General Security tab
Related Topics
- Overview
- Use this tab to configure the general, site-wide security settings.
- To Access
- From the Security Admin page, click the General Security tab.
| Option | Description | Default |
|---|---|---|
| Smarty security | Enable/Disable Smarty security. If checked, you can then define allowed and disabled modifiers and tags(functions, blocks and filters) that should be or not accesible to the template. You should leave this on unless you know what you are doing. |
Enabled |
| Allowed Smarty tags | This is a list of allowed tags. It's the list of (registered / autoloaded) function-, block and filter plugins that should be accessible to the template. If empty, no restriction by allowed_tags. This may be needed for custom templates. Use "," to separate values There may be security implications. Make sure you know what you are doing. |
None |
| Disabled Smarty tags | This is a list of disabled tags. It's the list of (registered / autoloaded) function-, block and filter plugins that may not be accessible to the template. If empty, no restriction by disabled_tags. This may be needed for custom templates. Use "," to separate values There may be security implications. Make sure you know what you are doing. |
None |
| Allowed Smarty modifiers | This is the list of allowed modifier plugins. It's the array of (registered / autoloaded) modifiers that should be accessible to the template. If this array is non-empty, only the herein listed modifiers may be used. This is a whitelist. If empty, no restriction by allowed_modifiers. This may be needed for custom templates. Use "," to separate values There may be security implications. Make sure you know what you are doing. |
None |
| Disabled Smarty modifiers | This is a list of disabled modifier plugins. It's the list of (registered / autoloaded) modifiers that may not be accessible to the template. If empty, no restriction by disabled_modifiers. This may be needed for custom templates. Use "," to separate values There may be security implications. Make sure you know what you are doing. |
None |
| Allowed Smarty built-in PHP functions | This is the list of allowed built-in PHP functions to be used as smarty modifiers. Smarty 5+ disabled the use of PHP functions as smarty modifiers. Use this preference to allow specific built-in functions not available in the currently exposed modifiers list that you need to use in your templates. Use "," to separate values There may be security implications. Make sure you know what you are doing. Try to keep this list as short as possible. |
None |
| Extra Smarty directories | Make additional directories available as Smarty directories. This may be needed for custom icons (clear temp/cache after changing). There may be security implications. Make sure you know what you are doing. |
None |
| HTML purifier | HTML Purifier is a standards-compliant HTML filter library written in PHP and integrated in Tiki. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also ensure that your documents are standards-compliant. Keep in mind that HTML Purifier is not HTML5 compatible and may rewrite HTML5 syntax and produce unwanted results. If you use HTML in your wiki page and it gets stripped out or rewritten, make sure your HTML is valid, or de-activate this feature. Keep in mind that HTML Purifier is not HTML5 compatible and may rewrite HTML5 syntax and produce unwanted results. |
Enabled |
| Output should be HTML purified | This activates HTML Purifier on wiki content and other outputs, to filter out potential security problems like XSS code. Keep in mind that HTML Purifier is not HTML5 compatible and may rewrite HTML5 syntax, producing unwanted results. If you are trying to use HTML in your pages and it gets stripped out, you should make sure your HTML is valid or de-activate this feature. |
Disabled |
| Protect all sessions with HTTPS | Always redirect to HTTPS to prevent a session hijack through network sniffing. Warning: activate only if SSL is already configured; otherwise, all users including admin will be locked out of the site |
Disabled |
| HTTP Basic Authentication | Check credentials from HTTP Basic Authentication, which is useful to allow webservices to use credentials. Disable | SSL Only (Recommended) | Always |
Disable |
| Prevent common passwords | For improved security, prevent users from creating blacklisted passwords. Use default blacklist or create custom blacklists through Control Panel -> Log in -> Password Blacklist. | Disabled |
| Require admin users to enter their password for some critical actions | User password will be required for critical operations that can compromise the system security or stability, like adding users to the admin group | Enabled |
| Allow sending newsletters through external clients | Generate mailto links using the recipients as the BCC list. This will expose the list if email addresses to all users allowed to send newsletters. |
