Fossil SCM

On the text descriptions of the various administrator settings, identify the property in the CONFIG table that is being modified.

drh 2017-07-03 19:07 trunk

Commit 3ca935ef556ef2da9659c70da75bccd13a880379dfb5b65135f10656d6e7ab25

Parent a8910101c3a5e1c…

1 file changed +55 -25

~ src/setup.c

M src/setup.c

+55 -25

		--- src/setup.c
		+++ src/setup.c
		@@ -1106,18 +1106,20 @@
1106	1106
1107	1107	style_header("Access Control Settings");
1108	1108	db_begin_transaction();
1109	1109	@ <form action="%s(g.zTop)/setup_access" method="post"><div>
1110	1110	login_insert_csrf_secret();
	1111	+ @ <input type="submit" name="submit" value="Apply Changes" /></p>
1111	1112	@ <hr />
1112	1113	onoff_attribute("Redirect to HTTPS on the Login page",
1113	1114	"redirect-to-https", "redirhttps", 0, 0);
1114	1115	@ <p>When selected, force the use of HTTPS for the Login page.
1115	1116	@ <p>Details: When enabled, this option causes the $secureurl TH1
1116	1117	@ variable is set to an "https:" variant of $baseurl. Otherwise,
1117	1118	@ $secureurl is just an alias for $baseurl. Also when enabled, the
1118	1119	@ Login page redirects to https if accessed via http.
	1120	+ @ (Property: "redirhttps")
1119	1121	@ <hr />
1120	1122	onoff_attribute("Require password for local access",
1121	1123	"localauth", "localauth", 0, 0);
1122	1124	@ <p>When enabled, the password sign-in is always required for
1123	1125	@ web access. When disabled, unrestricted web access from 127.0.0.1
		@@ -1138,67 +1140,74 @@
1138	1140	@ <a href="%R/help/server">fossil http</a> commands
1139	1141	@ without the "--localauth" option.
1140	1142	@ <li> The server is started from CGI without the "localauth" keyword
1141	1143	@ in the CGI script.
1142	1144	@ </ol>
	1145	+ @ (Property: "localauth")
1143	1146	@
1144	1147	@ <hr />
1145	1148	onoff_attribute("Enable /test_env",
1146	1149	"test_env_enable", "test_env_enable", 0, 0);
1147	1150	@ <p>When enabled, the %h(g.zBaseURL)/test_env URL is available to all
1148	1151	@ users. When disabled (the default) only users Admin and Setup can visit
1149	1152	@ the /test_env page.
	1153	+ @ (Property: "test_env_enable")
1150	1154	@ </p>
1151	1155	@
1152	1156	@ <hr />
1153	1157	onoff_attribute("Allow REMOTE_USER authentication",
1154	1158	"remote_user_ok", "remote_user_ok", 0, 0);
1155	1159	@ <p>When enabled, if the REMOTE_USER environment variable is set to the
1156	1160	@ login name of a valid user and no other login credentials are available,
1157	1161	@ then the REMOTE_USER is accepted as an authenticated user.
	1162	+ @ (Property: "remote_user_ok")
1158	1163	@ </p>
1159	1164	@
1160	1165	@ <hr />
1161	1166	onoff_attribute("Allow HTTP_AUTHENTICATION authentication",
1162	1167	"http_authentication_ok", "http_authentication_ok", 0, 0);
1163	1168	@ <p>When enabled, allow the use of the HTTP_AUTHENTICATION environment
1164	1169	@ variable or the "Authentication:" HTTP header to find the username and
1165	1170	@ password. This is another way of supporting Basic Authenitication.
	1171	+ @ (Property: "http_authentication_ok")
1166	1172	@ </p>
1167	1173	@
1168	1174	@ <hr />
1169	1175	entry_attribute("IP address terms used in login cookie", 3,
1170	1176	"ip-prefix-terms", "ipt", "2", 0);
1171	1177	@ <p>The number of octets of of the IP address used in the login cookie.
1172	1178	@ Set to zero to omit the IP address from the login cookie. A value of
1173	1179	@ 2 is recommended.
	1180	+ @ (Property: "ip-prefix-terms")
1174	1181	@ </p>
1175	1182	@
1176	1183	@ <hr />
1177	1184	entry_attribute("Login expiration time", 6, "cookie-expire", "cex",
1178	1185	"8766", 0);
1179	1186	@ <p>The number of hours for which a login is valid. This must be a
1180	1187	@ positive number. The default is 8766 hours which is approximately equal
1181		- @ to a year.</p>
	1188	+ @ to a year.
	1189	+ @ (Property: "cookie-expire")</p>
1182	1190
1183	1191	@ <hr />
1184	1192	entry_attribute("Download packet limit", 10, "max-download", "mxdwn",
1185	1193	"5000000", 0);
1186	1194	@ <p>Fossil tries to limit out-bound sync, clone, and pull packets
1187	1195	@ to this many bytes, uncompressed. If the client requires more data
1188	1196	@ than this, then the client will issue multiple HTTP requests.
1189	1197	@ Values below 1 million are not recommended. 5 million is a
1190		- @ reasonable number.</p>
	1198	+ @ reasonable number. (Property: "max-download")</p>
1191	1199
1192	1200	@ <hr />
1193	1201	entry_attribute("Download time limit", 11, "max-download-time", "mxdwnt",
1194	1202	"30", 0);
1195	1203
1196	1204	@ <p>Fossil tries to spend less than this many seconds gathering
1197	1205	@ the out-bound data of sync, clone, and pull packets.
1198	1206	@ If the client request takes longer, a partial reply is given similar
1199		- @ to the download packet limit. 30s is a reasonable default.</p>
	1207	+ @ to the download packet limit. 30s is a reasonable default.
	1208	+ @ (Property: "max-download-time")</p>
1200	1209
1201	1210	@ <hr />
1202	1211	entry_attribute("Server Load Average Limit", 11, "max-loadavg", "mxldavg",
1203	1212	"0.0", 0);
1204	1213	@ <p>Some expensive operations (such as computing tarballs, zip archives,
		@@ -1205,11 +1214,12 @@
1205	1214	@ or annotation/blame pages) are prohibited if the load average on the host
1206	1215	@ computer is too large. Set the threshold for disallowing expensive
1207	1216	@ computations here. Set this to 0.0 to disable the load average limit.
1208	1217	@ This limit is only enforced on Unix servers. On Linux systems,
1209	1218	@ access to the /proc virtual filesystem is required, which means this limit
1210		- @ might not work inside a chroot() jail.</p>
	1219	+ @ might not work inside a chroot() jail.
	1220	+ @ (Property: "max-loadavg")</p>
1211	1221
1212	1222	@ <hr />
1213	1223	onoff_attribute(
1214	1224	"Enable hyperlinks for \"nobody\" based on User-Agent and Javascript",
1215	1225	"auto-hyperlink", "autohyperlink", 1, 0);
		@@ -1219,41 +1229,42 @@
1219	1229	@ being and not a robot or spider and (2) the user agent is able to
1220	1230	@ run Javascript in order to set the href= attribute of hyperlinks. Bots
1221	1231	@ and spiders can forge a User-Agent string that makes them seem to be a
1222	1232	@ normal browser and they can run javascript just like browsers. But most
1223	1233	@ bots do not go to that much trouble so this is normally an effective
1224		- @ defense.</p>
	1234	+ @ defense.<p>
1225	1235	@
1226	1236	@ <p>You do not normally want a bot to walk your entire repository because
1227	1237	@ if it does, your server will end up computing diffs and annotations for
1228	1238	@ every historical version of every file and creating ZIPs and tarballs of
1229	1239	@ every historical check-in, which can use a lot of CPU and bandwidth
1230	1240	@ even for relatively small projects.</p>
1231	1241	@
1232	1242	@ <p>Additional parameters that control this behavior:</p>
1233	1243	@ <blockquote>
1234		- onoff_attribute("Enable hyperlinks for humans (as deduced from the UserAgent "
1235		- " HTTP header string)",
1236		- "auto-hyperlink-ishuman", "ahis", 0, 0);
	1244	+ onoff_attribute("Enable hyperlinks for humans as deduced from the UserAgent "
