DevOps:Doc/FlexForm/2.0/security - Revision history

Fd4138e7-8b46-4c8f-99bf-d4b738ebc295: Text replacement - "|Subject version=2.0,2.1" to "|Subject version=2.0,2.1,2.5"

2025-08-21T09:08:01Z

Text replacement - "|Subject version=2.0,2.1" to "|Subject version=2.0,2.1,2.5"

ws-class-props
← Older revision		Revision as of 11:08, 21 August 2025
Line 1:		Line 1:
	{{Csp class properties		{{Csp class properties
	\|Subject version=2.0,2.1		\|Subject version=2.0,2.1,2.5
	\|Doc subject=DevOps:Doc/FlexForm		\|Doc subject=DevOps:Doc/FlexForm
	\|Doc synopsis=FlexForm Security options		\|Doc synopsis=FlexForm Security options

Maintenance script: Imported by PageSync

2025-07-15T08:34:52Z

Imported by PageSync

ws-class-props
← Older revision		Revision as of 10:34, 15 July 2025
Line 1:		Line 1:
	{{~~Doc~~ properties		{{Csp class properties
	\|Subject version=2.0,2.1		\|Subject version=2.0,2.1
	\|Doc subject=DevOps:Doc/FlexForm		\|Doc subject=DevOps:Doc/FlexForm

Charlot: User:Charlot

2023-03-31T20:12:13Z

User:Charlot

ws-class-props
← Older revision		Revision as of 22:12, 31 March 2023
Line 1:		Line 1:
	{{Doc properties		{{Doc properties
	\|Subject version=2.0		\|Subject version=2.0,2.1
	\|Doc subject=DevOps:Doc/FlexForm		\|Doc subject=DevOps:Doc/FlexForm
	\|Doc synopsis=FlexForm Security options		\|Doc synopsis=FlexForm Security options

Charlot at 22:19, 4 January 2023

2023-01-04T22:19:08Z

← Older revision		Revision as of 00:19, 5 January 2023
Line 32:		Line 32:

	== Other options ==		== Other options ==
	By default, a FlexForm form is never rendered for an anonymous user. You can change this by adding a restrictions="lifted" to a Form tag. This can be useful for e.g. a contact form or questionnaire.		By default, a FlexForm form is never rendered for an anonymous user. You can change this by adding a restrictions="lifted" to a Form tag. This can be useful for e.g. a contact form or questionnaire. Be sure to setup the build-in reCaptcha options in Flexform when allowing anonymous form submit!

	When creating a user input in a Form, FlexForm will by default always filter the input for html, JavaScript or malicious code. You can however specify per input what is allowed and what is not. More information here : [[DevOps:Doc/FlexForm/2.0/input\|Default input HTML attribute]]		When creating a user input in a Form, FlexForm will by default always filter the input for html, JavaScript or malicious code. You can however specify per input what is allowed and what is not. More information here : [[DevOps:Doc/FlexForm/2.0/input\|Default input HTML attribute]]

	Especially when you have a "closed" wiki, where people need to register and will get their rights through user groups, it is a good option just not to show a Form to someone from a user group that is not allowed to use it.		Especially when you have a "closed" wiki, where people need to register and will get their rights through user groups, it is a good option just not to show a Form to someone from a user group that is not allowed to use it.

Charlot at 21:13, 4 January 2023

2023-01-04T21:13:56Z

← Older revision		Revision as of 23:13, 4 January 2023
Line 17:		Line 17:
	<code>$wgFlexFormConfig['allowedGroups'] = ["sysop","moderator"];</code>		<code>$wgFlexFormConfig['allowedGroups'] = ["sysop","moderator"];</code>
	<hr>		<hr>
	This option will only allow users in the allowedGroups to edit a page that contains a FlexForm in its source. Making it for anonymous or others users not possible to change a FlexForm Form.		This option will only allow users in the allowedGroups to edit a page that contains a FlexForm in its source. Making it for anonymous or others users not possible to change a FlexForm Form. On top of that, the edit and edit source options in the top menu, if available, will not be shown. Actions like edit or vedit are also blocked.