Disabled |
| Validate uploaded file content | Do not trust user input and open the files to verify their content. | Enabled |
| Allow the tiki_p_trust_input permission. | Bypass user input filtering. Note: all permissions are granted to the Admins group including this one, so if you enable this you may expose your site to XSS (Cross Site Scripting) attacks for admin users. |
Disabled |
| Quick permission assignment | Quickperms are an interface in addition to the normal edit-permissions page, for quick assignment of permissions for a page or other object. | Enabled |
| Verify HTTPS certificates of remote servers | When set to enforce, the server will fail to connect over HTTPS to a remote server that do not have a SSL certificate that is valid and can be verified against the local list of Certificate Authority (CA) Do not enforce verification | Enforce verification |
None |
| Use CURL for HTTP connections | Use CURL instead of sockets for server to server HTTP connections, when sockets are not available. | Disabled |
| Debugger console | A popup console with a list of all PHP and Smarty variables used to render the current webpage. It can be viewed by clicking 'Quick Administration->Smarty debug window' or by appending ?show_smarty_debug=1 or &show_smarty_debug=1 to the page URL. You may also execute SQL, watch vars and perform a number of other functions. Only viewable by admins Not suitable for production use. |
Disabled |
| SSRF whitelisted hosts | Comma-separated list of hostnames that are allowed to be fetched server-side even if they resolve to private or reserved IP addresses. Leave empty to disallow all private ranges. | None |
| All new trackers are restricted to wiki page access only by default | Option "Restrict non admins to wiki page access only" is not checked by default. | Disabled |
| User encryption | Tiki user encryption enables a personal, secure storage of sensitive data, e.g. password. Only the user can see the data. No decryption passwords are stored. Enable personal, secure storage of sensitive data such as passwords This is an experimental feature. Using it may cause loss of the encrypted data. |
Disabled |
| Password domains | Securely store extra user passwords and other user specific data for other "domains", or just for yourself | Userkey |
| Use short lived CSRF tokens | CSRF tokens generated will be valid for one use only and will have a limited life span Changing the CSRF tokens to be short lived may lead to an increase of errors on submitting information when the users take a long time to finish an operation or the session is lost. |
Disabled |
| Security timeout | Sets the expiration of CSRF tickets and related forms. The session_lifetime preference is used for the default, if set, otherwise the session.gc_maxlifetime php.ini setting is used, subject to a default maximum of four hours in any case.Minimum value is 30 seconds to avoid blocking everyone from being able to make any changes, including to this setting |
14400 seconds |
| Require confirmation of an action if a possible CSRF is detected | Disabled | |
| HTTP header x-frame options | The x-frame-options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object> | Enabled |
| Header value | DENY | SAMEORIGIN | DENY |
| HTTP header x-xss-protection | The x-xss-protection header is designed to enable the cross-site scripting (XSS) filter built into modern web browsers | Enabled |
| Header value | 0 | 1 | 1;mode=block | 1;mode=block |
| HTTP header x-content-type-options | The x-content-type-options header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. | Enabled |
| HTTP header allow credentials | The Access-Control-Allow-Credentials response header tells browsers whether the server allows cross-origin HTTP requests to include credentials. | Disabled |
| HTTP header access-control-allow-methods | Enables or disables the sending of the Access-Control-Allow-Methods header in HTTP responses from your Tiki site. This header is crucial for Cross-Origin Resource Sharing (CORS) and specifies the HTTP methods that are allowed when accessing resources in response to a preflight request. | Disabled |
| Header value | Specifies the HTTP methods that are allowed for cross-origin requests. This setting takes effect only if the HTTP header access-control-allow-methods is enabled. Separate multiple methods with commas. For example, to allow GET, POST, and PUT methods, set this value to GET, POST, PUT |
None |
| HTTP header access-control-allow-headers | Enables or disables the sending of the Access-Control-Allow-Headers header in HTTP responses from your Tiki site. This header is crucial for Cross-Origin Resource Sharing (CORS) and specifies the headers that are allowed when making actual requests (after the preflight has been accepted). | Disabled |