	1245	+ "string", "auto-hyperlink-ishuman", "ahis", 0, 0);
1237	1246	@ <br />
1238	1247	onoff_attribute("Require mouse movement before enabling hyperlinks",
1239	1248	"auto-hyperlink-mouseover", "ahmo", 0, 0);
1240	1249	@ <br />
1241		- entry_attribute("Delay before enabling hyperlinks (milliseconds)", 5,
	1250	+ entry_attribute("Delay in milliseconds before enabling hyperlinks", 5,
1242	1251	"auto-hyperlink-delay", "ah-delay", "10", 0);
1243	1252	@ </blockquote>
1244	1253	@ <p>Hyperlinks for user "nobody" are normally enabled as soon as the page
1245	1254	@ finishes loading. But the first check-box below can be set to require mouse
1246	1255	@ movement before enabling the links. One can also set a delay prior to enabling
1247	1256	@ links by enter a positive number of milliseconds in the entry box above.</p>
	1257	+ @ (Properties: "auto-hyperlink", "auto-hyperlink-ishuman",
	1258	+ @ "auto-hyperlink-mouseover", and "auto-hyperlink-delay")</p>
1248	1259
1249	1260	@ <hr />
1250	1261	onoff_attribute("Require a CAPTCHA if not logged in",
1251	1262	"require-captcha", "reqcapt", 1, 0);
1252	1263	@ <p>Require a CAPTCHA for edit operations (appending, creating, or
1253	1264	@ editing wiki or tickets or adding attachments to wiki or tickets)
1254		- @ for users who are not logged in.</p>
	1265	+ @ for users who are not logged in. (Property: "require-captcha")</p>
1255	1266
1256	1267	@ <hr />
1257	1268	entry_attribute("Public pages", 30, "public-pages",
1258	1269	"pubpage", "", 0);
1259	1270	@ <p>A comma-separated list of glob patterns for pages that are accessible
		@@ -1260,10 +1271,11 @@
1260	1271	@ without needing a login and using the privileges given by the
1261	1272	@ "Default privileges" setting below. Example use case: Set this field
1262	1273	@ to "/doc/trunk/www/*" to give anonymous users read-only permission to the
1263	1274	@ latest version of the embedded documentation in the www/ folder without
1264	1275	@ allowing them to see the rest of the source code.
	1276	+ @ (Property: "public-pages")
1265	1277	@ </p>
1266	1278
1267	1279	@ <hr />
1268	1280	onoff_attribute("Allow users to register themselves",
1269	1281	"self-register", "selfregister", 0, 0);
		@@ -1270,29 +1282,30 @@
1270	1282	@ <p>Allow users to register themselves through the HTTP UI.
1271	1283	@ The registration form always requires filling in a CAPTCHA
1272	1284	@ (<em>auto-captcha</em> setting is ignored). Still, bear in mind that anyone
1273	1285	@ can register under any user name. This option is useful for public projects
1274	1286	@ where you do not want everyone in any ticket discussion to be named
1275		- @ "Anonymous".</p>
	1287	+ @ "Anonymous". (Property: "self-register")</p>
1276	1288
1277	1289	@ <hr />
1278	1290	entry_attribute("Default privileges", 10, "default-perms",
1279	1291	"defaultperms", "u", 0);
1280	1292	@ <p>Permissions given to users that... <ul><li>register themselves using
1281	1293	@ the self-registration procedure (if enabled), or <li>access "public"
1282	1294	@ pages identified by the public-pages glob pattern above, or <li>
1283	1295	@ are users newly created by the administrator.</ul>
	1296	+ @ (Property: "default-perms")
1284	1297	@ </p>
1285	1298
1286	1299	@ <hr />
1287	1300	onoff_attribute("Show javascript button to fill in CAPTCHA",
1288	1301	"auto-captcha", "autocaptcha", 0, 0);
1289	1302	@ <p>When enabled, a button appears on the login screen for user
1290	1303	@ "anonymous" that will automatically fill in the CAPTCHA password.
1291	1304	@ This is less secure than forcing the user to do it manually, but is
1292	1305	@ probably secure enough and it is certainly more convenient for
1293		- @ anonymous users.</p>
	1306	+ @ anonymous users. (Property: "auto-captcha")</p>
1294	1307
1295	1308	@ <hr />
1296	1309	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1297	1310	@ </div></form>
1298	1311	db_end_transaction(0);
		@@ -1440,28 +1453,31 @@
1440	1453	style_header("Timeline Display Preferences");
1441	1454	db_begin_transaction();
1442	1455	@ <form action="%s(g.zTop)/setup_timeline" method="post"><div>
1443	1456	login_insert_csrf_secret();
1444	1457
	1458	+ @ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1445	1459	@ <hr />
1446	1460	onoff_attribute("Allow block-markup in timeline",
1447	1461	"timeline-block-markup", "tbm", 0, 0);
1448	1462	@ <p>In timeline displays, check-in comments can be displayed with or
1449		- @ without block markup (paragraphs, tables, etc.)</p>
	1463	+ @ without block markup such as paragraphs, tables, etc.
	1464	+ @ (Property: "timeline-block-markup")</p>
1450	1465
1451	1466	@ <hr />
1452	1467	onoff_attribute("Plaintext comments on timelines",
1453	1468	"timeline-plaintext", "tpt", 0, 0);
1454	1469	@ <p>In timeline displays, check-in comments are displayed literally,
1455		- @ without any wiki or HTML interpretation. (Note: Use CSS to change
1456		- @ display formatting features such as fonts and line-wrapping behavior.)</p>
	1470	+ @ without any wiki or HTML interpretation. Use CSS to change
	1471	+ @ display formatting features such as fonts and line-wrapping behavior.
	1472	+ @ (Property: "timeline-plaintext")</p>
1457	1473
1458	1474	@ <hr />
1459	1475	onoff_attribute("Truncate comment at first blank line",
1460	1476	"timeline-truncate-at-blank", "ttb", 0, 0);
1461	1477	@ <p>In timeline displays, check-in comments are displayed only through
1462		- @ the first blank line.</p>
	1478	+ @ the first blank line. (Property: "timeline-truncate-at-blank")</p>
1463	1479
1464	1480	@ <hr />
1465	1481	onoff_attribute("Use Universal Coordinated Time (UTC)",
1466	1482	"timeline-utc", "utc", 1, 0);
1467	1483	@ <p>Show times as UTC (also sometimes called Greenwich Mean Time (GMT) or
		@@ -1478,32 +1494,35 @@
1478	1494	sqlite3_snprintf(sizeof(zTmDiff), zTmDiff, "%.1f", -tmDiff);
1479	1495	@ %s(zTmDiff) hours behind UTC.</p>
1480	1496	}else{
1481	1497	@ %s(zTmDiff) hours ahead of UTC.</p>
1482	1498	}
1483		-
	1499	+ @ <p>(Property: "timeline-utc")
1484	1500	@ <hr />
1485	1501	multiple_choice_attribute("Per-Item Time Format", "timeline-date-format",
1486	1502	"tdf", "0", count(azTimeFormats)/2, azTimeFormats);
1487	1503	@ <p>If the "HH:MM" or "HH:MM:SS" format is selected, then the date is shown
1488	1504	@ in a separate box (using CSS class "timelineDate") whenever the date changes.
1489	1505	@ With the "YYYY-MM-DD HH:MM" and "YYMMDD ..." formats, the complete date
1490		- @ and time is shown on every timeline entry (using the CSS class "timelineTime").</p>
	1506	+ @ and time is shown on every timeline entry using the CSS class "timelineTime".
	1507	+ @ (Preperty: "timeline-date-format")</p>
1491	1508
1492	1509	@ <hr />
1493	1510	onoff_attribute("Show version differences by default",
1494	1511	"show-version-diffs", "vdiff", 0, 0);
1495	1512	@ <p>The version-information pages linked from the timeline can either
1496	1513	@ show complete diffs of all file changes, or can just list the names of
1497	1514	@ the files that have changed. Users can get to either page by
1498		- @ clicking. This setting selects the default.</p>
	1515	+ @ clicking. This setting selects the default.
	1516	+ @ (Property: "show-version-diffs")</p>
