MediaWiki
MediaWiki (hereinafter, the Software) is a free and open-source wiki software. The Software was originally developed for Wikipedia, but now the Software runs on many websites and has become the dominant software in its category. The Software is written in the PHP programming language and stores the contents into a set of databases.
The software is optimized to efficiently handle large projects, which can have terabytes of content and hundreds of thousands of hits per second. According to MediaWiki, achieving scalability through multiple layers of caching and database replication has been a major concern for developers. The software has more than 900 configuration settings and more than 1,900 extensions available for enabling various features to be added or changed.
On Wikipedia alone, more than 1000 automated and semi-automated bots and other tools have been developed to assist in editing. It has also been deployed by some companies as an internal knowledge management system, and some educators have assigned students to use the Software for collaborative group projects.
Contents
Permitted user roles
Permitted user roles are specific access and ability permissions that can be assigned to customizable user groups.
List of permissions
The following user rights are available in the latest version of MediaWiki.</translate> <translate> If you are using an older version, look at “Special:Version” on your wiki and see if your version is covered in the “Versions” column. </translate>
| Template:Hl2 | <translate> Right</translate> | Template:Hl2 | <translate> Description</translate> | Template:Hl2 | <translate> User groups that have this right by default</translate> | Template:Hl2 | <translate> Versions</translate> |
|---|---|---|---|
| Template:Hl3 colspan="4" |<translate> Reading</translate> | |||
| read | Template:Int - <translate> when set to false, override for specific pages with <tvar|WhitelistRead>Template:Ll</></translate>
|
*, user | 1.5+ |
| Template:Hl3 colspan="4"|<translate> Editing</translate> | |||
| applychangetags | Template:Int | user | 1.25+ |
| autocreateaccount | Template:Int - <translate> a more limited version of createaccount</translate> | — | 1.27+ |
| createaccount | Template:Int - register / registration | * | 1.5+ |
| createpage | Template:Int - <translate> requires the <tvar|1>edit</> right</translate> | *, user | 1.6+ |
| createtalk | Template:Int - <translate> requires the <tvar|1>edit</> right</translate> | *, user | 1.6+ |
| edit | Template:Int | *, user | 1.5+ |
| editsemiprotected | Template:Int - <translate> without cascading protection</translate> | autoconfirmed | 1.22+ |
| editprotected | Template:Int - <translate> without cascading protection</translate> | sysop | 1.13+ |
| move | Template:Int - <translate> requires the <tvar|1>edit</> right</translate> | user | 1.5+ |
| move-categorypages | Template:Int - <translate> (requires the <tvar|1>move</> right)</translate> | user | 1.25+ |
| move-rootuserpages | Template:Int - <translate> requires the <tvar|1>move</> right</translate> | user | 1.14+ |
| move-subpages | Template:Int - <translate> requires the <tvar|1>move</> right</translate> | user | 1.13+ |
| movefile | Template:Int - <translate> requires the <tvar|1>move</> right and <tvar|AllowImageMoving>Template:Ll</> to be true</translate> | user | 1.14+ |
| reupload | Template:Int - <translate> requires the <tvar|1>upload</> right</translate> | user | 1.6+ |
| reupload-own | Template:Int - <translate> requires the <tvar|1>upload</> right (note that this is not needed if the group already has the <tvar|reupload>reupload</> right)</translate> | — | 1.11+ |
| reupload-shared | Template:Int - <translate> (if one is set up) with local files</translate> <translate> (requires the <tvar|1>upload</> right)</translate> | user | 1.6+ |
| sendemail | Template:Int | user | 1.16+ |
| upload | Template:Int - <translate> requires the <tvar|1>edit</> right</translate> | user | 1.5+ |
| upload_by_url | Template:Int - <translate> requires the <tvar|1>upload</> right</translate> | — | 1.8+ |
| Template:Hl3 colspan="4"|<translate> Management</translate> | |||
| bigdelete | Template:Int | sysop | 1.12+ |
| block | Template:Int - <translate> Block options include preventing editing and registering new accounts, and autoblocking other users on the same IP address</translate> | sysop | 1.5+ |
| blockemail | Template:Int - <translate> allows preventing use of the Special:Emailuser interface when blocking</translate> | sysop | 1.11+ |
| browsearchive | Template:Int - <translate> through Special:Undelete</translate> | sysop | 1.13+ |
| changetags | Template:Int - <translate> currently unused by extensions</translate> | user | 1.25+ |
| delete | Template:Int 1.5–1.11: <translate> allows the deletion or undeletion of pages.</translate> 1.12+: <translate> allows the deletion of pages.</translate> <translate> For undeletions, there is now the <tvar|1>'undelete'</> right, see below</translate> |