| Header value | Specifies the HTTP headers that can be used when making the actual request. This setting takes effect only if the HTTP header access-control-allow-headers is enabled. Separate multiple header names with commas. For example, to allow headers such as Content-Type, Accept, and X-Requested-With, set this value to Content-Type, Accept, X-Requested-With |
None |
| HTTP header cross-origin-embedder-policy | Controls the loading of cross-origin resources in a document. Setting this header helps enhance security by ensuring that loaded resources explicitly grant permission to be loaded. | Disabled |
| Header value | Specifies the policy for loading cross-origin resources. "Require-CORP" requires cross-origin resources to have CORP headers. "Credentialless" allows loading cross-origin resources without credentials. "Unsafe-none" applies no restrictions. None | Require-CORP | Credentialless |
None |
| HTTP header Cross-Origin-Resource-Policy | Defines which cross-origin requests are allowed to access resources on your site. This header can help prevent other sites from reading or loading your site's resources without permission. | Disabled |
| Header value | Determines which origins are allowed to access resources. "Same-Origin" only allows your own site to access resources. "Same-Site" extends this to your entire site, including subdomains. "Cross-Origin" allows any site to access the resources. Same-Origin: Only same-origin requests are allowed. | Same-Site: Only requests from the same site are allowed. | Cross-Origin: Allows requests from any origin. |
Same-Site: Only requests fr... |
| HTTP header Cross-Origin-Opener-Policy | Enables or disables the sending of the Cross-Origin-Opener-Policy header in HTTP responses from your site. This header controls how the document may interact with other browsing contexts. | Disabled |
| Header value | Specifies the policy for cross-origin opener policy header. Same-Origin: Allows the document to be opened only by pages from the same origin. | Same-Origin-Allow-Popups: Allows the document to be opened by pages from the same origin, and allows those pages to open popups. | Same-Origin-Plus-COEP: Allows the document to be opened only by pages from the same origin, and sets the Cross-Origin-Embedder-Policy header to `require-corp`. | None: No specific po... |
Same-Origin-Allow-Popups: A... |
| HTTP header content-security-policy | The Content-Security-Policy header allows web site administrators to control resources the user agent is allowed to load for a given page. | Enabled |
| Header value | For example, to allow your Tiki to appear in an iframe on example.com set this value to frame-ancestors https://example.com/ |
None |
| HTTP header strict-transport-security | The Strict-Transport-Security header (often abbreviated as HSTS) is a security feature that lets a web site tell browsers that it should only be communicated with using HTTPS, instead of using HTTP. | Enabled |
| Header value | Add includeSubDomains only if every subdomain is served over HTTPS. Add preload only after careful review at hstspreload.org. | max-age=63072000 |
| HTTP header public-key-pins | The public-key-pins header associates a specific cryptographic public key with a certain web server to decrease the risk of MITM attacks with forged certificates. If one or several keys are pinned and none of them are used by the server, the browser will not accept the response as legitimate, and will not display it. | Disabled |
| Header value | None | |
| HTTP header Referrer-Policy | The Referrer-Policy HTTP header controls how much referrer information (sent via the Referer header) should be included with requests. | Enabled |
| Header value | Specifies the referrer policy. "strict-origin-when-cross-origin" is the recommended safe default. no-referrer: Never send the Referer header. | no-referrer-when-downgrade: Send full URL for same-origin, omit on downgrade. | origin: Send only the origin. | origin-when-cross-origin: Full URL for same-origin, origin only for cross-origin. | same-origin: Send referrer only to same-origin requests. | strict-origin: Send origin only when protocol security is maintained. | strict-origin-when-cross... |
strict-origin-when-cross-or... |
| HTTP header X-Permitted-Cross-Domain-Policies | The X-Permitted-Cross-Domain-Policies header controls how Adobe products (Flash, Acrobat) and Silverlight may access cross-domain data. | Enabled |
| Header value | none: No cross-domain policies allowed. (Recommended) | master-only: Only the master policy file is allowed. | by-content-type: Only policy files served with Content-Type: text/x-cross-domain-policy are allowed. | all: All policy files are allowed. | none: No cross-domain polic... |
| Warn when .htaccess diverges | Alert admins if the active .htaccess differs from the bundled _htaccess. | Enabled |