On Mon, 25 Oct 2004 07:44:33 -0700, shane freese &lt;shane.freese(a)gmail.com&gt; wrote: Well, you have the source, it's up to you - but it *would* be pretty risky. Somebody described how they'd done exactly this a few weeks ago: see http://mail.wikipedia.org/pipermail/wikitech-l/2004-October/025771.html and its follow-ups; but they then had problems with the pages being cached, as discussed in the threads starting with http://mail.wikipedia.org/pipermail/wikitech-l/2004-October/025786.html and http://mail.wikipedia.org/pipermail/wikitech-l/2004-October/025787.html This is, of course, just as dodgy as allowing arbitrary php code: there are all sorts of evil things someone could do with uncontrolled javascript, such as accessing cookie data and sending it somewhere else (since the JavaScript would be on your site, this could probably allow them to steal information necessary to log into your site as the person viewing the article). But if you make sure you really really trust everyone who can edit, this isn't a problem (it's not a wiki either, but there you go). It's certainly possible: people use "javascript feeds" all the time; I think the basic trick is to grab the data from a special URL, and then use document.write() to add it to the current page. However, better than allowing arbitrary anything is just to build the PHP script you want to execute into the code. You could probably create a <feed>url:path/to/feed</feed> "extension" (see above referenced threads), perhaps limiting it to relative paths (so nothing can be included from somewhere other than your server). Or you could be less flexible, and just have a magic word, checked for in Parser.php::internalParse(), that runs a function of your own design; hacky, but very simple to program. Of course, you will then end up in the same caching conundrum as Arvalux in the threads I already referenced: how to make sure the pages in question are forced to remain uncached. Some kind of hack with timestamps whereby the cache never thinks it has the latest version seems to be the best anyone's come up with for this; or, if you want to be less hacky, a cur_nocache flag in the database that's set and unset in Parser.php::preSaveTransform() [he says, quoting bits of code from memory that he's never really looked at carefully] Good luck... -- Rowan Collins BSc [IMSoP]

I simply used what was linked to by Rowan. I added this function to the bottom of Setup.php. It works just as I needed. function ParsePHPTag($Content) { global $wgOut; $wgOut->enableClientCache(false); ob_start(); eval($Content); $Result = ob_get_contents(); ob_end_clean(); return($Result); } $wgParser->setHook('php','ParsePHPTag'); I then just use the newly created <php></php> tags to include my php script. This does pose a security risk so I wouldn't use it on an open wiki, however my site isn't a wiki per say I just like the flexibility of MediaWiki. Shane On Tue, 26 Oct 2004 15:33:48 -0400, Jamie Bliss &lt;astronouth7303(a)gmail.com&gt; wrote:

On Nov 9, 2004, at 7:21 AM, Taneem A T wrote: If you do, be careful about validating the file name; in some configurations (eg, by default) PHP will let you include and run code from an arbitrary URL. -- brion vibber (brion @ pobox.com)

Hello all, Thanks for the comments. I have modified the previous hack to do what we've discussed earlier today: If you include the following snippet in setup.php: function IncludePHP($Content) { global $wgOut; $wgOut->enableClientCache(false); ob_start(); //match for only text and numbers, followed by a period followed by 'php' if(ereg("^([a-z]|[0-9])*.php$",$Content)==true){ $Content = "include('$Content');"; } else{ $Content = "echo \" <strong>invalid include file specified <strong>\";"; } eval($Content); $Result = ob_get_contents(); ob_end_clean(); return($Result); } $wgParser->setHook('includephp','IncludePHP'); (to make it work, you put the php code in "filename.php", upload it to your wiki directory then use the syntax <includephp>filename.php</includephp> In my wiki, this works beautifully - only *.php files in my wiki directory are executed. Everything else is rejected. It's a simple matter of tweaking the regex to allow subfolders too. Comments about the effectiveness of this are appreciated ... =) Taneem Talukdar On Tue, 9 Nov 2004 23:07:33 +0000, Rowan Collins &lt;rowan.collins(a)gmail.com&gt; wrote:

I thought of this and tested it - the server I'm on has debug messages turned off - all I get is a blank. However for my own purposes I could test if include() returns a true or false value (provided the included file returns nothing) and give a custom error message? Yes I should have remembered this - a simple solution I can think of is to specify a subfolder dedicated just to my own php files. Apart from that, thanks for all the points - as you can probably tell, I'm just learning all this stuff, so your comments are really appreciated =) Regards, Taneem Talukdar

This is true - the wiki file upload settings are set to the defaults - can't upload anything except pictures and such. Only people with access to the server through ftp can actually upload any php files. So it's just the admins. Thank you, I will look into using this =) Taneem Talukdar