1499	1517
1500	1518	@ <hr />
1501	1519	entry_attribute("Max timeline comment length", 6,
1502	1520	"timeline-max-comment", "tmc", "0", 0);
1503	1521	@ <p>The maximum length of a comment to be displayed in a timeline.
1504		- @ "0" there is no length limit.</p>
	1522	+ @ "0" there is no length limit.
	1523	+ @ (Property: "timeline-max-comment")</p>
1505	1524
1506	1525	@ <hr />
1507	1526	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1508	1527	@ </div></form>
1509	1528	db_end_transaction(0);
		@@ -1609,33 +1628,38 @@
1609	1628
1610	1629	style_header("WWW Configuration");
1611	1630	db_begin_transaction();
1612	1631	@ <form action="%s(g.zTop)/setup_config" method="post"><div>
1613	1632	login_insert_csrf_secret();
	1633	+ @ <input type="submit" name="submit" value="Apply Changes" /></p>
1614	1634	@ <hr />
1615	1635	entry_attribute("Project Name", 60, "project-name", "pn", "", 0);
1616		- @ <p>Give your project a name so visitors know what this site is about.
	1636	+ @ <p>A brief project name so visitors know what this site is about.
1617	1637	@ The project name will also be used as the RSS feed title.
	1638	+ @ (Property: "project-name")
1618	1639	@ </p>
1619	1640	@ <hr />
1620	1641	textarea_attribute("Project Description", 3, 80,
1621	1642	"project-description", "pd", "", 0);
1622	1643	@ <p>Describe your project. This will be used in page headers for search
1623		- @ engines as well as a short RSS description.</p>
	1644	+ @ engines as well as a short RSS description.
	1645	+ @ (Property: "project-description")</p>
1624	1646	@ <hr />
1625	1647	entry_attribute("Tarball and ZIP-archive Prefix", 20, "short-project-name", "spn", "", 0);
1626	1648	@ <p>This is used as a prefix on the names of generated tarballs and ZIP archive.
1627	1649	@ For best results, keep this prefix brief and avoid special characters such
1628	1650	@ as "/" and "\".
1629	1651	@ If no tarball prefix is specified, then the full Project Name above is used.
	1652	+ @ (Property: "short-project-name")
1630	1653	@ </p>
1631	1654	@ <hr />
1632	1655	onoff_attribute("Enable WYSIWYG Wiki Editing",
1633	1656	"wysiwyg-wiki", "wysiwyg-wiki", 0, 0);
1634	1657	@ <p>Enable what-you-see-is-what-you-get (WYSIWYG) editing of wiki pages.
1635	1658	@ The WYSIWYG editor generates HTML instead of markup, which makes
1636		- @ subsequent manual editing more difficult.</p>
	1659	+ @ subsequent manual editing more difficult.
	1660	+ @ (Property: "wysiwyg-wiki")</p>
1637	1661	@ <hr />
1638	1662	entry_attribute("Index Page", 60, "index-page", "idxpg", "/home", 0);
1639	1663	@ <p>Enter the pathname of the page to display when the "Home" menu
1640	1664	@ option is selected and when no pathname is
1641	1665	@ specified in the URL. For example, if you visit the url:</p>
		@@ -1653,10 +1677,11 @@
1653	1677	@
1654	1678	@ <p>Note: To avoid a redirect loop or other problems, this entry must
1655	1679	@ begin with "/" and it must specify a valid page. For example,
1656	1680	@ "<b>/home</b>" will work but "<b>home</b>" will not, since it omits the
1657	1681	@ leading "/".</p>
	1682	+ @ <p>(Property: "index-page")
1658	1683	@ <hr />
1659	1684	onoff_attribute("Use HTML as wiki markup language",
1660	1685	"wiki-use-html", "wiki-use-html", 0, 0);
1661	1686	@ <p>Use HTML as the wiki markup language. Wiki links will still be parsed
1662	1687	@ but all other wiki formatting will be ignored. This option is helpful
		@@ -1667,10 +1692,11 @@
1667	1692	@ No sanitization is done. This means that it is very possible for malicious
1668	1693	@ users to inject dangerous HTML, CSS and JavaScript code into your wiki.</p>
1669	1694	@ <p>This should <strong>only</strong> be enabled when wiki editing is limited
1670	1695	@ to trusted users. It should <strong>not</strong> be used on a publically
1671	1696	@ editable wiki.</p>
	1697	+ @ (Property: "wiki-use-html")
1672	1698	@ <hr />
1673	1699	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1674	1700	@ </div></form>
1675	1701	db_end_transaction(0);
1676	1702	style_footer();
		@@ -1699,11 +1725,11 @@
1699	1725	@ by a ticket moderator - a user with the "q" or Mod-Tkt privilege.
1700	1726	@ Ticket changes enter the system and are shown locally, but are not
1701	1727	@ synced until they are approved. The moderator has the option to
1702	1728	@ delete the change rather than approve it. Ticket changes made by
1703	1729	@ a user who has the Mod-Tkt privilege are never subject to
1704		- @ moderation.
	1730	+ @ moderation. (Property: "modreq-tkt")
1705	1731	@
1706	1732	@ <hr />
1707	1733	onoff_attribute("Moderate wiki changes",
1708	1734	"modreq-wiki", "modreq-wiki", 0, 0);
1709	1735	@ <p>When enabled, any change to wiki is subject to the approval
		@@ -1710,11 +1736,11 @@
1710	1736	@ by a wiki moderator - a user with the "l" or Mod-Wiki privilege.
1711	1737	@ Wiki changes enter the system and are shown locally, but are not
1712	1738	@ synced until they are approved. The moderator has the option to
1713	1739	@ delete the change rather than approve it. Wiki changes made by
1714	1740	@ a user who has the Mod-Wiki privilege are never subject to
1715		- @ moderation.
	1741	+ @ moderation. (Property: "modreq-wiki")
1716	1742	@ </p>
1717	1743
1718	1744	@ <hr />
1719	1745	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1720	1746	@ </div></form>
		@@ -1763,10 +1789,12 @@
1763	1789	@ <b>Ad-Unit Notes:</b><ul>
1764	1790	@ <li>Leave both Ad-Units blank to disable all advertising.
1765	1791	@ <li>The "Banner Ad-Unit" is used for wide pages.
1766	1792	@ <li>The "Right-Column Ad-Unit" is used on pages with tall, narrow content.
1767	1793	@ <li>If the "Right-Column Ad-Unit" is blank, the "Banner Ad-Unit" is used on all pages.
	1794	+ @ <li>Properties: "adunit", "adunit-right", "adunit-omit-if-admin", and
	1795	+ @ "adunit-omit-if-user".
1768	1796	@ <li>Suggested <a href="setup_skinedit?w=0">CSS</a> changes:
1769	1797	@ <blockquote><pre>
1770	1798	@ div.adunit_banner {
1771	1799	@ margin: auto;
1772	1800	@ width: 100%%;
		@@ -1888,10 +1916,11 @@
1888	1916	@ Logo Image file:
1889	1917	@ <input type="file" name="logoim" size="60" accept="image/*" />
1890	1918	@ <p align="center">
1891	1919	@ <input type="submit" name="setlogo" value="Change Logo" />
1892	1920	@ <input type="submit" name="clrlogo" value="Revert To Default" /></p>
	1921	+ @ <p>(Properties: "logo-image" and "logo-mimetype")
1893	1922	@ </div></form>
1894	1923	@ <hr />
1895	1924	@
1896	1925	@ <p>The current background image has a MIME-Type of <b>%h(zBgMime)</b>
1897	1926	@ and looks like this:</p>
		@@ -1911,10 +1940,11 @@
1911	1940	@ <input type="file" name="bgim" size="60" accept="image/*" />
1912	1941	@ <p align="center">
1913	1942	@ <input type="submit" name="setbg" value="Change Background" />
1914	1943	@ <input type="submit" name="clrbg" value="Revert To Default" /></p>
1915	1944	@ </div></form>
	1945	+ @ <p>(Properties: "background-image" and "background-mimetype")
1916	1946	@ <hr />
1917	1947	@
1918	1948	@ <p><span class="note">Note:</span> Your browser has probably cached these
1919	1949	@ images, so you may need to press the Reload button before changes will
1920	1950	@ take effect. </p>
1921	1951

