* using htmlspecialchars() for safe XHTML output

[lhc/web/wiklou.git] / includes / DefaultSettings.php

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index ab262c0..347940b 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -121,6 +121,32 @@ $wgTmpDirectory     = "{$wgUploadDirectory}/tmp";
 $wgUploadBaseUrl    = "";
 /**#@-*/
 
+/**
+ * Allowed title characters -- regex character class
+ * Don't change this unless you know what you're doing
+ *
+ * Problematic punctuation:
+ *  []{}|#    Are needed for link syntax, never enable these
+ *  %         Enabled by default, minor problems with path to query rewrite rules, see below
+ *  +         Doesn't work with path to query rewrite rules, corrupted by apache
+ *  ?         Enabled by default, but doesn't work with path to PATH_INFO rewrites
+ *
+ * All three of these punctuation problems can be avoided by using an alias, instead of a 
+ * rewrite rule of either variety.
+ *
+ * The problem with % is that when using a path to query rewrite rule, URLs are 
+ * double-unescaped: once by Apache's path conversion code, and again by PHP. So 
+ * %253F, for example, becomes "?". Our code does not double-escape to compensate 
+ * for this, indeed double escaping would break if the double-escaped title was 
+ * passed in the query string rather than the path. This is a minor security issue 
+ * because articles can be created such that they are hard to view or edit.
+ *
+ * Theoretically 0x80-0x9F of ISO 8859-1 should be disallowed, but
+ * this breaks interlanguage links
+ */
+$wgLegalTitleChars = " %!\"$&'()*,\\-.\\/0-9:;=?@A-Z\\\\^_`a-z~\\x80-\\xFF";
+
+
 /**
  * The external URL protocols (regexp)
  */
@@ -447,8 +473,9 @@ $wgDBClusterTimeout = 10;
 $wgDBminWordLen     = 4;
 /** Set to true if using InnoDB tables */
 $wgDBtransactions      = false;
-/** Set to true to use enhanced fulltext search */
-$wgDBmysql4                    = false;
+/** Set to true for compatibility with extensions that might be checking.
+ * MySQL 3.23.x is no longer supported. */
+$wgDBmysql4                    = true;
 
 /**
  * Other wikis on this site, can be administered from a single developer
@@ -709,6 +736,8 @@ $wgGroupPermissions['user' ]['move']            = true;
 $wgGroupPermissions['user' ]['read']            = true;
 $wgGroupPermissions['user' ]['edit']            = true;
 $wgGroupPermissions['user' ]['upload']          = true;
+$wgGroupPermissions['user' ]['reupload']        = true;
+$wgGroupPermissions['user' ]['reupload-shared'] = true;
 
 $wgGroupPermissions['bot'  ]['bot']             = true;
 
@@ -723,6 +752,8 @@ $wgGroupPermissions['sysop']['patrol']          = true;
 $wgGroupPermissions['sysop']['protect']         = true;
 $wgGroupPermissions['sysop']['rollback']        = true;
 $wgGroupPermissions['sysop']['upload']          = true;
+$wgGroupPermissions['sysop']['reupload']        = true;
+$wgGroupPermissions['sysop']['reupload-shared'] = true;
 
 $wgGroupPermissions['bureaucrat']['userrights'] = true;
 // Used by the Special:Renameuser extension
@@ -1086,11 +1117,14 @@ $wgSVGConverters = array(
        'sodipodi' => '$path/sodipodi -z -w $width -f $input -e $output',
        'inkscape' => '$path/inkscape -z -w $width -f $input -e $output',
        'batik' => 'java -Djava.awt.headless=true -jar $path/batik-rasterizer.jar -w $width -d $output $input',
+       'rsvg' => '$path/rsvg -w$width -h$height $input $output',
        );
 /** Pick one of the above */
 $wgSVGConverter = 'ImageMagick';
 /** If not in the executable PATH, specify */
 $wgSVGConverterPath = '';
+/** Don't scale a SVG larger than this unless its native size is larger */
+$wgSVGMaxSize = 1024;
 
 /** Set $wgCommandLineMode if it's not set already, to avoid notices */
 if( !isset( $wgCommandLineMode ) ) {
@@ -1386,6 +1420,9 @@ $wgBrowserBlackList = array(
  * Fake out the timezone that the server thinks it's in. This will be used for
  * date display and not for what's stored in the DB. Leave to null to retain
  * your server's OS-based timezone value. This is the same as the timezone.
+ *
+ * This variable is currently used ONLY for signature formatting, not for
+ * anything else.
  */
 # $wgLocaltimezone = 'GMT';
 # $wgLocaltimezone = 'PST8PDT';
@@ -1393,6 +1430,27 @@ $wgBrowserBlackList = array(
 # $wgLocaltimezone = 'CET';
 $wgLocaltimezone = null;
 
+/**
+ * Set an offset from UTC in hours to use for the default timezone setting
+ * for anonymous users and new user accounts.
+ *
+ * This setting is used for most date/time displays in the software, and is
+ * overrideable in user preferences. It is *not* used for signature timestamps.
+ *
+ * You can set it to match the configured server timezone like this:
+ *   $wgLocalTZoffset = date("Z") / 3600;
+ *
+ * If your server is not configured for the timezone you want, you can set
+ * this in conjunction with the signature timezone and override the TZ
+ * environment variable like so:
+ *   $wgLocaltimezone="Europe/Berlin";
+ *   putenv("TZ=$wgLocaltimezone");
+ *   $wgLocalTZoffset = date("Z") / 3600;
+ *
+ * Leave at NULL to show times in universal time (UTC/GMT).
+ */
+$wgLocalTZoffset = null;
+
 
 /**
  * When translating messages with wfMsg(), it is not always clear what should be
@@ -1615,4 +1673,10 @@ $wgEnableScaryTranscluding = false;
  */
 $wgUseTrackbacks = false;
 
+/**
+ * Enable filtering of robots in Special:Watchlist
+ */
+
+$wgFilterRobotsWL = false;
+
 ?>