MediaWiki

From CNM Wiki
Revision as of 01:08, 30 September 2018 by Gary (talk | contribs)
Jump to: navigation, search

MediaWiki is


Groups (user roles)

User rights are specific access and ability permissions that can be assigned to customizable user groups.</translate> <translate> Groups can then be assigned to (or removed from) users through the <tvar|user-rights>Special:UserRights</> [[<tvar|help>Special:MyLanguage/Help:Special pages</>|special page]]. </translate> <translate> See <tvar|1>Template:Ll</>.

Access to this interface is itself governed by the <tvar|userrights>userrights</> right, so only users in the <tvar|bureaucrat>Template:Int</> group can do it (in a default set-up).</translate> <translate> See <tvar|1>Template:Ll</> for information about managing and the assignment of user groups.

Changing group permissions

A default MediaWiki installation assigns certain rights to default groups (see below).</translate> <translate> You can change the default rights by editing the <tvar|GroupPermissions>Template:Ll</> array in <tvar|LocalSettings>Template:Ll</> with the syntax. </translate>

<syntaxhighlight lang="php"> $wgGroupPermissions['group']['right'] = true /* <translate> or false</translate> */; </syntaxhighlight>

Template:Note

<translate> If a member has multiple groups, they get all of the permissions from each of the groups they are in.</translate> <translate> All users, including anonymous users, are in the '*' group; all registered users are in the 'user' group.</translate> <translate> In addition to the default groups, you can arbitrarily create new groups using the same array.

Examples

This example will disable viewing of all pages not listed in <tvar|WhitelistRead>Template:Ll</>, then re-enable for registered users only: </translate>

<syntaxhighlight lang="php"> $wgGroupPermissions['*']['read'] = false;

  1. <translate> The following line is not actually necessary, since it's in the defaults. Setting '*' to false doesn't disable rights for groups that have the right separately set to true!</translate>

$wgGroupPermissions['user']['read'] = true; </syntaxhighlight>

<translate> This example will disable editing of all pages, then re-enable for users with confirmed email addresses only: </translate>

<syntaxhighlight lang="php">

  1. <translate> Disable for everyone.</translate>

$wgGroupPermissions['*']['edit'] = false;

  1. <translate> Disable for users, too: by default 'user' is allowed to edit, even if '*' is not.</translate>

$wgGroupPermissions['user']['edit'] = false;

  1. <translate> Make it so users with confirmed email addresses are in the group.</translate>

$wgAutopromote['emailconfirmed'] = APCOND_EMAILCONFIRMED;

  1. <translate> Hide group from user list.</translate>

$wgImplicitGroups[] = 'emailconfirmed';

  1. <translate> Finally, set it to true for the desired group.</translate>

$wgGroupPermissions['emailconfirmed']['edit'] = true; </syntaxhighlight>

<translate>

Creating a new group and assigning permissions to it

You can create new user groups by defining permissions for the according group name in $wgGroupPermissions['<group-name>'] where <group-name> is the actual name of the group.

Additionally to assigning permissions, you should create these three wiki pages with fitting content: </translate>

  • Template:Blue <translate> (content: Name of the group)</translate>
  • Template:Blue <translate> (content: Name of a member of the group)</translate>
  • Template:Blue <translate> (content: Name of the group page)</translate>

<translate> By default, bureaucrats can add users to, or remove them from, any group.</translate> <translate> However, if you are using <tvar|AddGroups>Template:Ll</> and <tvar|RemoveGroups>Template:Ll</>, you may need to customize those instead.

Examples

This example will create an arbitrary “ninja” group that can block users and delete pages, and whose edits are hidden by default in the recent changes log: </translate>

<syntaxhighlight lang="php"> $wgGroupPermissions['ninja']['bot'] = true; $wgGroupPermissions['ninja']['block'] = true; $wgGroupPermissions['ninja']['delete'] = true; </syntaxhighlight>

<translate> Note: the group name cannot contain spaces, so use 'random-group' or 'random_group' instead of 'random group'</translate>

<translate> In this example, you would probably also want to create these pages: </translate>

<translate> This will ensure that the group will be referred to as “Ninjas” throughout the interface, and a member will be referred to as a “ninja”, and overviews will link the group name to Template:Blue.