	--- src/setup.c
	+++ src/setup.c
	@@ -1106,18 +1106,20 @@
1106
1107	style_header("Access Control Settings");
1108	db_begin_transaction();
1109	@ <form action="%s(g.zTop)/setup_access" method="post"><div>
1110	login_insert_csrf_secret();

1111	@ <hr />
1112	onoff_attribute("Redirect to HTTPS on the Login page",
1113	"redirect-to-https", "redirhttps", 0, 0);
1114	@ <p>When selected, force the use of HTTPS for the Login page.
1115	@ <p>Details: When enabled, this option causes the $secureurl TH1
1116	@ variable is set to an "https:" variant of $baseurl. Otherwise,
1117	@ $secureurl is just an alias for $baseurl. Also when enabled, the
1118	@ Login page redirects to https if accessed via http.

1119	@ <hr />
1120	onoff_attribute("Require password for local access",
1121	"localauth", "localauth", 0, 0);
1122	@ <p>When enabled, the password sign-in is always required for
1123	@ web access. When disabled, unrestricted web access from 127.0.0.1
	@@ -1138,67 +1140,74 @@
1138	@ <a href="%R/help/server">fossil http</a> commands
1139	@ without the "--localauth" option.
1140	@ <li> The server is started from CGI without the "localauth" keyword
1141	@ in the CGI script.
1142	@ </ol>

1143	@
1144	@ <hr />
1145	onoff_attribute("Enable /test_env",
1146	"test_env_enable", "test_env_enable", 0, 0);
1147	@ <p>When enabled, the %h(g.zBaseURL)/test_env URL is available to all
1148	@ users. When disabled (the default) only users Admin and Setup can visit
1149	@ the /test_env page.

1150	@ </p>
1151	@
1152	@ <hr />
1153	onoff_attribute("Allow REMOTE_USER authentication",
1154	"remote_user_ok", "remote_user_ok", 0, 0);
1155	@ <p>When enabled, if the REMOTE_USER environment variable is set to the
1156	@ login name of a valid user and no other login credentials are available,
1157	@ then the REMOTE_USER is accepted as an authenticated user.

1158	@ </p>
1159	@
1160	@ <hr />
1161	onoff_attribute("Allow HTTP_AUTHENTICATION authentication",
1162	"http_authentication_ok", "http_authentication_ok", 0, 0);
1163	@ <p>When enabled, allow the use of the HTTP_AUTHENTICATION environment
1164	@ variable or the "Authentication:" HTTP header to find the username and
1165	@ password. This is another way of supporting Basic Authenitication.

1166	@ </p>
1167	@
1168	@ <hr />
1169	entry_attribute("IP address terms used in login cookie", 3,
1170	"ip-prefix-terms", "ipt", "2", 0);
1171	@ <p>The number of octets of of the IP address used in the login cookie.
1172	@ Set to zero to omit the IP address from the login cookie. A value of
1173	@ 2 is recommended.

1174	@ </p>
1175	@
1176	@ <hr />
1177	entry_attribute("Login expiration time", 6, "cookie-expire", "cex",
1178	"8766", 0);
1179	@ <p>The number of hours for which a login is valid. This must be a
1180	@ positive number. The default is 8766 hours which is approximately equal
1181	@ to a year.</p>

1182
1183	@ <hr />
1184	entry_attribute("Download packet limit", 10, "max-download", "mxdwn",
1185	"5000000", 0);
1186	@ <p>Fossil tries to limit out-bound sync, clone, and pull packets
1187	@ to this many bytes, uncompressed. If the client requires more data
1188	@ than this, then the client will issue multiple HTTP requests.
1189	@ Values below 1 million are not recommended. 5 million is a
1190	@ reasonable number.</p>
1191
1192	@ <hr />
1193	entry_attribute("Download time limit", 11, "max-download-time", "mxdwnt",
1194	"30", 0);
1195
1196	@ <p>Fossil tries to spend less than this many seconds gathering
1197	@ the out-bound data of sync, clone, and pull packets.
1198	@ If the client request takes longer, a partial reply is given similar
1199	@ to the download packet limit. 30s is a reasonable default.</p>

1200
1201	@ <hr />
1202	entry_attribute("Server Load Average Limit", 11, "max-loadavg", "mxldavg",
1203	"0.0", 0);
1204	@ <p>Some expensive operations (such as computing tarballs, zip archives,
	@@ -1205,11 +1214,12 @@
1205	@ or annotation/blame pages) are prohibited if the load average on the host
1206	@ computer is too large. Set the threshold for disallowing expensive
1207	@ computations here. Set this to 0.0 to disable the load average limit.
1208	@ This limit is only enforced on Unix servers. On Linux systems,
1209	@ access to the /proc virtual filesystem is required, which means this limit
1210	@ might not work inside a chroot() jail.</p>

1211
1212	@ <hr />
1213	onoff_attribute(
1214	"Enable hyperlinks for \"nobody\" based on User-Agent and Javascript",
1215	"auto-hyperlink", "autohyperlink", 1, 0);
	@@ -1219,41 +1229,42 @@
1219	@ being and not a robot or spider and (2) the user agent is able to
1220	@ run Javascript in order to set the href= attribute of hyperlinks. Bots
1221	@ and spiders can forge a User-Agent string that makes them seem to be a
1222	@ normal browser and they can run javascript just like browsers. But most
1223	@ bots do not go to that much trouble so this is normally an effective
1224	@ defense.</p>
1225	@
1226	@ <p>You do not normally want a bot to walk your entire repository because
1227	@ if it does, your server will end up computing diffs and annotations for
1228	@ every historical version of every file and creating ZIPs and tarballs of
1229	@ every historical check-in, which can use a lot of CPU and bandwidth
1230	@ even for relatively small projects.</p>
1231	@
1232	@ <p>Additional parameters that control this behavior:</p>
1233	@ <blockquote>
1234	onoff_attribute("Enable hyperlinks for humans (as deduced from the UserAgent "
1235	" HTTP header string)",
1236	"auto-hyperlink-ishuman", "ahis", 0, 0);
1237	@ <br />
1238	onoff_attribute("Require mouse movement before enabling hyperlinks",
1239	"auto-hyperlink-mouseover", "ahmo", 0, 0);
1240	@ <br />
1241	entry_attribute("Delay before enabling hyperlinks (milliseconds)", 5,
1242	"auto-hyperlink-delay", "ah-delay", "10", 0);
1243	@ </blockquote>
1244	@ <p>Hyperlinks for user "nobody" are normally enabled as soon as the page
1245	@ finishes loading. But the first check-box below can be set to require mouse
1246	@ movement before enabling the links. One can also set a delay prior to enabling
1247	@ links by enter a positive number of milliseconds in the entry box above.</p>


1248
1249	@ <hr />
1250	onoff_attribute("Require a CAPTCHA if not logged in",
1251	"require-captcha", "reqcapt", 1, 0);
1252	@ <p>Require a CAPTCHA for edit operations (appending, creating, or
1253	@ editing wiki or tickets or adding attachments to wiki or tickets)
1254	@ for users who are not logged in.</p>
1255
1256	@ <hr />
1257	entry_attribute("Public pages", 30, "public-pages",
1258	"pubpage", "", 0);
1259	@ <p>A comma-separated list of glob patterns for pages that are accessible
	@@ -1260,10 +1271,11 @@
1260	@ without needing a login and using the privileges given by the
1261	@ "Default privileges" setting below. Example use case: Set this field
1262	@ to "/doc/trunk/www/*" to give anonymous users read-only permission to the
1263	@ latest version of the embedded documentation in the www/ folder without
1264	@ allowing them to see the rest of the source code.

