Allow site config to be overridden by trusted users

Fixes #19

Author: edg2s

config.default.php

@@ -14,7 +14,14 @@
 		'key' => null,
 		'secret' => null,
 		// OAuth admins can delete any wiki
-		'admins' => []
+		'admins' => [],
+		// These users can override site configs. This is the same level of trust as V+2,
+		// as those users can also execute arbitrary code.
+		'configurers' => [],
+		// Same as above, but regexes e.g. / \(WMF\)$/
+		'configurersMatch' => [],
+		// Instructions to request 'configurers' user status, e.g. "File a request <a href=...>here</a>."
+		'configurersRequestHtml' => '',
 	],
 	// Conduit API key for bot cross-posting to Phabricator
 	'conduitApiKey' => null,

css/common.css

@@ -143,6 +143,14 @@ summary > .oo-ui-labelElement-label:not( .oo-ui-inline-help ) {
 	max-width: 10em;
 }
 
+.form-siteConfig .oo-ui-inputWidget-input {
+	font-family: monospace, monospace;
+}
+
+.form-siteConfig-message {
+	font-style: italic;
+}
+
 @media ( min-width: 721px ) {
 	.enableNotifications {
 		margin-left: 40%;

includes.php

@@ -12,6 +12,7 @@
 include 'config.default.php';
 if ( file_exists( 'config.php' ) ) {
 	include 'config.php';
+	// TODO: Make this recursive
 	$config = array_merge( $config, $localConfig );
 }
 
@@ -399,6 +400,27 @@ function can_delete( string $creator = null ): bool {
 	return ( $username && $username === $creator ) || can_admin();
 }
 
+function can_configure(): bool {
+	global $config, $user, $useOAuth;
+	if ( !$useOAuth ) {
+		// Unauthenticated site
+		return true;
+	}
+	$username = $user ? $user->username : null;
+	$admins = $config[ 'oauth' ][ 'admins' ];
+	$configurers = $config[ 'oauth' ][ 'configurers' ];
+	if ( $username && in_array( $username, $admins, true ) ) {
+		return true;
+	}
+	$configurersMatch = $config[ 'oauth' ][ 'configurersMatch' ];
+	foreach ( $configurersMatch as $pattern ) {
+		if ( preg_match( $pattern, $username ) ) {
+			return true;
+		}
+	}
+	return false;
+}
+
 function can_admin(): bool {
 	global $config, $user, $useOAuth;
 	if ( !$useOAuth ) {

index.php

@@ -139,6 +139,25 @@
 							'align' => 'left',
 						]
 					),
+					new OOUI\FieldLayout(
+						can_configure() ?
+							new OOUI\MultilineTextInputWidget( [
+								'classes' => [ 'form-siteConfig' ],
+								'name' => 'siteConfig',
+								'placeholder' => "e.g. \$wgSitename = 'Test wiki';",
+								'rows' => 3,
+							] ) :
+							new OOUI\LabelWidget( [
+								'classes' => [ 'form-siteConfig-message' ],
+								'label' => new OOUI\HtmlSnippet( 'Only approved users can modify site config. ' . $config['oauth']['configurersRequestHtml'] ),
+							] ),
+						[
+							'label' => 'Site config:',
+							'help' => new OOUI\HtmlSnippet( 'This config will be <strong>public</strong> on the wiki\'s main page.' ),
+							'helpInline' => true,
+							'align' => 'left',
+						]
+					),
 					new DetailsFieldLayout(
 						new OOUI\CheckboxMultiselectInputWidget( [
 							'classes' => [ 'form-repos' ],

new.php

@@ -21,6 +21,7 @@
 $patches = trim( $_POST['patches'] );
 $announce = !empty( $_POST['announce'] );
 $language = trim( $_POST['language'] );
+$siteConfig = can_configure() ? trim( $_POST['siteConfig'] ) : '';
 
 $namePath = substr( md5( $branch . $patches . time() ), 0, 10 );
 $server = detectProtocol() . '://' . $_SERVER['HTTP_HOST'];
@@ -301,6 +302,17 @@ function set_progress( float $pc, string $label ) {
 	$allowedRepos[] = 'mediawiki/extensions/MobileFrontendContentProvider';
 }
 
+if ( $siteConfig ) {
+	$mainPage .= "\n;Extra config\n";
+	$tag = 'pre';
+	$attrs = '';
+	if ( in_array( 'mediawiki/extensions/SyntaxHighlight_GeSHi', $allowedRepos ) ) {
+		$tag = 'syntaxhighlight';
+		$attrs = ' lang="php"';
+	}
+	$mainPage .= "<$tag$attrs style=\"margin-left: 1.6em\">\n$siteConfig\n</$tag>";
+}
+
 foreach ( array_keys( $repos ) as $repo ) {
 	// Unchecked the checkbox
 	if ( $repo !== 'mediawiki/core' && !in_array( $repo, $allowedRepos ) ) {
@@ -363,6 +375,7 @@ function set_progress( float $pc, string $label ) {
 		'SERVERPATH' => $serverPath,
 		'LANGUAGE' => $language,
 		'REPOSITORIES' => $reposString,
+		'SITECONFIG' => $siteConfig,
 	]
 );
 if ( $error ) {

new/install.sh

@@ -27,6 +27,9 @@ while IFS=' ' read -r repo dir; do
 	fi
 done <<< "$REPOSITORIES"
 
+# apply settings from install form
+echo "$SITECONFIG" >> $PATCHDEMO/wikis/$NAME/w/LocalSettings.php
+
 # create htaccess
 echo "RewriteEngine On
 # main rewrite rule