Score

Option Description Default Score Score is a game to motivate participants to increase their contribution by comparing to other users. Disabled Score expiry 0 days

Search - Federated search

Option Description Default Federated search Search through alternate site indices. Elasticsearch or Manticore Search is required Disabled Elasticsearch tribe node URL URL of the tribe client node accessing multiple clusters. None Manticore distributed index prefix The prefix used when creating distributed index in Manticore. This needs to be the same for all sites participating in the federation. Tiki_

Search - General settings

Option Description Default Unified search index Enables searching for content at the site using a Tiki-managed index. It's recommended to set a cron job to periodically rebuild the search index. Enabled Search statistics Enables administrators to collect and view statistics on search activity. Disabled Users available in search results Users available within search results. Content related to the user will be included in the index. None | All | Public None Incremental Index Update Update the index incrementally as the site content is modified. This may lead to lower performance and accuracy than processing the index on a periodic basis. Enabled Search index rebuild memory limit Temporarily adjust the memory limit to use during Search index rebuild. Depending on the volume of data, some large operations require more memory. Increasing it locally, per operation, allows to keep a lower memory limit globally. Keep in mind that memory usage is still limited to what is available on the server. for example: 256M None Search index rebuild time limit Temporarily adjust the time limit to use during Search index rebuild. Depending on the volume of data, some requests may take longer. Increase the time limit locally to resolve the issue. Use reasonable values. for example: 30 None Unified search engine Search engine used to index the content of this Tiki site. Some engines are more suitable for larger sites, but require additional software on the server. MySQL full-text search | Elasticsearch | Manticore Search MySQL full-text search Elasticsearch URL URL of any node in the cluster http://localhost:9200 Elasticsearch Authentication When Elasticsearch security module is enabled, user authentication can be set up here. No Authentication | Basic Authentication None Elasticsearch User HTTP basic authentication user to be sent with each request to Elasticsearch. None Elasticsearch Password HTTP basic authentication password to be sent with each request to Elasticsearch. None Elasticsearch index prefix The prefix that is used for all indexes for this installation in Elasticsearch Tiki_ Elasticsearch current index A new index is created upon rebuilding, and the old one is then destroyed. This setting enables seeing the currently active index. Do not change this value unless you know what you are doing. None Elasticsearch field limit per index The maximum number of fields per search index in Elasticsearch version 5.x and above 1000 fields Relation types to index within object. Comma-separated relation types for which objects should be indexed in their related objects. Elasticsearch needed None Use MySQL Full-Text Search (fallback) In case of Elasticsearch is active and unavailable, use MySQL Full-Text Search as fallback Disabled Index max result window for ElasticSearch This allows a larger amount of data to be recorded. None MySQL full-text search current index A new index is created upon rebuilding, and the old one is then destroyed. This setting enables seeing the currently active index. Do not change this value unless you know what you are doing. None MySQL use short field names Due to frm file constraints, number of search fields that one index can hold is usually limited to about 1500. This can be exceeded if you have numerous tracker fields. Enabling this option will try to shorten the field names internally that should allow you to use 300-500 more fields. Switching this option requires full index rebuild. Disabled Restore old MySQL indexes during reindex If set, after the reindex is performed, old table MySQL indexes will be restored to the reindex related table. Disabled Manticore URL URL of the Manticore search server http://127.0.0.1 Manticore HTTP(S) Port Port number for the HTTP(S) interface. 9308 Manticore MySQL Port Port number for the MySQL interface. 9306 Manticore index prefix The prefix that is used for all indexes for this installation in Manticore Tiki_ Manticore current index A new set of indexes are created upon rebuilding, and the old ones are then destroyed. This setting enables seeing the currently active index prefix. Do not change this value unless you know what you are doing. None Morphology processing Advanced morphology preprocessors to apply in the Manticore index, comma-separated. For example libstemmer_en,libstemmer_fr. See Manticore manual for possible values. None Manticore indexed full-text fields Manticore has a hard-limit of 256 full-text indexed fields per index. If your installation has more, some will be indexed as string attributes and perform the slower regex search. You can add a comma-separated list of fields to always index as full-text here. title,contents Check for unused indexes Check for unused indexes and remove them to free up space and maintain optimal search performance. Disabled Default Boolean Operator Use OR or AND as the default search operator. AND | OR AND Excluded categories List of category IDs to exclude from the search index None Excluded plugins List of plugin names to exclude while indexing None Additional plugins searchable by default List of plugin names that are required to additionnaly include while indexing. Example: fancytable,list,trackerlist,trackerfilter attach, box, code, copyrigh... Don't index non searchable fields Indexing will skip adding all tracker fields that are not marked as "searchable". This will free index space but also make it impossible to use those fields in search index queries. Disabled Index forum replies together with initial post Forum replies will be indexed together with the initial post as a single document instead of being indexed separately. Enabled Tokenize version numbers Tokenize version number strings so that major versions are found when sub-versions are mentioned. For example, searching for 2.7 would return documents containing 2.7.4, but not 1.2.7. Disabled Tokenize CamelCase words Consider the components of camel-case words as separate tokens, allowing them to be searched individually. Conflicts with Tokenize Version Numbers. Disabled Possessive Stemmer The possessive stemmer removes possessives (trailing "'s") from words before indexing them. Enabled Field weights Allow the field weights to be set that apply when ranking pages in the search results. The weight is applied only when the field is in the query. To nullify the value of a field, use an insignificant amount, but not 0, which may lead to unexpected behaviors such as stripping of results. (Add these fields to the "Default content fields" preference below for it to have an effect in a global "content" search) One field per line, field_name:5.3 title:2.5 allowed_groups:0.... Default content fields All of the content is aggregated in the contents field. For custom weighting to apply, the fields must be included in the query. This option allows other fields to be included in the default content search. contents, title Cache per user and query for Tiki built-in search Time in minutes a user has a same query cached applied to Tiki built-in search interface only. 0 minutes Cache result-specific formatted results Formatted search results such as the ones used in the List plugin will be cached to prevent process-intensive reformatting on each page load. The cache is result-specific. Every different result will generate a separate cache. This could quickly build up a large cache directory. It is recommended to clear Tiki caches often (e.g. once per week) via an automated job if you use this feature. Disabled Cache relation field formatted values Relation field formats related objects by searching existing index on each record rebuild. This might be very slow if you have relation fields on many tracker items. Enable this option to pre-cache all possible relation formatted values at indexing time. This could potentially use a lot of memory (if you have relations on big trackers) or be less efficient (if you have little density of populated relation fields). Disabled Cache individual search formatters List of search formatters whose output will be cached. This is separate to the result-specific formatted results cache. None LIST plugin cache default on If selected, LIST plugins will be cached by default unless turned off at plugin level. Disabled LIST plugin cache default expiry Default number of minutes for LIST plugin cache expiry. 30 Index Tracker Category names Index the names and paths of category field values Requires reindexing Enabled Use unified search in category admin Use unified search to find objects to add to categories. This limits the types of objects available to those included in the unified index. Disabled Automatically trim Elasticsearch results on date-sorted query Automatically trim Elasticsearch results in unified search if the query is sorted by modification or creation date. Disabled Show error on missing field When using List plugin to specify certain fields, especially tracker fields, this check helps ensure their names were entered correctly. Enabled Stop Word List Words excluded from the search index, because they can be too frequent and produce unwanted results. This list is applied to the selected search engine. Note for MySQL: It completely replaces the native InnoDB stopword list. If left empty, will disable stopword filtering. a, an, and, are, as, at, be... Search index outdated Number of days to consider the search index outdated 2 days Automatic indexing of file content Uses command line tools to extract the information from the files based on their MIME types. Disabled Automatic indexing of emails stored as files Parses message/rfc822 types of files (aka eml files) and stores individual email headers and content in search index. Disabled Asynchronous indexing Enabled Autocomplete page names Automatically complete page names as the user starts typing. For example the user types the start of the wiki page name “Sear” and Tiki returns “Search”, “Search General Settings”, etc Disabled Referer search highlighting When a user lands on a Tiki page from a search engine, Tiki highlights the search words they used. Its similar to using Tiki’s search facility. Enabled File thumbnail preview Have a preview of attachments in search results Disabled Forum name search When listing forums Disabled Forum content search When listing forums Enabled Topic content search Enabled Unified search for forums and file galleries Enabled