sysop | 1.5+ |
| deletedhistory | Template:Int | sysop | 1.6+ |
| deletedtext | Template:Int | sysop | |
| deletelogentry | Template:Int - <translate> allows deleting/undeleting information (action text, summary, user who made the action) of specific log entries (not available by default)</translate> | — | 1.20+ |
| deleterevision | Template:Int - <translate> allows deleting/undeleting information (revision text, edit summary, user who made the edit) of specific revisions</translate> <translate> Split into deleterevision and deletelogentry in 1.20 (not available by default)</translate> | — | 1.6+ |
| editcontentmodel | Template:Int | — | 1.23.7+ |
| editinterface | Template:Int - <translate> contains [[<tvar|man>Special:MyLanguage/Manual:Interface</>|interface messages]]</translate> | sysop, interface-admin | 1.5+ |
| editmyoptions | Template:Int | * | 1.22+ |
| editmyprivateinfo | Template:Int | * | 1.22+ |
| editmyusercss | Template:Int | * | 1.22+ |
| editmyuserjs | Template:Int | * | 1.22+ |
| editmyuserjson | Template:Int | user | 1.31+ |
| editmywatchlist | Template:Int | * | 1.22+ |
| editsitecss | Template:Int | interface-admin | 1.32+ |
| editsitejs | Template:Int | interface-admin | 1.32+ |
| editsitejson | Template:Int | interface-admin | 1.32+ |
| editusercss | Template:Int | interface-admin | 1.16+ |
| edituserjs | Template:Int | interface-admin | 1.16+ |
| edituserjson | Template:Int | interface-admin | 1.31+ |
| hideuser | Template:Int - <translate>
(not available by default) Only users with 1000 edits or less can be suppressed by default.</translate> <translate> Use <tvar|HideUserContribLimit>Template:Wg</> to disable.</translate> |
— | 1.10+ |
| markbotedits | Template:Int - <translate> see [[<tvar|man>Special:MyLanguage/Manual:Administrators#Rollback</>|Manual:Administrators#Rollback]]</translate> | sysop | 1.12+ |
| mergehistory | Template:Int | sysop | 1.12+ |
| pagelang | Template:Int - <translate> <tvar|PageLanguageUseDB>Template:Ll</> must be true</translate> | — | 1.24+ |
| patrol | Template:Int - <translate> <tvar|UseRCPatrol>Template:Ll</> must be true</translate> | sysop | 1.5+ |
| patrolmarks | Template:Int | — | 1.16+ |
| protect | Template:Int | sysop | 1.5+ |
| rollback | Template:Int | sysop | 1.5+ |
| suppressionlog | Template:Int | — | 1.6+ |
| suppressrevision | Template:Int - <translate> Prior to 1.13 this right was named hiderevision (not available by default)</translate> | — | 1.6+ |
| unblockself | Template:Int - <translate> Without it, an administrator that has the capability to block cannot unblock themselves if blocked by another administrator</translate> | sysop | 1.17+ |
| undelete | Template:Int | sysop | 1.12+ |
| userrights | Template:Int - <translate> allows the assignment or removal of all* groups to any user.</translate> <translate>
|
bureaucrat | 1.5+ |
| userrights-interwiki | Template:Int | — | 1.12+ |
| viewmyprivateinfo | Template:Int | * | 1.22+ |
| viewmywatchlist | Template:Int | * | 1.22+ |
| viewsuppressed | Template:Int - <translate> i.e. a more narrow alternative to "suppressrevision" (not available by default)</translate> | — | 1.24+ |
| Template:Hl3 colspan="4"|<translate> Administration</translate> | |||
| autopatrol | Template:Int - <translate> <tvar|UseRCPatrol>Template:Ll</> must be true</translate> | bot, sysop | 1.9+ |
| import | Template:Int - <translate> “transwiki”</translate> | sysop | 1.5+ |
| importupload | Template:Int - <translate> This right was called 'importraw' in and before version 1.5</translate> | sysop | 1.5+ |
| managechangetags | Template:Int - <translate> currently unused by extensions</translate> | sysop | 1.25+ |
| siteadmin | Template:Int - <translate> which blocks all interactions with the web site except viewing.</translate> <translate> Disabled by default</translate> | — | 1.5+ |
| unwatchedpages | Template:Int - <translate> lists pages that no user has watchlisted</translate> | sysop | 1.6+ |
| Template:Hl3 colspan="4"|<translate> Technical</translate> | |||
| apihighlimits | Template:Int | bot, sysop | 1.12+ |
| autoconfirmed | Template:Int - <translate> used for the 'autoconfirmed' group, see the other table below for more information</translate> | autoconfirmed, bot, sysop | 1.6+ |
| bot | Template:Int - <translate> can optionally be viewed</translate> | bot | 1.5+ |
| ipblock-exempt | Template:Int | sysop | 1.9+ |
| minoredit | Template:Int | user | 1.6+ |
| nominornewtalk | Template:Int - <translate> requires minor edit right</translate> | bot | 1.9+ |
| noratelimit | Template:Int - <translate> not affected by [[<tvar|man>Special:MyLanguage/Manual:$wgRateLimits</>|rate limits]] (prior to the introduction of this right, the configuration variable <tvar|RateLimitsExcludedGroups>Template:Ll</> was used for this purpose)</translate> | sysop, bureaucrat | 1.13+ |
