MoniWiki System Overview en

MoniWiki System Overview

This page describes the current MoniWiki runtime from source code. It is not a proposal.

Entry Points

• wiki.php is the primary web entry point. It loads config, creates WikiDB, initializes request/user state, handles session cookies, sets cache headers, and calls wiki_main($options).
• wikilib.php contains shared request actions and user helpers. Important examples are WikiUser, do_goto(), do_post_savepage(), ajax_savepage(), and do_post_DeleteFile().
• plugin/*.php files provide action, macro, and processor extensions. wiki.php discovers plugin names with getPlugin(), getProcessor(), and getFilter().
• lib/cache.text.php stores cached settings, page HTML, PI metadata, and dynamic macro metadata.

Runtime Layers

flowchart TD
    Request["HTTP request"] --> Bootstrap["wiki.php bootstrap"]
    Bootstrap --> Config["config.php + site config cache"]
    Config --> DBInfo["WikiDB"]
    DBInfo --> UserInit["init_requests(options)"]
    UserInit --> Session["session cookie check"]
    Session --> Headers["early cache/CORS headers"]
    Headers --> Main["wiki_main(options)"]
    Main --> Security["DBInfo->security"]
    Main --> Formatter["Formatter"]
    Formatter --> Page["WikiPage"]
    Main --> Plugins["plugin action/macro/processor"]

Loading

The central mutable context is $options. It starts as a small array in wiki.php, is populated by init_requests(), and then moves through wiki_main(), security checks, formatter rendering, and action handlers.

Extension Lookup

getPlugin(), getProcessor(), and getFilter() scan configured include paths and cache the discovered basename map. Action dispatch does not include arbitrary request paths directly; it resolves an action to a known plugin basename before include_once("plugin/$pn.php").

This means dynamic include risk should usually be reviewed at the resolver boundary and at configuration-controlled include paths, not only at individual action calls.

Current Security Boundary

The current request boundary is split across several places:

• init_requests() creates WikiUser from MONI_ID and populates $options['id'].
• _session_start() validates the additional MONIWIKI session cookie when PHP sessions are enabled.
• wiki_main() performs request parsing, blocklist checks, robot handling, read checks, and action authorization.
• Action handlers in wikilib.php and plugins perform action-specific checks such as writable(), protected admin password checks, upload validation, and save hash checks.

For future fixes, keep normalizing identity and request state before action authorization. Fixing individual plugins is still necessary for file or output sinks, but it should not be the first layer of defense.