[](https://opencollective.com/wikijs)
[](https://blog.js.wiki/subscribe)
[](https://wiki.requarks.io/slack)
[](https://twitter.com/requarks)
[](https://t.me/wiki_js)
[](https://discord.gg/rcxt9QS2jd)
[](https://bsky.app/profile/js.wiki)
[](https://t.me/wiki_js)
@ -13,15 +13,10 @@ If you find such vulnerability, it's important to disclose it in a quick and sec
## Reporting a Vulnerability
**DO NOT CREATE AN ISSUE ON GITHUB** to report a potential vulnerability / security problem. Instead, choose one of these options:
> [!CAUTION]
> **DO NOT CREATE A GITHUB ISSUE / DISCUSSION** to report a potential vulnerability / security problem. Instead, use the process below:
### A) Disclose on Huntr.dev
Disclose the vulnerability on [Huntr.dev](https://huntr.dev/bounties/disclose) for the repository `https://github.com/Requarks/wiki`.
### B) Send an email
Send an email to security@requarks.io.
Submit a Vulnerability Report by filling in the form on https://github.com/requarks/wiki/security/advisories/new
Include as much details as possible, such as:
- The version(s) of Wiki.js that are impacted
@ -31,3 +26,6 @@ Include as much details as possible, such as:
- Your GitHub username if you'd like to be included as a collaborator on the private fix branch
The vulnerability will be investigated ASAP. If deemed valid, a draft security advisory will be created on GitHub and you will be included as a collaborator. A fix will be worked on in a private branch to resolves the issue. Once a fix is available, the advisory will be published.
> [!NOTE]
> There's no reward for submitting a report. As this is open source project and not corporate owned, we are not able to provide monetary rewards. You will however be credited as the bug reporter in the release notes.
hint:'Can create or authorize new users, but not modify existing ones',
hint:'Can create or authorize new users, but not modify existing ones. Can only assign to non-administrative groups',
warning:false,
restrictedForSystem:true,
disabled:false
},
{
permission:'manage:users',
hint:'Can manage all users (but not users with administrative permissions)',
hint:'Can create, authorize and modify ANY users. Can only assign to non-administrative groups',
warning:false,
restrictedForSystem:true,
disabled:false
},
{
permission:'write:groups',
hint:'Can manage groups and assign CONTENT permissions / page rules',
hint:'Can manage groups and set CONTENT permissions / page rules. Can only assign users to non-administrative groups',
warning:false,
restrictedForSystem:true,
disabled:false
},
{
permission:'manage:groups',
hint:'Can manage groups and assign ANY permissions (but not manage:system) / page rules',
hint:'Can manage groups and set ANY permissions (but not manage:system) / page rules. Can assign users to ANY groups (except groups with the manage:system permission)',
warning:true,
restrictedForSystem:true,
disabled:false
@ -203,7 +203,7 @@ export default {
},
{
permission:'manage:system',
hint:'Can manage and access everything. Root administrator.',
hint:'Can manage and access everything. Root administrator',
@ -43,7 +43,7 @@ Wiki.js is an open source project that has been made possible due to the generou
This chart bootstraps a Wiki.js deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
It also optionally packages the [PostgreSQL](https://github.com/kubernetes/charts/tree/master/stable/postgresql) as the database but you are free to bring your own.
It also optionally deploys PostgreSQL as the database using the official PostgreSQL image from Docker Hub, but you are free to bring your own database.
> **Tip**: You can use the default [values.yaml](values.yaml)
## PostgresSQL
## PostgreSQL
By default, PostgreSQL is installed as part of the chart.
By default, PostgreSQL is installed as part of the chart using the official PostgreSQL image from Docker Hub (version 18).
