diff -r 2f530ad04f1b -r ccad6026a168 install.php
--- a/install.php Tue Jun 19 18:41:10 2007 -0400
+++ b/install.php Thu Jun 21 12:00:16 2007 -0400
@@ -12,7 +12,7 @@
* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for details.
*/
-//@include('config.php');
+@include('config.php');
if( ( defined('ENANO_INSTALLED') || defined('MIDGET_INSTALLED') ) && ((isset($_GET['mode']) && ($_GET['mode']!='finish' && $_GET['mode']!='css')) || !isset($_GET['mode']))) {
$_GET['title'] = 'Enano:WhoCaresWhatThisIs';
require('includes/common.php');
@@ -168,6 +168,61 @@
mysql_close($conn);
die('good');
break;
+ case 'pophelp':
+ $topic = ( isset($_GET['topic']) ) ? $_GET['topic'] : 'invalid';
+ switch($topic)
+ {
+ case 'admin_embed_php':
+ $title = 'Allow administrators to embed PHP';
+ $content = '
This option allows you to control whether anything between the standard <?php and ?> tags will be treated as
+ PHP code by Enano. If this option is enabled, and members of the Administrators group use these tags, Enano will
+ execute that code when the page is loaded. There are obvious potential security implications here, which should
+ be carefully considered before enabling this option.
+
If you are the only administrator of this site, or if you have a high level of trust for those will be administering
+ the site with you, you should enable this to allow extreme customization of pages.
+
Leave this option off if you are at all concerned about security – if your account is compromised and PHP embedding
+ is enabled, an attacker can run arbitrary code on your server! Enabling this will also allow administrators to
+ embed Javascript and arbitrary HTML and CSS.
+
If you don\'t have experience coding in PHP, you can safely disable this option. You may change this at any time
+ using the ACL editor by selecting the Administrators group and This Entire Website under the scope selection, or by
+ using the "embedded PHP kill switch" in the administration panel.
+ Allow administrative embedding of PHP:
+ Do not under any circumstances enable this option without reading these
+ important security implications.
+
+
+
+
+
+
+
+
If your browser supports Javascript, the password you enter here will be encrypted with AES before it is sent to the server.
