outgoing mail. This is only used if Net::SMTP is installed. Examples: mail.your.company If the smtp server uses a different port than the default 25 # use the syntax mail.your.company:portnumber

CAUTION This setting can be overridden by a setting of SMTPMAILHOST in SitePreferences. Make sure you delete that setting if you are using a SitePreferences topic from a previous release of Foswiki.

For Gmail, set MailMethod to Net::SMTP::SSL, set MAILHOST to smtp.gmail.com:465 and provide your gmail email address and password below for authentication.

Mail domain sending mail, required if you are using Net::SMTP. SMTP requires that you identify the server sending mail. If not set, Net::SMTP will guess it for you. Example: foswiki.your.company. CAUTION This setting can be overridden by a setting of %SMTPSENDERHOST% in SitePreferences. Make sure you delete that setting.

Username for SMTP. Only required if your server requires authentication. If this is left blank, Foswiki will not attempt to authenticate the mail sender.

Password for your {SMTP}{Username}.

Enable S/MIME signing.

Secure email certificate. If you want e-mail sent by Foswiki to be signed, specify the filename of the administrator's X.509 certificate here. It must be in PEM format.

Secure email certificate. If you want e-mail sent by Foswiki to be signed, specify the filename of the administrator's X.509 private key here. It must be in PEM format. Be sure that this file is only readable by the Foswiki software; it must NOT be readable by users!

Default table attributes.

Enable debugging (debug messages will be written to data/debug.txt)

a hash mapping TWiki's TWiki web topics to Foswiki's topics

a hash mapping TWiki's Main web topics to Foswiki's topics

Used by TWikiCompatibilityPlugin view and viewfile auto-compatibility. if a topic or attachment is not found in one web, it will try the other.

Turn on/off debugging in debug.txt

Template defined by form overrides existing VIEW_TEMPLATE or EDIT_TEMPLATE settings

How to find the view or edit template. 'exist' means the template name is derived from the name of the form definition topic. 'section' means the template name is defined in a section in the form definition topic.

Style of the calendar

Language of the calendar

Default format of the calendar

Define the regular expression that an email address entered in WebNotify must match to be identified as a legal email by the notifier. You can use this expression to - for example - filter email addresses on your company domain, or even block use of raw emails in WebNotify altogether (just make it something that will never match, e.g. ^@@notAnEmail). If this is not defined, then the default setting of [A-Za-z0-9.+-_]+\@[A-Za-z0-9.-]+ is used.

This setting is required to enable executing the compare script from the bin directory

This setting is required when using ApacheLogin and the user needs to be authenticated when executing the compare script