### Using an external PostgreSQL server
To use an external PostgreSQL server, set `postgresql.enabled` to `false` and then set `postgresql.postgresqlHost` and `postgresql.postgresqlPassword`. To use an existing `Secret`, set `postgresql.existingSecret`. The other options (`postgresql.postgresqlDatabase`, `postgresql.postgresqlUser`, `postgresql.postgresqlPort` and `postgresql.existingSecretKey`) may also want changing from their default values.
To use an external PostgreSQL server, set `postgresql.enabled` to `false`, then use either:
To use an SSL connection you can set `postgresql.ssl` to `true` and if needed the path to a Certificate of Authority can be set using `postgresql.ca` to `/path/to/ca`. Default `postgresql.ssl` value is `false`.
#### Connection String
If `postgresql.existingSecret` is not specified, you also need to add the following Helm template to your deployment in order to create the postgresql `Secret`:
Set `externalPostgresql.databaseURL` to the full PostgreSQL connection string.
Set `externalPostgresql.host`, `externalPostgres.port`, `externalPostgres.database`, `externalPostgres.username`, `externalPostgres.existingSecret`*(secret name)* and `externalPostgres.existingSecretKey` *(key in the secret containing the password)*
Ensure the secret specified in `externalPostgresql.existingSecret` already exists, with a password set at the path specified in `externalPostgres.existingSecretKey`.
To use an SSL connection you can set `externalPostgresql.ssl` to `true` and if needed the path to a Certificate of Authority can be set using `externalPostgresql.ca` to `/path/to/ca`. Default `externalPostgresql.ssl` value is `false`.
### Using an existing PostgreSQL secret with built-in PostgreSQL
When using the built-in PostgreSQL (default behavior with `postgresql.enabled: true`), you can still use an existing Kubernetes secret for the database credentials by setting:
- `postgresql.existingSecret`: Name of the existing secret containing the credentials
- `postgresql.existingSecretKey`: Key in the secret containing the password (defaults to `postgresql-password`)
- `postgresql.existingSecretUserKey`: Key in the secret containing the username (defaults to `postgresql-username`)
@ -175,3 +211,38 @@ See the [Configuration](#configuration) section to configure the PVC or to disab
## Ingress
This chart provides support for Ingress resource. If you have an available Ingress Controller such as Nginx or Traefik you maybe want to set `ingress.enabled` to true and add `ingress.hosts` for the URL. Then, you should be able to access the installation using that address.
## Extra Trusted Certificates
To append extra CA Certificates:
1. Create a ConfigMap with CAs in PEM format, e.g.:
```yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: ca
namespace: your-wikijs-namespace
data:
certs.pem: |-
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
-----END CERTIFICATE-----
```
2. Mount your CAs from the ConfigMap to the Wiki.js pod and set `nodeExtraCaCerts` helm variable. Insert the following lines to your Wiki.js `values.yaml`, e.g.:
echo -en "Some critical tests failed. These items must be resolved and this scan re-run before you submit your image to the DigitalOcean Marketplace.\n\n"
WIKI.logger.warn(`GitHub OAuth: No email found in profile for user ${profile.id||profile.username}. Make sure 'user:email' scope is granted.`)
}
constuser=awaitWIKI.models.users.processProfile({
providerKey:req.params.strategy,
profile:{
@ -34,9 +42,19 @@ module.exports = {
picture:_.get(profile,'photos[0].value','')
}
})
WIKI.logger.info(`GitHub OAuth: Successfully authenticated user ${user.email}`)
cb(null,user)
}catch(err){
cb(err,null)
WIKI.logger.warn(`GitHub OAuth: Authentication failed for strategy ${req.params.strategy}:`,err)
// Provide more user-friendly error messages
if(err.message&&err.message.includes('email')){
cb(newError('GitHub authentication failed: Email address is required but not available. Please ensure your GitHub account has a verified email address and grant email access permissions.'),null)
cb(newError('Google authentication failed: Email address is required but not available. Please ensure your Google account has a verified email address.'),null)
Yunus Emre Alpu
21 hours ago