	<code>$wgFlexFormConfig['hideEdit'] = true;</code>		<code>$wgFlexFormConfig['hideEdit'] = true;</code>

Charlot: User:Charlot

2023-01-04T20:12:24Z

User:Charlot

ws-base-props
← Older revision		Revision as of 22:12, 4 January 2023
Line 1:		Line 1:
	{{Base properties		{{Base properties
	\|Title=~~security~~		\|Title=Security
	\|Class=Doc		\|Class=Doc
	}}		}}

Charlot at 20:11, 4 January 2023

2023-01-04T20:11:08Z

← Older revision		Revision as of 22:11, 4 January 2023
Line 26:		Line 26:
	<code>$wgFlexFormConfig['userscaneditallpages'] = false;</code>		<code>$wgFlexFormConfig['userscaneditallpages'] = false;</code>
	<hr>		<hr>
	This option is very powerful and will only render approved or valid forms. Basically, any form created or ~~edit~~ by a user in the allowedGroups setting automatically validates a form.		This option is very powerful and will only render approved or valid forms. Basically, any form created or edited by a user in the allowedGroups setting, automatically validates a form.
	For more detailed information : [[DevOps:Doc/FlexForm/2.0/validated-forms\|Documentation on Validated forms]]		For more detailed information : [[DevOps:Doc/FlexForm/2.0/validated-forms\|Documentation on Validated forms]]

Charlot at 20:09, 4 January 2023

2023-01-04T20:09:43Z

← Older revision		Revision as of 22:09, 4 January 2023
Line 13:		Line 13:
	<code>$wgFlexFormConfig['can_create_user'] = false;</code>		<code>$wgFlexFormConfig['can_create_user'] = false;</code>
	<hr>		<hr>
	~~Then you can set~~ a group of users that can have special privileges using FlexForm. Here we set the sysop and moderators to have these privileges.		Set a group of users that can have special privileges using FlexForm. Here we set the sysop and moderators to have these privileges.

	<code>$wgFlexFormConfig['allowedGroups'] = ["sysop","moderator"];</code>		<code>$wgFlexFormConfig['allowedGroups'] = ["sysop","moderator"];</code>

Charlot at 20:09, 4 January 2023

2023-01-04T20:09:04Z

← Older revision		Revision as of 22:09, 4 January 2023
Line 6:		Line 6:

	This setting should be always be on. It will filter any user input. Create checksums for each form to detect tempering. Will renders Forms that make no sense when inspected by the Browsers Developer tools. And more.		This setting should be always be on. It will filter any user input. Create checksums for each form to detect tempering. Will renders Forms that make no sense when inspected by the Browsers Developer tools. And more.

	<code>$wgFlexFormConfig['secure'] = true;</code>		<code>$wgFlexFormConfig['secure'] = true;</code>
			<hr>
			By default the option to have FlexForm create users with a Form is turned off

	~~By default the option to have FlexForm create users with a Form is turned off~~
	<code>$wgFlexFormConfig['can_create_user'] = false;</code>		<code>$wgFlexFormConfig['can_create_user'] = false;</code>
			<hr>
			Then you can set a group of users that can have special privileges using FlexForm. Here we set the sysop and moderators to have these privileges.

	~~Then you can set a group of users that can have special privileges using FlexForm. Here we set the sysop and moderators to have these privileges.~~
	<code>$wgFlexFormConfig['allowedGroups'] = ["sysop","moderator"];</code>		<code>$wgFlexFormConfig['allowedGroups'] = ["sysop","moderator"];</code>
			<hr>
			This option will only allow users in the allowedGroups to edit a page that contains a FlexForm in its source. Making it for anonymous or others users not possible to change a FlexForm Form.