1265	@ </p>
1266
1267	@ <hr />
1268	onoff_attribute("Allow users to register themselves",
1269	"self-register", "selfregister", 0, 0);
	@@ -1270,29 +1282,30 @@
1270	@ <p>Allow users to register themselves through the HTTP UI.
1271	@ The registration form always requires filling in a CAPTCHA
1272	@ (<em>auto-captcha</em> setting is ignored). Still, bear in mind that anyone
1273	@ can register under any user name. This option is useful for public projects
1274	@ where you do not want everyone in any ticket discussion to be named
1275	@ "Anonymous".</p>
1276
1277	@ <hr />
1278	entry_attribute("Default privileges", 10, "default-perms",
1279	"defaultperms", "u", 0);
1280	@ <p>Permissions given to users that... <ul><li>register themselves using
1281	@ the self-registration procedure (if enabled), or <li>access "public"
1282	@ pages identified by the public-pages glob pattern above, or <li>
1283	@ are users newly created by the administrator.</ul>

1284	@ </p>
1285
1286	@ <hr />
1287	onoff_attribute("Show javascript button to fill in CAPTCHA",
1288	"auto-captcha", "autocaptcha", 0, 0);
1289	@ <p>When enabled, a button appears on the login screen for user
1290	@ "anonymous" that will automatically fill in the CAPTCHA password.
1291	@ This is less secure than forcing the user to do it manually, but is
1292	@ probably secure enough and it is certainly more convenient for
1293	@ anonymous users.</p>
1294
1295	@ <hr />
1296	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1297	@ </div></form>
1298	db_end_transaction(0);
	@@ -1440,28 +1453,31 @@
1440	style_header("Timeline Display Preferences");
1441	db_begin_transaction();
1442	@ <form action="%s(g.zTop)/setup_timeline" method="post"><div>
1443	login_insert_csrf_secret();
1444

1445	@ <hr />
1446	onoff_attribute("Allow block-markup in timeline",
1447	"timeline-block-markup", "tbm", 0, 0);
1448	@ <p>In timeline displays, check-in comments can be displayed with or
1449	@ without block markup (paragraphs, tables, etc.)</p>

1450
1451	@ <hr />
1452	onoff_attribute("Plaintext comments on timelines",
1453	"timeline-plaintext", "tpt", 0, 0);
1454	@ <p>In timeline displays, check-in comments are displayed literally,
1455	@ without any wiki or HTML interpretation. (Note: Use CSS to change
1456	@ display formatting features such as fonts and line-wrapping behavior.)</p>

1457
1458	@ <hr />
1459	onoff_attribute("Truncate comment at first blank line",
1460	"timeline-truncate-at-blank", "ttb", 0, 0);
1461	@ <p>In timeline displays, check-in comments are displayed only through
1462	@ the first blank line.</p>
1463
1464	@ <hr />
1465	onoff_attribute("Use Universal Coordinated Time (UTC)",
1466	"timeline-utc", "utc", 1, 0);
1467	@ <p>Show times as UTC (also sometimes called Greenwich Mean Time (GMT) or
	@@ -1478,32 +1494,35 @@
1478	sqlite3_snprintf(sizeof(zTmDiff), zTmDiff, "%.1f", -tmDiff);
1479	@ %s(zTmDiff) hours behind UTC.</p>
1480	}else{
1481	@ %s(zTmDiff) hours ahead of UTC.</p>
1482	}
1483
1484	@ <hr />
1485	multiple_choice_attribute("Per-Item Time Format", "timeline-date-format",
1486	"tdf", "0", count(azTimeFormats)/2, azTimeFormats);
1487	@ <p>If the "HH:MM" or "HH:MM:SS" format is selected, then the date is shown
1488	@ in a separate box (using CSS class "timelineDate") whenever the date changes.
1489	@ With the "YYYY-MM-DD HH:MM" and "YYMMDD ..." formats, the complete date
1490	@ and time is shown on every timeline entry (using the CSS class "timelineTime").</p>

1491
1492	@ <hr />
1493	onoff_attribute("Show version differences by default",
1494	"show-version-diffs", "vdiff", 0, 0);
1495	@ <p>The version-information pages linked from the timeline can either
1496	@ show complete diffs of all file changes, or can just list the names of
1497	@ the files that have changed. Users can get to either page by
1498	@ clicking. This setting selects the default.</p>

1499
1500	@ <hr />
1501	entry_attribute("Max timeline comment length", 6,
1502	"timeline-max-comment", "tmc", "0", 0);
1503	@ <p>The maximum length of a comment to be displayed in a timeline.
1504	@ "0" there is no length limit.</p>

1505
1506	@ <hr />
1507	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1508	@ </div></form>
1509	db_end_transaction(0);
	@@ -1609,33 +1628,38 @@
1609
1610	style_header("WWW Configuration");
1611	db_begin_transaction();
1612	@ <form action="%s(g.zTop)/setup_config" method="post"><div>
1613	login_insert_csrf_secret();

1614	@ <hr />
1615	entry_attribute("Project Name", 60, "project-name", "pn", "", 0);
1616	@ <p>Give your project a name so visitors know what this site is about.
1617	@ The project name will also be used as the RSS feed title.

1618	@ </p>
1619	@ <hr />
1620	textarea_attribute("Project Description", 3, 80,
1621	"project-description", "pd", "", 0);
1622	@ <p>Describe your project. This will be used in page headers for search
1623	@ engines as well as a short RSS description.</p>

1624	@ <hr />
1625	entry_attribute("Tarball and ZIP-archive Prefix", 20, "short-project-name", "spn", "", 0);
1626	@ <p>This is used as a prefix on the names of generated tarballs and ZIP archive.
1627	@ For best results, keep this prefix brief and avoid special characters such
1628	@ as "/" and "\".
1629	@ If no tarball prefix is specified, then the full Project Name above is used.

1630	@ </p>
1631	@ <hr />
1632	onoff_attribute("Enable WYSIWYG Wiki Editing",
1633	"wysiwyg-wiki", "wysiwyg-wiki", 0, 0);
1634	@ <p>Enable what-you-see-is-what-you-get (WYSIWYG) editing of wiki pages.
1635	@ The WYSIWYG editor generates HTML instead of markup, which makes
1636	@ subsequent manual editing more difficult.</p>

1637	@ <hr />
1638	entry_attribute("Index Page", 60, "index-page", "idxpg", "/home", 0);
1639	@ <p>Enter the pathname of the page to display when the "Home" menu
1640	@ option is selected and when no pathname is
1641	@ specified in the URL. For example, if you visit the url:</p>
	@@ -1653,10 +1677,11 @@
1653	@
1654	@ <p>Note: To avoid a redirect loop or other problems, this entry must
1655	@ begin with "/" and it must specify a valid page. For example,
1656	@ "<b>/home</b>" will work but "<b>home</b>" will not, since it omits the
1657	@ leading "/".</p>

