version=pmwiki-2.2.69 ordered=1 urlencoded=1
author=Petko
charset=UTF-8
csum=$FmtPV['$Var'] = $_REQUEST['Var']; # critically insecure
ctime=1135816487
description=Documentation for "variables" that are associated with pages. 
name=PmWiki.PageVariables
rev=94
targets=PmWiki.PageVariables,PmWiki.Variables,Cookbook.Functions,PmWiki.FmtPageName,PmWiki.IncludeOtherPages,PmWiki.PageTextVariables,PmWiki.PageListTemplates,PmWiki.MarkupExpressions,Site.PageNotFound,PmWiki.PageLists,PmWiki.ConditionalMarkup,Cookbook.MoreCustomPageVariables,PmWiki.MarkupMasterIndex,Category.PmWikiDeveloper
text=(:title Page specific variables:)%0a(:description Documentation for "variables" that are associated with pages. :)%0a(:Summary: variables that are associated with pages:)%0a(:Audience: authors (intermediate) :)%0a%0a[[#desc]]This page describes the "variables" that are associated with pages.  Page variables have the form @@{$''variable''}@@, and can be used in page markup or in certain formatting strings in PmWiki.  For example, the markup "[@{$Group}@]" renders in this page as "{$Group}".%0a%0aNote: Do not confuse these variables (set and used only in PmWiki pages) with [[PmWiki/Variables|PHP variables]].  Page variables can be read in PHP with the [[Cookbook:Functions#PageVar|PageVar()]] function.%0a%0aNote that these variables do not necessarily exist in the PHP code, because they have to be determined for a specific page.  (However, they are usable in [[FmtPageName]] strings.)%0a%0aThere is also the form @@{''pagename''$''variable''}@@, which returns the value of the variable for another page.  For example, "[@{MarkupMasterIndex$Title}@]" displays as "{MarkupMasterIndex$Title}".%0a%0a[[#specialreferences]]%0a!! Special references%0aSpecial referenced variables are used to specify the context of the [[variable(s)]] when:%0a* the variable is [[PmWiki/IncludeOtherPages|included]] into a destination (target) page%0a* the variable is used in a sidebar, header, or footer%0a%0aPrefixing the variable name with an asterisk (*) means the variable's value is related to the target page or main (body) page.%0a%0a* @@{'''[@*$@]'''PageVariablename}@@ - prefixed by an asterisk (*) - value reflects target page context%0aWithout the asterisk the variable's value is that in the page from which it originates, eg source page of include, sidebar, or header or footer.%0a* @@{'''[@$@]'''PageVariablename}@@ -  retains value in source page context%0a-%3c See also $EnableRelativePageVars.%0a-%3c Special references are also used in [[page text variables(#specialreferences)]] and [[page list templates(#specialreferences)]].%0a%0aFor example you can test to see if the page is part of another page%0a(:markup:)%0a(:if ! name {$FullName}:) %0a%25comment%25 name of this page is not the same as the page this text was sourced from%0a->[[{$FullName}#anchor | more ...]]%0a(:ifend:)%0a(:markupend:)%0aor refer to the main page in a sidebar, footer, or header%0a(:markup class=horiz:)%0aThis page is [[{*$FullName}]]%0a(:markupend:)%0a%0a[[#specialreferencesend]]%0a%0a!! Default page variables%0a%0aThe page variables defined for PmWiki are:%0a%0a->[@{$Action}@] - page's url action argument, as in "{$Action}"%0a->[@{$BaseName}@] - page's "base" form (stripping any prefixes or suffixes defined via @@$BaseNamePatterns@@) as in "`{$BaseName}"%0a->[@{$DefaultGroup}@] - default group name, as in "{$DefaultGroup}"%0a->[@{$DefaultName}@] - name of default page, as in "`{$DefaultName}"%0a->[@{$Description}@] - page's description from the [@(:description:)@] markup, as in "{$Description}"%0a->[@{$FullName}@] - page's full name, as in "`{$FullName}"%0a->[@{$Group}@] - page's group name, as in "`{$Group}"%0a->[@{$Groupspaced}@] - spaced group name, as in "{$Groupspaced}"%0a%0a->[@{$LastModified}@] - date page was edited, as in "{$LastModified}"%0a->[@{$LastModifiedBy}@] - page's last editor, as in "{$LastModifiedBy}"%0a->[@{$LastModifiedHost}@] - IP of page's last editor, as in "{$LastModifiedHost}"%0a->[@{$LastModifiedSummary}@] - Summary from last edit, as in "{$LastModifiedSummary}"%0a->[@{$LastModifiedTime}@] - time page was edited in unix-style timestamp, as in "{$LastModifiedTime}"%0a-->This can be used (preceded by '@') in [[PmWiki.MarkupExpressions#ftime|[@{(ftime)}@]]] and other date/time markups.