	~~This option will only allow users in the allowedGroups to edit a page that contains a FlexForm in its source. Making it for anonymous or others users not possible to change a FlexForm Form.~~
	<code>$wgFlexFormConfig['hideEdit'] = true;</code>		<code>$wgFlexFormConfig['hideEdit'] = true;</code>
			<hr>
	With the next option, FlexForm will check if the action it needs to do (create or edit a page) is allowed for the user filling in the Form. Example: You have a Form to edit a Template on your main page. The Form can be anywhere in the wiki. FlexForm will check on Form submit if the user is allowed to edit the main page first.		With the next option, FlexForm will check if the action it needs to do (create or edit a page) is allowed for the user filling in the Form. Example: You have a Form to edit a Template on your main page. The Form can be anywhere in the wiki. FlexForm will check on Form submit if the user is allowed to edit the main page first.
	When you set this option to true, then no such check will be done.		When you set this option to true, then no such check will be done.

	<code>$wgFlexFormConfig['userscaneditallpages'] = false;</code>		<code>$wgFlexFormConfig['userscaneditallpages'] = false;</code>
			<hr>
	This option is very powerful and will only render approved or valid forms. Basically, any form created or edit by a user in the allowedGroups setting automatically validates a form.		This option is very powerful and will only render approved or valid forms. Basically, any form created or edit by a user in the allowedGroups setting automatically validates a form.
	For more detailed information : [[DevOps:Doc/FlexForm/2.0/validated-forms\|Documentation on Validated forms]]		For more detailed information : [[DevOps:Doc/FlexForm/2.0/validated-forms\|Documentation on Validated forms]]

	<code>$wgFlexFormConfig['renderonlyapprovedforms'] = true;</code>		<code>$wgFlexFormConfig['renderonlyapprovedforms'] = true;</code>



	== Other options ==		== Other options ==

Charlot at 20:08, 4 January 2023

2023-01-04T20:08:04Z

← Older revision	Revision as of 22:08, 4 January 2023
Line 1:	Line 1:
		FlexForm is a very powerful tool. It can create new pages or edit existing ones. It can create new users, send emails and much more. With this much power comes responsibility.

		Luckily FlexForm has a lot of security features build-in.

		== LocalSetting configuration ==

		This setting should be always be on. It will filter any user input. Create checksums for each form to detect tempering. Will renders Forms that make no sense when inspected by the Browsers Developer tools. And more.
		<code>$wgFlexFormConfig['secure'] = true;</code>

		By default the option to have FlexForm create users with a Form is turned off
		<code>$wgFlexFormConfig['can_create_user'] = false;</code>

		Then you can set a group of users that can have special privileges using FlexForm. Here we set the sysop and moderators to have these privileges.
		<code>$wgFlexFormConfig['allowedGroups'] = ["sysop","moderator"];</code>

		This option will only allow users in the allowedGroups to edit a page that contains a FlexForm in its source. Making it for anonymous or others users not possible to change a FlexForm Form.
		<code>$wgFlexFormConfig['hideEdit'] = true;</code>

		With the next option, FlexForm will check if the action it needs to do (create or edit a page) is allowed for the user filling in the Form. Example: You have a Form to edit a Template on your main page. The Form can be anywhere in the wiki. FlexForm will check on Form submit if the user is allowed to edit the main page first.
		When you set this option to true, then no such check will be done.
		<code>$wgFlexFormConfig['userscaneditallpages'] = false;</code>

		This option is very powerful and will only render approved or valid forms. Basically, any form created or edit by a user in the allowedGroups setting automatically validates a form.
		For more detailed information : [[DevOps:Doc/FlexForm/2.0/validated-forms\|Documentation on Validated forms]]
		<code>$wgFlexFormConfig['renderonlyapprovedforms'] = true;</code>



		== Other options ==
		By default, a FlexForm form is never rendered for an anonymous user. You can change this by adding a restrictions="lifted" to a Form tag. This can be useful for e.g. a contact form or questionnaire.

		When creating a user input in a Form, FlexForm will by default always filter the input for html, JavaScript or malicious code. You can however specify per input what is allowed and what is not. More information here : [[DevOps:Doc/FlexForm/2.0/input\|Default input HTML attribute]]

		Especially when you have a "closed" wiki, where people need to register and will get their rights through user groups, it is a good option just not to show a Form to someone from a user group that is not allowed to use it.