1658	@ <hr />
1659	onoff_attribute("Use HTML as wiki markup language",
1660	"wiki-use-html", "wiki-use-html", 0, 0);
1661	@ <p>Use HTML as the wiki markup language. Wiki links will still be parsed
1662	@ but all other wiki formatting will be ignored. This option is helpful
	@@ -1667,10 +1692,11 @@
1667	@ No sanitization is done. This means that it is very possible for malicious
1668	@ users to inject dangerous HTML, CSS and JavaScript code into your wiki.</p>
1669	@ <p>This should <strong>only</strong> be enabled when wiki editing is limited
1670	@ to trusted users. It should <strong>not</strong> be used on a publically
1671	@ editable wiki.</p>

1672	@ <hr />
1673	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1674	@ </div></form>
1675	db_end_transaction(0);
1676	style_footer();
	@@ -1699,11 +1725,11 @@
1699	@ by a ticket moderator - a user with the "q" or Mod-Tkt privilege.
1700	@ Ticket changes enter the system and are shown locally, but are not
1701	@ synced until they are approved. The moderator has the option to
1702	@ delete the change rather than approve it. Ticket changes made by
1703	@ a user who has the Mod-Tkt privilege are never subject to
1704	@ moderation.
1705	@
1706	@ <hr />
1707	onoff_attribute("Moderate wiki changes",
1708	"modreq-wiki", "modreq-wiki", 0, 0);
1709	@ <p>When enabled, any change to wiki is subject to the approval
	@@ -1710,11 +1736,11 @@
1710	@ by a wiki moderator - a user with the "l" or Mod-Wiki privilege.
1711	@ Wiki changes enter the system and are shown locally, but are not
1712	@ synced until they are approved. The moderator has the option to
1713	@ delete the change rather than approve it. Wiki changes made by
1714	@ a user who has the Mod-Wiki privilege are never subject to
1715	@ moderation.
1716	@ </p>
1717
1718	@ <hr />
1719	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1720	@ </div></form>
	@@ -1763,10 +1789,12 @@
1763	@ <b>Ad-Unit Notes:</b><ul>
1764	@ <li>Leave both Ad-Units blank to disable all advertising.
1765	@ <li>The "Banner Ad-Unit" is used for wide pages.
1766	@ <li>The "Right-Column Ad-Unit" is used on pages with tall, narrow content.
1767	@ <li>If the "Right-Column Ad-Unit" is blank, the "Banner Ad-Unit" is used on all pages.


1768	@ <li>Suggested <a href="setup_skinedit?w=0">CSS</a> changes:
1769	@ <blockquote><pre>
1770	@ div.adunit_banner {
1771	@ margin: auto;
1772	@ width: 100%%;
	@@ -1888,10 +1916,11 @@
1888	@ Logo Image file:
1889	@ <input type="file" name="logoim" size="60" accept="image/*" />
1890	@ <p align="center">
1891	@ <input type="submit" name="setlogo" value="Change Logo" />
1892	@ <input type="submit" name="clrlogo" value="Revert To Default" /></p>

1893	@ </div></form>
1894	@ <hr />
1895	@
1896	@ <p>The current background image has a MIME-Type of <b>%h(zBgMime)</b>
1897	@ and looks like this:</p>
	@@ -1911,10 +1940,11 @@
1911	@ <input type="file" name="bgim" size="60" accept="image/*" />
1912	@ <p align="center">
1913	@ <input type="submit" name="setbg" value="Change Background" />
1914	@ <input type="submit" name="clrbg" value="Revert To Default" /></p>
1915	@ </div></form>

1916	@ <hr />
1917	@
1918	@ <p><span class="note">Note:</span> Your browser has probably cached these
1919	@ images, so you may need to press the Reload button before changes will
1920	@ take effect. </p>
1921

	--- src/setup.c
	+++ src/setup.c
	@@ -1106,18 +1106,20 @@
1106
1107	style_header("Access Control Settings");
1108	db_begin_transaction();
1109	@ <form action="%s(g.zTop)/setup_access" method="post"><div>
1110	login_insert_csrf_secret();
1111	@ <input type="submit" name="submit" value="Apply Changes" /></p>
1112	@ <hr />
1113	onoff_attribute("Redirect to HTTPS on the Login page",
1114	"redirect-to-https", "redirhttps", 0, 0);
1115	@ <p>When selected, force the use of HTTPS for the Login page.
1116	@ <p>Details: When enabled, this option causes the $secureurl TH1
1117	@ variable is set to an "https:" variant of $baseurl. Otherwise,
1118	@ $secureurl is just an alias for $baseurl. Also when enabled, the
1119	@ Login page redirects to https if accessed via http.
1120	@ (Property: "redirhttps")
1121	@ <hr />
1122	onoff_attribute("Require password for local access",
1123	"localauth", "localauth", 0, 0);
1124	@ <p>When enabled, the password sign-in is always required for
1125	@ web access. When disabled, unrestricted web access from 127.0.0.1
	@@ -1138,67 +1140,74 @@
1140	@ <a href="%R/help/server">fossil http</a> commands
1141	@ without the "--localauth" option.
1142	@ <li> The server is started from CGI without the "localauth" keyword
1143	@ in the CGI script.
1144	@ </ol>
1145	@ (Property: "localauth")
1146	@
1147	@ <hr />
1148	onoff_attribute("Enable /test_env",
1149	"test_env_enable", "test_env_enable", 0, 0);
1150	@ <p>When enabled, the %h(g.zBaseURL)/test_env URL is available to all
1151	@ users. When disabled (the default) only users Admin and Setup can visit
1152	@ the /test_env page.
1153	@ (Property: "test_env_enable")
1154	@ </p>
1155	@
1156	@ <hr />
1157	onoff_attribute("Allow REMOTE_USER authentication",
1158	"remote_user_ok", "remote_user_ok", 0, 0);
1159	@ <p>When enabled, if the REMOTE_USER environment variable is set to the
1160	@ login name of a valid user and no other login credentials are available,
1161	@ then the REMOTE_USER is accepted as an authenticated user.
1162	@ (Property: "remote_user_ok")
1163	@ </p>
1164	@
1165	@ <hr />
1166	onoff_attribute("Allow HTTP_AUTHENTICATION authentication",
1167	"http_authentication_ok", "http_authentication_ok", 0, 0);
1168	@ <p>When enabled, allow the use of the HTTP_AUTHENTICATION environment
1169	@ variable or the "Authentication:" HTTP header to find the username and
1170	@ password. This is another way of supporting Basic Authenitication.
1171	@ (Property: "http_authentication_ok")
1172	@ </p>
1173	@
1174	@ <hr />
1175	entry_attribute("IP address terms used in login cookie", 3,
1176	"ip-prefix-terms", "ipt", "2", 0);
1177	@ <p>The number of octets of of the IP address used in the login cookie.
1178	@ Set to zero to omit the IP address from the login cookie. A value of
1179	@ 2 is recommended.
1180	@ (Property: "ip-prefix-terms")
1181	@ </p>
1182	@
1183	@ <hr />
1184	entry_attribute("Login expiration time", 6, "cookie-expire", "cex",
1185	"8766", 0);
1186	@ <p>The number of hours for which a login is valid. This must be a
1187	@ positive number. The default is 8766 hours which is approximately equal
1188	@ to a year.
1189	@ (Property: "cookie-expire")</p>
1190
1191	@ <hr />
1192	entry_attribute("Download packet limit", 10, "max-download", "mxdwn",
1193	"5000000", 0);
1194	@ <p>Fossil tries to limit out-bound sync, clone, and pull packets
1195	@ to this many bytes, uncompressed. If the client requires more data
1196	@ than this, then the client will issue multiple HTTP requests.
1197	@ Values below 1 million are not recommended. 5 million is a
1198	@ reasonable number. (Property: "max-download")</p>
1199
1200	@ <hr />
1201	entry_attribute("Download time limit", 11, "max-download-time", "mxdwnt",
1202	"30", 0);
1203
1204	@ <p>Fossil tries to spend less than this many seconds gathering
1205	@ the out-bound data of sync, clone, and pull packets.
1206	@ If the client request takes longer, a partial reply is given similar
1207	@ to the download packet limit. 30s is a reasonable default.
1208	@ (Property: "max-download-time")</p>
1209
1210	@ <hr />
1211	entry_attribute("Server Load Average Limit", 11, "max-loadavg", "mxldavg",
1212	"0.0", 0);
1213	@ <p>Some expensive operations (such as computing tarballs, zip archives,
	@@ -1205,11 +1214,12 @@
1214	@ or annotation/blame pages) are prohibited if the load average on the host
1215	@ computer is too large. Set the threshold for disallowing expensive
1216	@ computations here. Set this to 0.0 to disable the load average limit.
1217	@ This limit is only enforced on Unix servers. On Linux systems,
1218	@ access to the /proc virtual filesystem is required, which means this limit
1219	@ might not work inside a chroot() jail.
1220	@ (Property: "max-loadavg")</p>
1221
1222	@ <hr />
1223	onoff_attribute(
1224	"Enable hyperlinks for \"nobody\" based on User-Agent and Javascript",
1225	"auto-hyperlink", "autohyperlink", 1, 0);
	@@ -1219,41 +1229,42 @@
1229	@ being and not a robot or spider and (2) the user agent is able to
1230	@ run Javascript in order to set the href= attribute of hyperlinks. Bots
1231	@ and spiders can forge a User-Agent string that makes them seem to be a
1232	@ normal browser and they can run javascript just like browsers. But most
1233	@ bots do not go to that much trouble so this is normally an effective
1234	@ defense.<p>
1235	@
1236	@ <p>You do not normally want a bot to walk your entire repository because
1237	@ if it does, your server will end up computing diffs and annotations for
1238	@ every historical version of every file and creating ZIPs and tarballs of
1239	@ every historical check-in, which can use a lot of CPU and bandwidth
1240	@ even for relatively small projects.</p>
1241	@
1242	@ <p>Additional parameters that control this behavior:</p>
1243	@ <blockquote>
1244	onoff_attribute("Enable hyperlinks for humans as deduced from the UserAgent "
1245	"string", "auto-hyperlink-ishuman", "ahis", 0, 0);

