Page MenuHomePhabricator

Limit user rights on our wikis
Closed, ResolvedPublic4 Estimated Story Points

Description

Limit ordinary users to only be able to do the minimum that they need. This should help minimise the risk that things are added or modified either by mistake or maliciously.

The only editing rights that are needed are:

  • Demo wiki: change preferences.
  • Producer wiki: write to the pronunciation lexicon.

Documentation for this can be found on mw:Manual:User rights.

Event Timeline

So I guess these are the only options we want to have:

Demo wiki: $wgGroupPermissions['user']['editmyoptions'] = true;
Producer: $wgGroupPermissions['wikispeech-edit-lexicon']['wikispeech-edit-lexicon'] = true; or: $wgGroupPermissions['user']['wikispeech-edit-lexicon'] = true;

Yes, for editing. We still want to keep reading and listening permissions for everyone.

Producer: $wgGroupPermissions['wikispeech-edit-lexicon']['wikispeech-edit-lexicon'] = true; or: $wgGroupPermissions['user']['wikispeech-edit-lexicon'] = true;

I'd say the first since we have that specific group. Not sure that it'll make any difference at the moment, but could in the future.

The only thing I can find to remove in producer and demo wiki is this:

$wgGroupPermissions['user']['pagelang'] = true; otherwise it seems like the user did not have access to any other rights?

There are default values for group permissions: mw:Manual:User rights. You can also look at Special:ListGroupRights to see settings for that wiki.

Yes, thanks! Then I think this is done!

It looks like you locked down a bit too much. Now I can't edit or create pages as an admin 🙂 I think you may have to add the permissions you removed to the admin group.

Oh.. I had reset the user group's rights on the demo wiki using $wgGroupPermissions['user'] = []; to ensure ordinary users can't edit anything, so I think I removed it all..

To fix this, i guess for example these are needed for admin?:

$wgGroupPermissions['sysop']['edit'] = true;
$wgGroupPermissions['sysop']['createpage'] = true;
$wgGroupPermissions['sysop']['upload'] = true;
$wgGroupPermissions['sysop']['move'] = true;

I think that would work. There may be something in the documentation about doing something like this. It might be worth having a look if you haven't already.

Now it should finally work. From what I could read fro the documentation the way to go was to manually add the extra rights to the sysop when needed.