This example disables write access (page editing and creation) by default, creates a group named “Write”, and grants it write access. Users can be manually added to this group via <tvar|UserRights>Special:UserRights</>: </translate>

<syntaxhighlight lang="php"> $wgGroupPermissions['*']['edit'] = false; $wgGroupPermissions['*']['createpage'] = false; $wgGroupPermissions['user']['edit'] = false; $wgGroupPermissions['user']['createpage'] = false; $wgGroupPermissions['Write']['edit'] = true; $wgGroupPermissions['Write']['createpage'] = true; </syntaxhighlight>

<translate> In this example, you would probably also want to create these pages: </translate>

<translate>

Removing predefined groups

MediaWiki out of the box comes with a number of predefined groups.</translate> <translate> Most of these groups can be removed by unsetting the according array keys, among them $wgGroupPermissions['<group-name>'].</translate> <translate> For details see below.

Example

This example will eliminate the bureaucrat group entirely.</translate> <translate> It is necessary to ensure that all six of these variables are unset for any group that one wishes to remove from being listed at <tvar|List>Special:ListGroupRights</>; however, merely unsetting $wgGroupPermissions will suffice to remove it from <tvar|UserRights>Special:UserRights</>.</translate> <translate> This code should be placed after any require_once lines that add extensions such as <tvar|RenameUser>Template:Ll</> containing code that gives bureaucrats group permissions by default. </translate>

<syntaxhighlight lang="php"> unset( $wgGroupPermissions['bureaucrat'] ); unset( $wgRevokePermissions['bureaucrat'] ); unset( $wgAddGroups['bureaucrat'] ); unset( $wgRemoveGroups['bureaucrat'] ); unset( $wgGroupsAddToSelf['bureaucrat'] ); unset( $wgGroupsRemoveFromSelf['bureaucrat'] ); </syntaxhighlight>

<translate> In some extensions (Flow, Semantic MediaWiki, etc.), rights are added during extension registration or in a registration function. In this case, it could be necessary to use a registration function in LocalSettings.php to remove some predefined user groups: </translate>

<syntaxhighlight lang="php"> $wgExtensionFunctions[] = function() use ( &$wgGroupPermissions ) { 

   unset( $wgGroupPermissions['oversight'] );
   unset( $wgGroupPermissions['flow-bot'] );

}; </syntaxhighlight>

<translate>

Note on the group called “user”

With the above mechanism, you can remove the groups sysop, bureaucrat and bot, which - if used - can be assigned through the usual [[<tvar|help>Special:MyLanguage/Help:User rights and groups</>|user permission system]]. </translate> <translate> However, it is currently impossible to remove the user group.</translate> <translate> This group is not assigned through the usual permission system.</translate> <translate> Instead, every logged in user automatically is member of that group.</translate> <translate> This is hardcoded in MediaWiki and currently cannot be changed easily.

List of permissions

The following user rights are available in the latest version of MediaWiki.</translate> <translate> If you are using an older version, look at “Special:Version” on your wiki and see if your version is covered in the “Versions” column. </translate>

Template:Hl2 | <translate> Right</translate> Template:Hl2 | <translate> Description</translate> Template:Hl2 | <translate> User groups that have this right by default</translate> Template:Hl2 | <translate> Versions</translate>
Template:Hl3 colspan="4" |<translate> Reading</translate>
read Template:Int - <translate> when set to false, override for specific pages with <tvar|WhitelistRead>Template:Ll</></translate>

