Re: [Phpwiki-talk] new wikinames and javascript vulnerability

[Arno H. <aho...@in...>]

You wrote:

 > Yes, the list can be configured so hitting "reply" sends to the list
 > instead of the author, but the Sourceforge documentation strongly
 > recommends against this (they don't say why though). I'm used to this with
 > other lists I'm on so I assumed it was for a good reason.

I assume it's because most lists in open source projects are set up
this way. But this is a small project & a small list so we can make
our own rules, no? Anyway, I think I can get used to this setting too.
This is not a big issue.


 > Anyway, I was thinking how to solve this; and it hits the deeper issue of,
 > "What is the best linking scheme?" It's one that best serves the users, of
 > course.

I take it as read that my "latest updates" email didn't reach you
before you wrote this. Seems the mailing list had some delay yesterday.

 > One thing I don't like about it is having to use url-encoded page names:
 > http://www.somewiki.com/wiki/index.php3?this%20is%20a%20page%20name
 > It's ugly and unreadable.

I guess this plus reasons of database design made the tcl'er wiki
replace the name by a number. It's readable, but not easy to memorize.
All in all I don't like this fancy linking stuff at all. I think wiki
benefits from the simple names. If I want to link to a page, I can
make educated guesses. It's easier to link to old style names - I mean 
what are the chances that I remember
[In the beginning - first stop for someone new to Tcl and Tk]
if not coming directly from that page?

I can see some shortcomings in the old-style convention, this why I
added the following patch to a private version of phpwiki:
	- allow digits instead of lowercase letters too (not uppercase!)
	  e.g. My2Cents, E13375P34k (eleetspeak ;o)
	- plus a version similar too '[]' I used '__' to mark it:
	  has to start with uppercase letter, afterwards any combination
	  of A-Za-z0-9 is allowed, e.g. __Singleword__, __FAQ__

I assume that the later extension gets rid of almost all cases where
the simple wikinames don't seem enough. Yet it is restrictive enough
to avoid chaos. What do you think about this scheme?

 > I also have reservations about allowing named URL's (i.e. 
 > [some link name| http://www.foo.com/] ) because Wiki pages and external
 > pages look the same... I like the fact that they are clearly
 > distinguished under the old linking scheme.

Naming might be ok. If we keep it then it should be possible to
name internal pages as well. Distinguishing between internal/external
links could be done by color or using some kind of emphasis suitable
for the current wiki theme.


 > Anyways, I think a simple approach is to write out all the kinds of links
 > we want to allow and then only allow those that fit the pattern.

I already have done something like this. Try to create a bad URL or
see the EditLinks page in the latest CVS version.


 > > While poking around I discovered that the $magic_quotes_gpc=1 bug
 > > seems to be back (this time for page names)
 >
 > That's odd. Maybe Sourceforge has it enabled? Or is the bug on your local
 > machine?

I don't know about sourceforge. I use my own machine. And here magic quotes
are on. The problem is not odd at all. Under the old scheme there were 
only letters in the pagename. Now everything can be in the name
including _\'"_ and these characters get quoted.


Btw, how about a better theming possibility of phpwiki?
I changed the layout of phpwiki (see gtl.jeudego.org/wiki/),
but it's not easy to do at all.
Introducing an HTML template possibility should be easy to do.
About three templates are needed: regular browsing,
search results, editing. (Well editing is actually three files:
edit text, edit links, and save ok.)

Another change I would like to see included before 1.2 is released
are that references (backlinks) get their own database. Plus some nice 
features that take advantage of this concept.

I still think that EditLinks is awkward. Just had a look at tcl'ers:
[http://....] produces [1] - nice.
Inline images can be done the same way, e.g.
[http://host.com/inline_me.png] vs. http://host.com/dont_inline.png

The only drawback I can see is that one can't reuse the link,
i.e. using [1] more than once in the page. Shouldn't be a big problem -
I have never seen a page that reused links.

/Arno