1246	@ <br />
1247	onoff_attribute("Require mouse movement before enabling hyperlinks",
1248	"auto-hyperlink-mouseover", "ahmo", 0, 0);
1249	@ <br />
1250	entry_attribute("Delay in milliseconds before enabling hyperlinks", 5,
1251	"auto-hyperlink-delay", "ah-delay", "10", 0);
1252	@ </blockquote>
1253	@ <p>Hyperlinks for user "nobody" are normally enabled as soon as the page
1254	@ finishes loading. But the first check-box below can be set to require mouse
1255	@ movement before enabling the links. One can also set a delay prior to enabling
1256	@ links by enter a positive number of milliseconds in the entry box above.</p>
1257	@ (Properties: "auto-hyperlink", "auto-hyperlink-ishuman",
1258	@ "auto-hyperlink-mouseover", and "auto-hyperlink-delay")</p>
1259
1260	@ <hr />
1261	onoff_attribute("Require a CAPTCHA if not logged in",
1262	"require-captcha", "reqcapt", 1, 0);
1263	@ <p>Require a CAPTCHA for edit operations (appending, creating, or
1264	@ editing wiki or tickets or adding attachments to wiki or tickets)
1265	@ for users who are not logged in. (Property: "require-captcha")</p>
1266
1267	@ <hr />
1268	entry_attribute("Public pages", 30, "public-pages",
1269	"pubpage", "", 0);
1270	@ <p>A comma-separated list of glob patterns for pages that are accessible
	@@ -1260,10 +1271,11 @@
1271	@ without needing a login and using the privileges given by the
1272	@ "Default privileges" setting below. Example use case: Set this field
1273	@ to "/doc/trunk/www/*" to give anonymous users read-only permission to the
1274	@ latest version of the embedded documentation in the www/ folder without
1275	@ allowing them to see the rest of the source code.
1276	@ (Property: "public-pages")
1277	@ </p>
1278
1279	@ <hr />
1280	onoff_attribute("Allow users to register themselves",
1281	"self-register", "selfregister", 0, 0);
	@@ -1270,29 +1282,30 @@
1282	@ <p>Allow users to register themselves through the HTTP UI.
1283	@ The registration form always requires filling in a CAPTCHA
1284	@ (<em>auto-captcha</em> setting is ignored). Still, bear in mind that anyone
1285	@ can register under any user name. This option is useful for public projects
1286	@ where you do not want everyone in any ticket discussion to be named
1287	@ "Anonymous". (Property: "self-register")</p>
1288
1289	@ <hr />
1290	entry_attribute("Default privileges", 10, "default-perms",
1291	"defaultperms", "u", 0);
1292	@ <p>Permissions given to users that... <ul><li>register themselves using
1293	@ the self-registration procedure (if enabled), or <li>access "public"
1294	@ pages identified by the public-pages glob pattern above, or <li>
1295	@ are users newly created by the administrator.</ul>
1296	@ (Property: "default-perms")
1297	@ </p>
1298
1299	@ <hr />
1300	onoff_attribute("Show javascript button to fill in CAPTCHA",
1301	"auto-captcha", "autocaptcha", 0, 0);
1302	@ <p>When enabled, a button appears on the login screen for user
1303	@ "anonymous" that will automatically fill in the CAPTCHA password.
1304	@ This is less secure than forcing the user to do it manually, but is
1305	@ probably secure enough and it is certainly more convenient for
1306	@ anonymous users. (Property: "auto-captcha")</p>
1307
1308	@ <hr />
1309	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1310	@ </div></form>
1311	db_end_transaction(0);
	@@ -1440,28 +1453,31 @@
1453	style_header("Timeline Display Preferences");
1454	db_begin_transaction();
1455	@ <form action="%s(g.zTop)/setup_timeline" method="post"><div>
1456	login_insert_csrf_secret();
1457
1458	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1459	@ <hr />
1460	onoff_attribute("Allow block-markup in timeline",
1461	"timeline-block-markup", "tbm", 0, 0);
1462	@ <p>In timeline displays, check-in comments can be displayed with or
1463	@ without block markup such as paragraphs, tables, etc.
1464	@ (Property: "timeline-block-markup")</p>
1465
1466	@ <hr />
1467	onoff_attribute("Plaintext comments on timelines",
1468	"timeline-plaintext", "tpt", 0, 0);
1469	@ <p>In timeline displays, check-in comments are displayed literally,
1470	@ without any wiki or HTML interpretation. Use CSS to change
1471	@ display formatting features such as fonts and line-wrapping behavior.
1472	@ (Property: "timeline-plaintext")</p>
1473
1474	@ <hr />
1475	onoff_attribute("Truncate comment at first blank line",
1476	"timeline-truncate-at-blank", "ttb", 0, 0);
1477	@ <p>In timeline displays, check-in comments are displayed only through
1478	@ the first blank line. (Property: "timeline-truncate-at-blank")</p>
1479
1480	@ <hr />
1481	onoff_attribute("Use Universal Coordinated Time (UTC)",
1482	"timeline-utc", "utc", 1, 0);
1483	@ <p>Show times as UTC (also sometimes called Greenwich Mean Time (GMT) or
	@@ -1478,32 +1494,35 @@
1494	sqlite3_snprintf(sizeof(zTmDiff), zTmDiff, "%.1f", -tmDiff);
1495	@ %s(zTmDiff) hours behind UTC.</p>
1496	}else{
1497	@ %s(zTmDiff) hours ahead of UTC.</p>
1498	}
1499	@ <p>(Property: "timeline-utc")
1500	@ <hr />
1501	multiple_choice_attribute("Per-Item Time Format", "timeline-date-format",
1502	"tdf", "0", count(azTimeFormats)/2, azTimeFormats);
1503	@ <p>If the "HH:MM" or "HH:MM:SS" format is selected, then the date is shown
1504	@ in a separate box (using CSS class "timelineDate") whenever the date changes.
1505	@ With the "YYYY-MM-DD HH:MM" and "YYMMDD ..." formats, the complete date
1506	@ and time is shown on every timeline entry using the CSS class "timelineTime".
1507	@ (Preperty: "timeline-date-format")</p>
1508
1509	@ <hr />
1510	onoff_attribute("Show version differences by default",
1511	"show-version-diffs", "vdiff", 0, 0);
1512	@ <p>The version-information pages linked from the timeline can either
1513	@ show complete diffs of all file changes, or can just list the names of
1514	@ the files that have changed. Users can get to either page by
1515	@ clicking. This setting selects the default.
1516	@ (Property: "show-version-diffs")</p>
1517
1518	@ <hr />
1519	entry_attribute("Max timeline comment length", 6,
1520	"timeline-max-comment", "tmc", "0", 0);
1521	@ <p>The maximum length of a comment to be displayed in a timeline.