Template:Uploaded-files-access-restriction-info

*, user 1.5+
Template:Hl3 colspan="4"|<translate> Editing</translate>
applychangetags Template:Int user 1.25+
autocreateaccount Template:Int - <translate> a more limited version of createaccount</translate> — 1.27+
createaccount Template:Int - register / registration * 1.5+
createpage Template:Int - <translate> requires the <tvar|1>edit</> right</translate> *, user 1.6+
createtalk Template:Int - <translate> requires the <tvar|1>edit</> right</translate> *, user 1.6+
edit Template:Int *, user 1.5+
editsemiprotected Template:Int - <translate> without cascading protection</translate> autoconfirmed 1.22+
editprotected Template:Int - <translate> without cascading protection</translate> sysop 1.13+
move Template:Int - <translate> requires the <tvar|1>edit</> right</translate> user 1.5+
move-categorypages Template:Int - <translate> (requires the <tvar|1>move</> right)</translate> user 1.25+
move-rootuserpages Template:Int - <translate> requires the <tvar|1>move</> right</translate> user 1.14+
move-subpages Template:Int - <translate> requires the <tvar|1>move</> right</translate> user 1.13+
movefile Template:Int - <translate> requires the <tvar|1>move</> right and <tvar|AllowImageMoving>Template:Ll</> to be true</translate> user 1.14+
reupload Template:Int - <translate> requires the <tvar|1>upload</> right</translate> user 1.6+
reupload-own Template:Int - <translate> requires the <tvar|1>upload</> right (note that this is not needed if the group already has the <tvar|reupload>reupload</> right)</translate> — 1.11+
reupload-shared Template:Int - <translate> (if one is set up) with local files</translate> <translate> (requires the <tvar|1>upload</> right)</translate> user 1.6+
sendemail Template:Int user 1.16+
upload Template:Int - <translate> requires the <tvar|1>edit</> right</translate> user 1.5+
upload_by_url Template:Int - <translate> requires the <tvar|1>upload</> right</translate> — 1.8+
Template:Hl3 colspan="4"|<translate> Management</translate>
bigdelete Template:Int sysop 1.12+
block Template:Int - <translate> Block options include preventing editing and registering new accounts, and autoblocking other users on the same IP address</translate> sysop 1.5+
blockemail Template:Int - <translate> allows preventing use of the Special:Emailuser interface when blocking</translate> sysop 1.11+
browsearchive Template:Int - <translate> through Special:Undelete</translate> sysop 1.13+
changetags Template:Int - <translate> currently unused by extensions</translate> user 1.25+
delete Template:Int 1.5–1.11: <translate> allows the deletion or undeletion of pages.</translate>
1.12+: <translate> allows the deletion of pages.</translate> <translate> For undeletions, there is now the <tvar|1>'undelete'</> right, see below</translate> 		sysop 1.5+
deletedhistory Template:Int sysop 1.6+
deletedtext Template:Int sysop
deletelogentry Template:Int - <translate> allows deleting/undeleting information (action text, summary, user who made the action) of specific log entries (not available by default)</translate> — 1.20+
deleterevision Template:Int - <translate> allows deleting/undeleting information (revision text, edit summary, user who made the edit) of specific revisions</translate> <translate> Split into deleterevision and deletelogentry in 1.20 (not available by default)</translate> — 1.6+
editcontentmodel Template:Int — 1.23.7+
editinterface Template:Int - <translate> contains [[<tvar|man>Special:MyLanguage/Manual:Interface</>|interface messages]]</translate> sysop, interface-admin 1.5+
editmyoptions Template:Int * 1.22+
editmyprivateinfo Template:Int * 1.22+
editmyusercss Template:Int * 1.22+
editmyuserjs Template:Int * 1.22+
editmyuserjson Template:Int user 1.31+
editmywatchlist Template:Int * 1.22+
editsitecss Template:Int interface-admin 1.32+
editsitejs Template:Int interface-admin 1.32+
editsitejson Template:Int interface-admin 1.32+
editusercss Template:Int interface-admin 1.16+
edituserjs Template:Int interface-admin 1.16+
edituserjson Template:Int interface-admin 1.31+
hideuser Template:Int - <translate>