| purge | Template:Int - <translate> [[<tvar|man>Special:MyLanguage/Manual:URL</>|URL parameter]] "&action=purge"</translate>
|
user | 1.10+ |
| suppressredirect | Template:Int | bot, sysop | 1.12+ |
| writeapi | Template:Int | *, user, bot | 1.13+ |
<translate>
List of groups
The following groups are available in the latest version of MediaWiki.</translate> <translate> If you are using an older version then some of these may not be implemented. </translate>
| Template:Hl2 | <translate> Group</translate> | Template:Hl2 | <translate> Description</translate> | Template:Hl2 | <translate> Default rights</translate> | Template:Hl2 | <translate> Versions</translate> |
|---|---|---|---|
| * | <translate> all users (including anonymous).</translate> | createaccount, createpage, createtalk, edit, editmyoptions, editmyprivateinfo, editmyusercss, editmyuserjs, editmywatchlist, read, viewmyprivateinfo, viewmywatchlist, writeapi | 1.5+ |
| user | <translate> registered accounts.</translate> | applychangetags, changetags, createpage, createtalk, edit, minoredit, move, move-categorypages, move-rootuserpages, move-subpages, movefile, purge, read, reupload, reupload-shared, sendemail, upload, writeapi | |
| autoconfirmed | AutoConfirmAge>Template:Ll</> and having at least as many edits as <tvar|AutoConfirmCount>Template:Ll</>.</translate> | autoconfirmed, editsemiprotected | 1.6+ |
| bot | <translate> accounts with the bot right (intended for automated scripts).</translate> | autoconfirmed, autopatrol, apihighlimits, bot, editsemiprotected, nominornewtalk, suppressredirect, writeapi | 1.5+ |
| sysop | <translate> users who by default can delete and restore pages, block and unblock users, et cetera.</translate> | apihighlimits, autoconfirmed, autopatrol, bigdelete, block, blockemail, browsearchive, createaccount, delete, deletedhistory, deletedtext, editinterface, editprotected, editsemiprotected, editusercss, edituserjs, import, importupload, ipblock-exempt, managechangetags, markbotedits, mergehistory, move, move-categorypages, move-rootuserpages, move-subpages, movefile, noratelimit, patrol, protect, proxyunbannable, reupload, reupload-shared, rollback, suppressredirect, unblockself, undelete, unwatchedpages, upload, upload_by_url | 1.5+ |
| bureaucrat | <translate> users who by default can change other users' rights.</translate> | noratelimit, userrights | 1.5+ |
<translate> From MW 1.12, you can create your own groups into which users are automatically promoted (as with autoconfirmed and emailconfirmed) using <tvar|AutoPromote>Template:Ll</>.</translate> <translate> You can even create any custom group by just assigning rights to them.
Default rights
The default rights are defined in <tvar|DefaultSettings>Template:Ll</>.</translate> <translate>
- Default values in HEAD version:</translate> https://phabricator.wikimedia.org/diffusion/MW/browse/master/includes/DefaultSettings.php
<translate>
- The default values in the latest stable MediaWiki release, version Template:MW stable branch number, are available here:</translate> https://phabricator.wikimedia.org/diffusion/MW/browse/{{#invoke:Version%7Cget%7Cstable%7Cgit}}/includes/DefaultSettings.php
<translate>
- Additional rights: you should be able to list all the permissions available on your wiki by running <tvar|getAllRights>
User::getAllRights()</>.
</translate>
Template:Anchor <translate>
Adding new rights
</translate> <translate> Information for coders only follows.</translate>
<translate>
If you're adding a new right in core, for instance to [[<tvar|man>Special:MyLanguage/Manual:Special pages</>|control a new special page]], you are required to add it to the list of available rights in <tvar|User>Template:Ll</>, $mCoreRights ([<tvar|url>https://gerrit.wikimedia.org/r/#/c/135312/73/includes/User.php</> example]).</translate>
<translate>
If you're {{<tvar|man>ll|Manual:Developing extensions</>|doing so in an extension}}, you instead need to use <tvar|AvailableRights>Template:Ll</>.
You probably also want to assign it to some user group by editing <tvar|GroupPermissions>Template:Ll</> described above.
If you want this right to be accessible to external applications by <tvar|OAuth>Template:Ll</> or by [[<tvar|botpasswords>Manual:Bot passwords</>|bot passwords]], then you will need to add it to a grant by editing <tvar|GrantPermissions>Template:Ll</>.</translate>
<source lang="php"> // create ninja-powers right $wgAvailableRights[] = 'ninja-powers';
//add ninja-powers to the ninja-group $wgGroupPermissions['ninja']['ninja-powers'] = true;
//add ninja-powers to the 'basic' grant so we can use our ninja powers over an API request $wgGrantPermissions['basic']['ninja-powers'] = true; </source>
Security
As any open-source software, the Wiki is vulnerable to external attacks:
- https://www.mediawiki.org/wiki/Manual:Security
- https://www.mediawiki.org/wiki/Security_for_developers
