Setting up a Demo Site - Revision history

Dirk: note about OAuth

2011-06-18T16:55:44Z

note about OAuth

Dirk: Links to "discussion" on geeklog-devel

2010-01-06T08:48:17Z

Links to "discussion" on geeklog-devel

Dirk: link to feature request

2010-01-06T08:40:45Z

link to feature request

Dirk: Things to consider when setting up a demo site

2010-01-06T08:24:55Z

Things to consider when setting up a demo site

New page

== Incentive ==

This is a collection of tips if you want to set up a demo site, i.e. a Geeklog site where users can log in with admin privileges so that they can have a look "behind the scenes" without having to install Geeklog themselves first.

== The Problem ==

All of the "risky" options on a Geeklog site require admin access. On a demo site, however, you give admin access to any random visitor. So it's important to identify and disable those admin options that can either bring down the demo site or even allow an attacker to upload and run malicious code on the site.

These issues are specific to running a demo site. On a standard Geeklog install, you would only give admin privileges to people you trust.

=== PHP in Static Pages ===

You can [http://www.geeklog.net/docs/english/staticpages.html#php embed PHP code] in Static Pages. By default, that feature is disabled in a standard install, but can easily be enabled if you have admin privileges.

To disable this option entirely on a demo site setup, add the following line to your site's <tt>siteconfig.php</tt> file:

<pre>$_SP_DEFAULT['allow_php'] = 0;</pre>

=== Plugin Uploads ===

Geeklog 1.6 introduced an option to upload plugins directly from within Geeklog. This option requires write access to certain directories and is therefore a potential security issue on a demo site.

To disable this option, make sure the <tt>plugins</tt> directories are not writeable for the webserver, i.e.

<tt>/path/to/geeklog/plugins</tt> and<br>
<tt>/path/to/geeklog/public_html/admin/plugins</tt>

=== 3rd Party Plugins ===

Carefully consider any additional plugins you install on the demo site and review their features for potential abuse. Plugins that allow any form of upload may create issues. At the very least, you may need to remove uploaded files during a regular reset of the site.

== Other Considerations ==

If you open up a site like in a demo setup, people will try all sorts of things. This will most likely include vandalism, spam, changing passwords, and trying to exploit features. Here are some things to consider for a demo setup:

=== Reset the Site regularly ===

Set up a cronjob to automatically reset the site every hour or at least once a day. Things you should reset:

* the database - simply drop it and reload from a backup
* clear out the upload directories:
** <tt>/path/to/geeklog/data</tt>
** <tt>/path/to/geeklog/public_html/images/articles</tt>
** <tt>/path/to/geeklog/public_html/images/topics</tt>
** <tt>/path/to/geeklog/public_html/images/userphotos</tt>

← Older revision		Revision as of 08:48, 6 January 2010
Line 48:		Line 48:

	* [http://project.geeklog.net/tracking/view.php?id=1059 Feature Request: Demo Site option]		* [http://project.geeklog.net/tracking/view.php?id=1059 Feature Request: Demo Site option]
		+	* Not much of a discussion, but there were [http://eight.pairlist.net/pipermail/geeklog-devel/2009-January/003999.html two] [http://eight.pairlist.net/pipermail/geeklog-devel/2009-January/004000.html posts] on the geeklog-devel list regarding a demo site option.

← Older revision		Revision as of 08:40, 6 January 2010
Line 44:		Line 44:
	** <tt>/path/to/geeklog/public_html/images/topics</tt>		** <tt>/path/to/geeklog/public_html/images/topics</tt>
	** <tt>/path/to/geeklog/public_html/images/userphotos</tt>		** <tt>/path/to/geeklog/public_html/images/userphotos</tt>
		+
		+	== Also See ==
		+
		+	* [http://project.geeklog.net/tracking/view.php?id=1059 Feature Request: Demo Site option]

@@ Line 25: / Line 25: @@
 <tt>/path/to/geeklog/plugins</tt> and<br>
 <tt>/path/to/geeklog/public_html/admin/plugins</tt>
 === 3rd Party Plugins ===