(not available by default)

Only users with 1000 edits or less can be suppressed by default.</translate> <translate> Use <tvar|HideUserContribLimit>Template:Wg</> to disable.</translate>

— 1.10+
markbotedits Template:Int - <translate> see [[<tvar|man>Special:MyLanguage/Manual:Administrators#Rollback</>|Manual:Administrators#Rollback]]</translate> sysop 1.12+
mergehistory Template:Int sysop 1.12+
pagelang Template:Int - <translate> <tvar|PageLanguageUseDB>Template:Ll</> must be true</translate> — 1.24+
patrol Template:Int - <translate> <tvar|UseRCPatrol>Template:Ll</> must be true</translate> sysop 1.5+
patrolmarks Template:Int — 1.16+
protect Template:Int sysop 1.5+
rollback Template:Int sysop 1.5+
suppressionlog Template:Int — 1.6+
suppressrevision Template:Int - <translate> Prior to 1.13 this right was named hiderevision (not available by default)</translate> — 1.6+
unblockself Template:Int - <translate> Without it, an administrator that has the capability to block cannot unblock themselves if blocked by another administrator</translate> sysop 1.17+
undelete Template:Int sysop 1.12+
userrights Template:Int - <translate> allows the assignment or removal of all* groups to any user.</translate>
<translate>
  • With <tvar|AddGroups>Template:Ll</> and <tvar|RemoveGroups>Template:Ll</> you can set the possibility to add/remove certain groups instead of all</translate>
 bureaucrat 1.5+
userrights-interwiki Template:Int — 1.12+
viewmyprivateinfo Template:Int * 1.22+
viewmywatchlist Template:Int * 1.22+
viewsuppressed Template:Int - <translate> i.e. a more narrow alternative to "suppressrevision" (not available by default)</translate> — 1.24+
Template:Hl3 colspan="4"|<translate> Administration</translate>
autopatrol Template:Int - <translate> <tvar|UseRCPatrol>Template:Ll</> must be true</translate> bot, sysop 1.9+
import Template:Int - <translate> “transwiki”</translate> sysop 1.5+
importupload Template:Int - <translate> This right was called 'importraw' in and before version 1.5</translate> sysop 1.5+
managechangetags Template:Int - <translate> currently unused by extensions</translate> sysop 1.25+
siteadmin Template:Int - <translate> which blocks all interactions with the web site except viewing.</translate> <translate> Disabled by default</translate> — 1.5+
unwatchedpages Template:Int - <translate> lists pages that no user has watchlisted</translate> sysop 1.6+
Template:Hl3 colspan="4"|<translate> Technical</translate>
apihighlimits Template:Int bot, sysop 1.12+
autoconfirmed Template:Int - <translate> used for the 'autoconfirmed' group, see the other table below for more information</translate> autoconfirmed, bot, sysop 1.6+
bot Template:Int - <translate> can optionally be viewed</translate> bot 1.5+
ipblock-exempt Template:Int sysop 1.9+
minoredit Template:Int user 1.6+
nominornewtalk Template:Int - <translate> requires minor edit right</translate> bot 1.9+
noratelimit Template:Int - <translate> not affected by [[<tvar|man>Special:MyLanguage/Manual:$wgRateLimits</>|rate limits]] (prior to the introduction of this right, the configuration variable <tvar|RateLimitsExcludedGroups>Template:Ll</> was used for this purpose)</translate> sysop, bureaucrat 1.13+
purge Template:Int - <translate> [[<tvar|man>Special:MyLanguage/Manual:URL</>|URL parameter]] "&action=purge"</translate> user 1.10+
suppressredirect Template:Int bot, sysop 1.12+
writeapi Template:Int *, user, bot 1.13+

Template:Note

<translate>

List of groups

The following groups are available in the latest version of MediaWiki.</translate> <translate> If you are using an older version then some of these may not be implemented. </translate>

