Remember: always follow the Leave No Trace principles when out in the wild.
Help:User rights
From CampWiki
|
User rights are specific access and ability permissions that can be assigned to customizable groups, which can then be assigned to (or removed from) users through the Special:Userrights interface. For example, the default bureaucrat group enables the use of the User rights interface.
This feature was introduced in MediaWiki 1.5; see setting user rights in MediaWiki on the Meta-wiki for earlier methods.
[edit] Managing groups
A default MediaWiki installation assigns certain rights to default groups (see below). You can change the default rights by declaring the Template:Mediawiki in Template:Mediawiki with the syntax "$wgGroupPermissions[‘group’][‘right’] = boolean;". To change permissions for all groups, use "*" as the group. For example, to disable editing for all users, add "$wgGroupPermissions['*']['edit'] = false;".
In addition to the default groups, you can arbitrarily create new groups using the same array. For example: <source lang="php"> $wgGroupPermissions['ninja']['bot'] = true; $wgGroupPermissions['ninja']['block'] = true; $wgGroupPermissions['ninja']['delete'] = true; </source>
[edit] Rights and groups
The following user rights are available in the latest version of MediaWiki. If you are using an older version then some of these may not be implemented.
| bgcolor="#A7C1F2" | Right | bgcolor="#A7C1F2" | Description |
|---|---|---|---|
| Reading | |||
| read | allows viewing pages not defined in Template:Mediawiki.
| ||
| Editing | |||
| edit | allows editing unprotected pages. | ||
| createpage | allows the creation of new pages (requires the edit right). | ||
| createtalk | allows the creation of new talk pages (requires the edit right). | ||
| move | allows renaming page titles. | ||
| createaccount | allows the creation of new user accounts. | ||
| upload | allows the creation of new images and files. | ||
| reupload | allows overwriting existing images and files. | ||
| reupload-shared | allows replacing images and files from a shared repository (if one is set up) with local files. | ||
| upload_by_url | allows uploading by entering the URL of an external image. | ||
| Management | |||
| delete | allows the deletion of edits and pages. | ||
| undelete | allows viewing and restoring deleted edits and pages. | ||
| deletedhistory | allows viewing deleted revisions, but not restoring. | ||
| protect | allows locking a page to prevent edits, and editing locked pages. | ||
| block | allows the blocking of IP addresses, CIDR ranges, and registered users. Block options include preventing editing and registering new accounts, and autoblocking other users on the same IP address. | ||
| blockemail | allows preventing use of the Special:Emailuser interface when blocking. | ||
| userrights | allows the use of the user rights interface, which allows the assignment or removal of groups to any user. | ||
| rollback | allows one-click reversion of edits. | ||
| patrol | allows marking edits as legitimate (Template:Mediawiki must be true). | ||
| editinterface | allows editing the MediaWiki namespace, which contains Template:Mediawiki. | ||
| editusercssjs | allows editing user's monobook.css, monobook.js, ... subpages. (MediaWiki 1.12, so not yet available for non-Wikimedia sites) | ||
| Administration | |||
| siteadmin | allows locking and unlocking the database (which blocks all interactions with the web site except viewing). | ||
| import | allows user to import pages from another wiki. | ||
| importupload | allows user to import pages from XML files. | ||
| trackback | allows removal of trackbacks (if Template:Mediawiki is true). | ||
| unwatchedpages | allows access to Special:Unwatchedpages, which lists pages that no user has watchlisted. | ||
| Technical | |||
| bot | hides edits from recent changes lists and watchlists by default (can optionally be viewed). | ||
| purge | allows purging a page without a confirmation step (Template:Mediawiki "&action=purge").
| ||
| minoredit | allows marking an edit as 'minor'. | ||
| nominornewtalk | blocks new message notification when making minor edits to user talk pages (requires minor edit right). | ||
| ipblock-exempt | makes user immune to blocks applied to his IP address. | ||
| proxyunbannable | makes user immune to the open proxy blocker, which is disabled by default (Template:Mediawiki). | ||
| autopatrol | automatically marks all edits by the user as patrolled (Template:Mediawiki must be true). | ||
The following groups are available in the latest version of MediaWiki. If you are using an older version then some of these may not be implemented.
| bgcolor="#A7C1F2" | Group | bgcolor="#A7C1F2" | Description |
|---|---|---|---|
| * | all users (including anonymous). | ||
| user | registered accounts. | ||
| autoconfirmed | registered accounts at least as old as Template:Mediawiki and having at least as many edits as Template:Mediawiki. | ||
| emailconfirmed | registered accounts with confirmed email addresses. | ||
| bot | accounts with the bot right (intended for automated scripts). | ||
| sysop | users who by default can delete and restore pages, block and unblock users, et cetera. | ||
| bureaucrat | users who by default can change other users' rights. |
Note that the 'developer' group is obsolete and should no longer be used.