%0a%0a->[@{$Name}@] - page name, as in "`{$Name}"%0a->[@{$Namespaced}@] - spaced page name, as in "{$Namespaced}"%0a->[@{$PageUrl}@] - page's url, as in "{$PageUrl}"%0a->[@{$PasswdRead}@] - "read" permissions for the page e.g. "{$PasswdRead}"%0a->[@{$PasswdEdit}@] - "edit" permissions for the page e.g. "{$PasswdEdit}"%0a->[@{$PasswdAttr}@] - "attr" permissions for the page e.g. "{$PasswdAttr}"%0a->[@{$RequestedPage}@] - page requested in URL, used on [[Site.PageNotFound]]. e.g. "{$RequestedPage}"%0a->[@{$SiteGroup}@] - default group name for e.g. RecentChanges, as in "{$SiteGroup}"%0a->[@{$Title}@] - page title (may differ from Name), as in "{$Title}"%0a->[@{$Titlespaced}@] - either the page title (if defined), or the spaced page name, as in "{$Titlespaced}"%0a%0aIn addition to the above, there are some page-invariant variables available through this markup:%0a%0a->[@{$Author}@] - the name of the person currently interacting with the site, as in "{$Author}"%0a->[@{$AuthId}@] - current authenticated id, as in "{$AuthId}" %25red%25note the lower case 'd'.%25%25%0a%0a->[@{$Version}@] - PmWiki version, as in "{$Version}"%0a->[@{$VersionNum}@] - The internal version number, as in "{$VersionNum}"%0a->[@{$ScriptUrl}@] - The url to the pmwiki script, as in "{$ScriptUrl}"%0a%0a[[#security]]%0a!! Page variable security ($authpage)%0a%0aThe form @@{''pagename''$''variable''}@@ or some [[PageLists]], can display the values for other pages, regardless of the password protections. %0a%0aIf the other pages are protected and the visitor has no read permissions, PageVariables, unlike [[PageTextVariables]], normally display the values. While most variables do not contain sensitive information, some of them could do: $Title, $Description and those starting with $LastModified.%0a%0aAdministrators and module developers can redefine the sensitive page variables to respect authentications, by using the "$authpage" variable instead of "$page" in the definition. The following snippet can be added in local/config.php -- it will rewrite the default possibly sensitive definitions to the secure ones.%0a%0a[@%0aforeach($FmtPV as $k=>$v) {%0a  if(preg_match('/^\\$(Title(spaced)?|LastModified(By|Host|Summary|Time)?|Description)$/', $k))%0a    $FmtPV[$k] = str_replace('$page', '$authpage', $v);%0a}%0a@]%0a%0a%0a[[#custompv]]%0a!! Custom page variables%0a%0aYou may add custom page variables as a local customization. In a local configuration file or a recipe script, use the variable $FmtPV:%0a%0a->[@%0a$FmtPV['$VarName'] = "'variable definition'";%0a$FmtPV['$CurrentSkin'] = '$GLOBALS["Skin"]';%0a$FmtPV['$WikiTitle'] = '$GLOBALS["WikiTitle"]';%0a@]%0a%0aDefines new Page Variable of name $CurrentSkin, which can be used in the page with [@{$CurrentSkin}@] (also for [[Conditional markup]]).  It's necessary to use the single quotes nested inside double-quotes as shown above (preferred) or a double-quoted string nested inside single-quotes like ''[@'"this"'@]''.%0a%0a>>frame%3c%3c%0aPlease note that the values of the elements of $FmtPV are @@eval()@@ed so always sanitize any user input. The following is very insecure[=:=]%0a%0a->[@$FmtPV['$Var'] = $_REQUEST['Var'];@] %25red%25# critically insecure, allows PHP code injection%0a%0aYou should sanitize the user input to contain only expected values, or make sure the value is a quoted string, for example[=:=]%0a%0a->[@# we only expect numeric values of Var%0a$FmtPV['$Var'] = intval($_REQUEST['Var']);%0a%0a# properly escaped quoted string.%0a$FmtPV['$Var'] = '"'. addslashes($_REQUEST['Var']) . '"';@]%0a>>%3c%3c%0a%0a!! See also%0a%0a* [[Cookbook:More custom page variables]]%0a* [[PmWiki.Variables]] &mdash; about variables internal to PmWiki.%0a* [[PmWiki.MarkupMasterIndex]] &mdash; complete list of PmWiki markups.%0a* [[PmWiki/PageTextVariables]] &mdash; page variables automatically made available through natural page markup or explicit page markup within the wiki text of the page.%0a* [[PmWiki.Markup Expressions]] &mdash; markup expressions can manipulate page variables%0a%0a>>faq%3c%3c [[#faq]]%0a%0aQ:Is there a variable like $LastModified, but which shows me the creation time?%0aA:No, but you can create one in config.php. For instance:%0a->[@# add page variable {$PageCreationDate} in format yyyy-mm-dd%0a$FmtPV['$PageCreationDate'] = 'strftime("%25Y-%25m-%25d", $page["ctime"])';@]%0a%0aIf you like the same format that you define in config.php with $TimeFmt use%0a[@ $FmtPV['$Created'] = "strftime(\$GLOBALS['TimeFmt'], \$page['ctime'])";%0a@]%0a%0aQ: How can I test if a variable is set and/or not empty?%0aA: Use @@ [=(:if ! equal "{$Variable}" "":) $Variable is not empty. (:ifend:)=]@@. Note that undefined/inexistent variables appear as empty ones.%0a%0aCategories: [[!PmWiki Developer]]
time=1415603781
title=Page specific variables