Search - Stored search

Option Description Default Stored searches Allow users to store search queries. Disabled

Security - General security

Option Description Default Smarty security Enable/Disable Smarty security. If checked, you can then define allowed and disabled modifiers and tags(functions, blocks and filters) that should be or not accesible to the template. You should leave this on unless you know what you are doing. Enabled Allowed Smarty tags This is a list of allowed tags. It's the list of (registered / autoloaded) function-, block and filter plugins that should be accessible to the template. If empty, no restriction by allowed_tags. This may be needed for custom templates. Use "," to separate values There may be security implications. Make sure you know what you are doing. None Disabled Smarty tags This is a list of disabled tags. It's the list of (registered / autoloaded) function-, block and filter plugins that may not be accessible to the template. If empty, no restriction by disabled_tags. This may be needed for custom templates. Use "," to separate values There may be security implications. Make sure you know what you are doing. None Allowed Smarty modifiers This is the list of allowed modifier plugins. It's the array of (registered / autoloaded) modifiers that should be accessible to the template. If this array is non-empty, only the herein listed modifiers may be used. This is a whitelist. If empty, no restriction by allowed_modifiers. This may be needed for custom templates. Use "," to separate values There may be security implications. Make sure you know what you are doing. None Disabled Smarty modifiers This is a list of disabled modifier plugins. It's the list of (registered / autoloaded) modifiers that may not be accessible to the template. If empty, no restriction by disabled_modifiers. This may be needed for custom templates. Use "," to separate values There may be security implications. Make sure you know what you are doing. None Allowed Smarty built-in PHP functions This is the list of allowed built-in PHP functions to be used as smarty modifiers. Smarty 5+ disabled the use of PHP functions as smarty modifiers. Use this preference to allow specific built-in functions not available in the currently exposed modifiers list that you need to use in your templates. Use "," to separate values There may be security implications. Make sure you know what you are doing. Try to keep this list as short as possible. None Extra Smarty directories Make additional directories available as Smarty directories. This may be needed for custom icons (clear temp/cache after changing). There may be security implications. Make sure you know what you are doing. None HTML purifier HTML Purifier is a standards-compliant HTML filter library written in PHP and integrated in Tiki. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also ensure that your documents are standards-compliant. Keep in mind that HTML Purifier is not HTML5 compatible and may rewrite HTML5 syntax and produce unwanted results. If you use HTML in your wiki page and it gets stripped out or rewritten, make sure your HTML is valid, or de-activate this feature. Keep in mind that HTML Purifier is not HTML5 compatible and may rewrite HTML5 syntax and produce unwanted results. Enabled Output should be HTML purified This activates HTML Purifier on wiki content and other outputs, to filter out potential security problems like XSS code. Keep in mind that HTML Purifier is not HTML5 compatible and may rewrite HTML5 syntax, producing unwanted results. If you are trying to use HTML in your pages and it gets stripped out, you should make sure your HTML is valid or de-activate this feature. Disabled Protect all sessions with HTTPS Always redirect to HTTPS to prevent a session hijack through network sniffing. Warning: activate only if SSL is already configured; otherwise, all users including admin will be locked out of the site Disabled HTTP Basic Authentication Check credentials from HTTP Basic Authentication, which is useful to allow webservices to use credentials. Disable | SSL Only (Recommended) | Always Disable Prevent common passwords For improved security, prevent users from creating blacklisted passwords. Use default blacklist or create custom blacklists through Control Panel -> Log in -> Password Blacklist. Disabled Require admin users to enter their password for some critical actions User password will be required for critical operations that can compromise the system security or stability, like adding users to the admin group Enabled Allow sending newsletters through external clients Generate mailto links using the recipients as the BCC list. This will expose the list if email addresses to all users allowed to send newsletters. Disabled Validate uploaded file content Do not trust user input and open the files to verify their content. Enabled Allow the tiki_p_trust_input permission. Bypass user input filtering. Note: all permissions are granted to the Admins group including this one, so if you enable this you may expose your site to XSS (Cross Site Scripting) attacks for admin users. Disabled Quick permission assignment Quickperms are an interface in addition to the normal edit-permissions page, for quick assignment of permissions for a page or other object. Enabled Verify HTTPS certificates of remote servers When set to enforce, the server will fail to connect over HTTPS to a remote server that do not have a SSL certificate that is valid and can be verified against the local list of Certificate Authority (CA) Do not enforce verification | Enforce verification None Use CURL for HTTP connections Use CURL instead of sockets for server to server HTTP connections, when sockets are not available. Disabled Debugger console A popup console with a list of all PHP and Smarty variables used to render the current webpage. It can be viewed by clicking 'Quick Administration->Smarty debug window' or by appending ?show_smarty_debug=1 or &show_smarty_debug=1 to the page URL. You may also execute SQL, watch vars and perform a number of other functions. Only viewable by admins Not suitable for production use. Disabled SSRF whitelisted hosts Comma-separated list of hostnames that are allowed to be fetched server-side even if they resolve to private or reserved IP addresses. Leave empty to disallow all private ranges. None All new trackers are restricted to wiki page access only by default Option "Restrict non admins to wiki page access only" is not checked by default. Disabled User encryption Tiki user encryption enables a personal, secure storage of sensitive data, e.g. password. Only the user can see the data. No decryption passwords are stored. Enable personal, secure storage of sensitive data such as passwords This is an experimental feature. Using it may cause loss of the encrypted data. Disabled Password domains Securely store extra user passwords and other user specific data for other "domains", or just for yourself Userkey Use short lived CSRF tokens CSRF tokens generated will be valid for one use only and will have a limited life span Changing the CSRF tokens to be short lived may lead to an increase of errors on submitting information when the users take a long time to finish an operation or the session is lost. Disabled Security timeout Sets the expiration of CSRF tickets and related forms. The session_lifetime preference is used for the default, if set, otherwise the session.gc_maxlifetime php.ini setting is used, subject to a default maximum of four hours in any case. Minimum value is 30 seconds to avoid blocking everyone from being able to make any changes, including to this setting 14400 seconds Require confirmation of an action if a possible CSRF is detected Disabled HTTP header x-frame options The x-frame-options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a ,