[edit] Default rights
The default rights are defined in DefaultSettings.php. MediaWiki 1.12alpha defines the following (for older versions see Manual:$wgGroupPermissions). <source lang="php"> /**
* Permission keys given to users in each group. * All users are implicitly in the '*' group including anonymous visitors; * logged-in users are all implicitly in the 'user' group. These will be * combined with the permissions of all groups that a given user is listed * in in the user_groups table. * * Functionality to make pages inaccessible has not been extensively tested * for security. Use at your own risk! * * This replaces wgWhitelistAccount and wgWhitelistEdit */
$wgGroupPermissions = array();
// Implicit group for all visitors $wgGroupPermissions['*' ]['createaccount'] = true; $wgGroupPermissions['*' ]['read'] = true; $wgGroupPermissions['*' ]['edit'] = true; $wgGroupPermissions['*' ]['createpage'] = true; $wgGroupPermissions['*' ]['createtalk'] = true;
// Implicit group for all logged-in accounts $wgGroupPermissions['user' ]['move'] = true; $wgGroupPermissions['user' ]['read'] = true; $wgGroupPermissions['user' ]['edit'] = true; $wgGroupPermissions['user' ]['createpage'] = true; $wgGroupPermissions['user' ]['createtalk'] = true; $wgGroupPermissions['user' ]['upload'] = true; $wgGroupPermissions['user' ]['reupload'] = true; $wgGroupPermissions['user' ]['reupload-shared'] = true; $wgGroupPermissions['user' ]['minoredit'] = true; $wgGroupPermissions['user' ]['purge'] = true; // can use ?action=purge without clicking "ok"
// Implicit group for accounts that pass $wgAutoConfirmAge $wgGroupPermissions['autoconfirmed']['autoconfirmed'] = true;
// Implicit group for accounts with confirmed email addresses // This has little use when email address confirmation is off $wgGroupPermissions['emailconfirmed']['emailconfirmed'] = true;
// Users with bot privilege can have their edits hidden // from various log pages by default $wgGroupPermissions['bot' ]['bot'] = true; $wgGroupPermissions['bot' ]['autoconfirmed'] = true; $wgGroupPermissions['bot' ]['nominornewtalk'] = true; $wgGroupPermissions['bot' ]['autopatrol'] = true;
// Most extra permission abilities go to this group $wgGroupPermissions['sysop']['block'] = true; $wgGroupPermissions['sysop']['createaccount'] = true; $wgGroupPermissions['sysop']['delete'] = true; $wgGroupPermissions['sysop']['deletedhistory'] = true; // can view deleted history entries, but not see or restore the text $wgGroupPermissions['sysop']['editinterface'] = true; $wgGroupPermissions['sysop']['editusercssjs'] = true; $wgGroupPermissions['sysop']['import'] = true; $wgGroupPermissions['sysop']['importupload'] = true; $wgGroupPermissions['sysop']['move'] = true; $wgGroupPermissions['sysop']['patrol'] = true; $wgGroupPermissions['sysop']['autopatrol'] = true; $wgGroupPermissions['sysop']['protect'] = true; $wgGroupPermissions['sysop']['proxyunbannable'] = true; $wgGroupPermissions['sysop']['rollback'] = true; $wgGroupPermissions['sysop']['trackback'] = true; $wgGroupPermissions['sysop']['upload'] = true; $wgGroupPermissions['sysop']['reupload'] = true; $wgGroupPermissions['sysop']['reupload-shared'] = true; $wgGroupPermissions['sysop']['unwatchedpages'] = true; $wgGroupPermissions['sysop']['autoconfirmed'] = true; $wgGroupPermissions['sysop']['upload_by_url'] = true; $wgGroupPermissions['sysop']['ipblock-exempt'] = true; $wgGroupPermissions['sysop']['blockemail'] = true;
// Permission to change users' group assignments $wgGroupPermissions['bureaucrat']['userrights'] = true;
// Experimental permissions, not ready for production use //$wgGroupPermissions['sysop']['deleterevision'] = true; //$wgGroupPermissions['bureaucrat']['hiderevision'] = true;
/**
* The developer group is deprecated, but can be activated if need be * to use the 'lockdb' and 'unlockdb' special pages. Those require * that a lock file be defined and creatable/removable by the web * server. */
- $wgGroupPermissions['developer']['siteadmin'] = true;
</source>
[edit] Examples
[edit] Anonymous users cannot view pages
This example will disable viewing of all pages not listed in Template:Mediawiki, then re-enable for registered users only. <source lang="php"> $wgGroupPermissions['*']['read'] = false; $wgGroupPermissions['user']['read'] = true; </source>
[edit] Anonymous users cannot edit
This example will disable editing of all pages, then re-enable for registered users only. <source lang="php"> $wgGroupPermissions['*']['edit'] = false; $wgGroupPermissions['user']['edit'] = true; </source>