Template:Hl2 | <translate> Group</translate> Template:Hl2 | <translate> Description</translate> Template:Hl2 | <translate> Default rights</translate> Template:Hl2 | <translate> Versions</translate>
* <translate> all users (including anonymous).</translate> createaccount, createpage, createtalk, edit, editmyoptions, editmyprivateinfo, editmyusercss, editmyuserjs, editmywatchlist, read, viewmyprivateinfo, viewmywatchlist, writeapi 1.5+
user <translate> registered accounts.</translate> applychangetags, changetags, createpage, createtalk, edit, minoredit, move, move-categorypages, move-rootuserpages, move-subpages, movefile, purge, read, reupload, reupload-shared, sendemail, upload, writeapi
autoconfirmed AutoConfirmAge>Template:Ll</> and having at least as many edits as <tvar|AutoConfirmCount>Template:Ll</>.</translate> autoconfirmed, editsemiprotected 1.6+
bot <translate> accounts with the bot right (intended for automated scripts).</translate> autoconfirmed, autopatrol, apihighlimits, bot, editsemiprotected, nominornewtalk, suppressredirect, writeapi 1.5+
sysop <translate> users who by default can delete and restore pages, block and unblock users, et cetera.</translate> apihighlimits, autoconfirmed, autopatrol, bigdelete, block, blockemail, browsearchive, createaccount, delete, deletedhistory, deletedtext, editinterface, editprotected, editsemiprotected, editusercss, edituserjs, import, importupload, ipblock-exempt, managechangetags, markbotedits, mergehistory, move, move-categorypages, move-rootuserpages, move-subpages, movefile, noratelimit, patrol, protect, proxyunbannable, reupload, reupload-shared, rollback, suppressredirect, unblockself, undelete, unwatchedpages, upload, upload_by_url 1.5+
bureaucrat <translate> users who by default can change other users' rights.</translate> noratelimit, userrights 1.5+

<translate> From MW 1.12, you can create your own groups into which users are automatically promoted (as with autoconfirmed and emailconfirmed) using <tvar|AutoPromote>Template:Ll</>.</translate> <translate> You can even create any custom group by just assigning rights to them.

Default rights

The default rights are defined in <tvar|DefaultSettings>Template:Ll</>.</translate> <translate>

<translate>

<translate>

  • Additional rights: you should be able to list all the permissions available on your wiki by running <tvar|getAllRights>User::getAllRights()</>.

</translate>

Template:Anchor <translate>

Adding new rights

</translate> <translate> Information for coders only follows.</translate>

<translate> If you're adding a new right in core, for instance to [[<tvar|man>Special:MyLanguage/Manual:Special pages</>|control a new special page]], you are required to add it to the list of available rights in <tvar|User>Template:Ll</>, $mCoreRights ([<tvar|url>https://gerrit.wikimedia.org/r/#/c/135312/73/includes/User.php</> example]).</translate> <translate> If you're {{<tvar|man>ll|Manual:Developing extensions</>|doing so in an extension}}, you instead need to use <tvar|AvailableRights>Template:Ll</>.

You probably also want to assign it to some user group by editing <tvar|GroupPermissions>Template:Ll</> described above.

If you want this right to be accessible to external applications by <tvar|OAuth>Template:Ll</> or by [[<tvar|botpasswords>Manual:Bot passwords</>|bot passwords]], then you will need to add it to a grant by editing <tvar|GrantPermissions>Template:Ll</>.</translate>

<source lang="php"> // create ninja-powers right $wgAvailableRights[] = 'ninja-powers';

//add ninja-powers to the ninja-group $wgGroupPermissions['ninja']['ninja-powers'] = true;

//add ninja-powers to the 'basic' grant so we can use our ninja powers over an API request $wgGrantPermissions['basic']['ninja-powers'] = true; </source>

Security

As any open-source software, the Wiki is vulnerable to external attacks:

Getting started

Retrieved from "https://pravka.bskol.com/w/index.php?title=MediaWiki&oldid=8028"