1522	@ "0" there is no length limit.
1523	@ (Property: "timeline-max-comment")</p>
1524
1525	@ <hr />
1526	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1527	@ </div></form>
1528	db_end_transaction(0);
	@@ -1609,33 +1628,38 @@
1628
1629	style_header("WWW Configuration");
1630	db_begin_transaction();
1631	@ <form action="%s(g.zTop)/setup_config" method="post"><div>
1632	login_insert_csrf_secret();
1633	@ <input type="submit" name="submit" value="Apply Changes" /></p>
1634	@ <hr />
1635	entry_attribute("Project Name", 60, "project-name", "pn", "", 0);
1636	@ <p>A brief project name so visitors know what this site is about.
1637	@ The project name will also be used as the RSS feed title.
1638	@ (Property: "project-name")
1639	@ </p>
1640	@ <hr />
1641	textarea_attribute("Project Description", 3, 80,
1642	"project-description", "pd", "", 0);
1643	@ <p>Describe your project. This will be used in page headers for search
1644	@ engines as well as a short RSS description.
1645	@ (Property: "project-description")</p>
1646	@ <hr />
1647	entry_attribute("Tarball and ZIP-archive Prefix", 20, "short-project-name", "spn", "", 0);
1648	@ <p>This is used as a prefix on the names of generated tarballs and ZIP archive.
1649	@ For best results, keep this prefix brief and avoid special characters such
1650	@ as "/" and "\".
1651	@ If no tarball prefix is specified, then the full Project Name above is used.
1652	@ (Property: "short-project-name")
1653	@ </p>
1654	@ <hr />
1655	onoff_attribute("Enable WYSIWYG Wiki Editing",
1656	"wysiwyg-wiki", "wysiwyg-wiki", 0, 0);
1657	@ <p>Enable what-you-see-is-what-you-get (WYSIWYG) editing of wiki pages.
1658	@ The WYSIWYG editor generates HTML instead of markup, which makes
1659	@ subsequent manual editing more difficult.
1660	@ (Property: "wysiwyg-wiki")</p>
1661	@ <hr />
1662	entry_attribute("Index Page", 60, "index-page", "idxpg", "/home", 0);
1663	@ <p>Enter the pathname of the page to display when the "Home" menu
1664	@ option is selected and when no pathname is
1665	@ specified in the URL. For example, if you visit the url:</p>
	@@ -1653,10 +1677,11 @@
1677	@
1678	@ <p>Note: To avoid a redirect loop or other problems, this entry must
1679	@ begin with "/" and it must specify a valid page. For example,
1680	@ "<b>/home</b>" will work but "<b>home</b>" will not, since it omits the
1681	@ leading "/".</p>
1682	@ <p>(Property: "index-page")
1683	@ <hr />
1684	onoff_attribute("Use HTML as wiki markup language",
1685	"wiki-use-html", "wiki-use-html", 0, 0);
1686	@ <p>Use HTML as the wiki markup language. Wiki links will still be parsed
1687	@ but all other wiki formatting will be ignored. This option is helpful
	@@ -1667,10 +1692,11 @@
1692	@ No sanitization is done. This means that it is very possible for malicious
1693	@ users to inject dangerous HTML, CSS and JavaScript code into your wiki.</p>
1694	@ <p>This should <strong>only</strong> be enabled when wiki editing is limited
1695	@ to trusted users. It should <strong>not</strong> be used on a publically
1696	@ editable wiki.</p>
1697	@ (Property: "wiki-use-html")
1698	@ <hr />
1699	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1700	@ </div></form>
1701	db_end_transaction(0);
1702	style_footer();
	@@ -1699,11 +1725,11 @@
1725	@ by a ticket moderator - a user with the "q" or Mod-Tkt privilege.
1726	@ Ticket changes enter the system and are shown locally, but are not
1727	@ synced until they are approved. The moderator has the option to
1728	@ delete the change rather than approve it. Ticket changes made by
1729	@ a user who has the Mod-Tkt privilege are never subject to
1730	@ moderation. (Property: "modreq-tkt")
1731	@
1732	@ <hr />
1733	onoff_attribute("Moderate wiki changes",
1734	"modreq-wiki", "modreq-wiki", 0, 0);
1735	@ <p>When enabled, any change to wiki is subject to the approval
	@@ -1710,11 +1736,11 @@
1736	@ by a wiki moderator - a user with the "l" or Mod-Wiki privilege.
1737	@ Wiki changes enter the system and are shown locally, but are not
1738	@ synced until they are approved. The moderator has the option to
1739	@ delete the change rather than approve it. Wiki changes made by
1740	@ a user who has the Mod-Wiki privilege are never subject to
1741	@ moderation. (Property: "modreq-wiki")
1742	@ </p>
1743
1744	@ <hr />
1745	@ <p><input type="submit" name="submit" value="Apply Changes" /></p>
1746	@ </div></form>
	@@ -1763,10 +1789,12 @@
1789	@ <b>Ad-Unit Notes:</b><ul>
1790	@ <li>Leave both Ad-Units blank to disable all advertising.
1791	@ <li>The "Banner Ad-Unit" is used for wide pages.
1792	@ <li>The "Right-Column Ad-Unit" is used on pages with tall, narrow content.
1793	@ <li>If the "Right-Column Ad-Unit" is blank, the "Banner Ad-Unit" is used on all pages.
1794	@ <li>Properties: "adunit", "adunit-right", "adunit-omit-if-admin", and
1795	@ "adunit-omit-if-user".
1796	@ <li>Suggested <a href="setup_skinedit?w=0">CSS</a> changes:
1797	@ <blockquote><pre>
1798	@ div.adunit_banner {
1799	@ margin: auto;
1800	@ width: 100%%;
	@@ -1888,10 +1916,11 @@
1916	@ Logo Image file:
1917	@ <input type="file" name="logoim" size="60" accept="image/*" />
1918	@ <p align="center">
1919	@ <input type="submit" name="setlogo" value="Change Logo" />
1920	@ <input type="submit" name="clrlogo" value="Revert To Default" /></p>
1921	@ <p>(Properties: "logo-image" and "logo-mimetype")
1922	@ </div></form>
1923	@ <hr />
1924	@
1925	@ <p>The current background image has a MIME-Type of <b>%h(zBgMime)</b>
1926	@ and looks like this:</p>
	@@ -1911,10 +1940,11 @@
1940	@ <input type="file" name="bgim" size="60" accept="image/*" />
1941	@ <p align="center">
1942	@ <input type="submit" name="setbg" value="Change Background" />
1943	@ <input type="submit" name="clrbg" value="Revert To Default" /></p>
1944	@ </div></form>
1945	@ <p>(Properties: "background-image" and "background-mimetype")
1946	@ <hr />
1947	@
1948	@ <p><span class="note">Note:</span> Your browser has probably cached these
1949	@ images, so you may need to press the Reload button before changes will
1950	@ take effect. </p>
1951

Fossil SCM

Keyboard Shortcuts