Difference between revisions of "Mediawiki Security Matrix"

From Micylou WIKI
Jump to navigation Jump to search
m (Page creation)
m (Text replacement - "[{{fullurl:{{FULLPAGENAMEE}}|action=mpdf}} Download this page as PDF]" to "")
 
(15 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
Security matrix sample to set up in LocalSettings.php
+
<!-- Template Infobox Generic-->
 +
{{Template:Class-Infobox-Generic<!-- ALL MUST BE FILLED IN -->
 +
|image = <!-- If an logo is required, enter the link here -->
 +
|Section = [[Section::{{PAGENAME}}]]
 +
|Source = [[Source::DataSource]]  <!-- [[Source::DataSource]], [[Source::Query]] ... -->
 +
|Language = [[Language::English]] <!-- [[Language::English]], [[Language::Français]], [[Language::Nederlands]] -->
 +
|Topic =  [[Topic::Mediawiki]] <!-- [[Topic::Mediawiki]], [[Subject::Microsoft]], ... -->
 +
|SubTopic = [[SubTopic::Security]] <!-- [[SubTopic::Mediawiki Extension]], [[SubTopic::Office 365]] , ... -->
 +
        |DocumentType =  [[DocumentType::Documentation]] <!-- [[DocumentType::User Guide]], [[DocumentType::Procedure]], [[DocumentType::Script]], [[DocumentType::Gallery]], ...-->
 +
|LastEditBy = [[LastEditBy::{{REVISIONUSER}}]]
 +
|LastEdit = [[LastEdit::{{REVISIONYEAR}}-{{REVISIONMONTH}}-{{REVISIONDAY2}}]]
 +
|Status = [[Status::Active]] <!--[[Status::Active]]  [[Status::Development]] [[Status::Obsolete]] [[Status::Archived]] [[Status::To Delete]]-->
 +
|Access = [[Access::free]] <!--[[Access::free]] [[Access::Private]] [[Access::Subscription]] -->
 +
<!-- Template version 1.01 -->
 +
}}
 +
<!-- End of Template Infobox Generic-->
  
 +
== Micylou Standard Mediawiki Security Matrix ==
 +
=== Defaults ===
 +
Micylou builds a start-up solution based on the original Mediawiki LTS package and includes additional extensions to build its start-up solution.
 +
 +
Therefore, the roles and rights included in these extensions are taken into account, even if the extension is not activated.
 +
 +
=== Roles by groups ===
 +
{| class="wikitable sortable"
 +
|-
 +
! Source !! Permission !! Description !! By default !! As from !! * Reset !! * Granted !! User Reset !! User Granted !! administrator Granted!| sysop Granted !! Bot Granted !! Bureaucrat Granted !! Linux-Admin Granted !! Wiki-Admin Granted !! Wiki-Moderator Granted !! Wiki-Editor Granted !! Wiki-Updater Granted
 +
|-
 +
| Default Mediawiki || apihighlimits || Use higher limits in API queries || bot, sysop || 1.12+
 +
|-
 +
| Default Mediawiki || applychangetags || Apply tags along with one's changes || user || 1.25+ ||  ||  || X ||  || X|| X ||  ||  ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || autoconfirmed || Not be affected by IP-based rate limits - used for the 'autoconfirmed' group, see the other table below for more information || autoconfirmed, bot, sysop || 1.6+
 +
|-
 +
| Default Mediawiki || autocreateaccount || Automatically log in with an external user account - a more limited version of createaccount || — || 1.27+ ||  || X ||  || LDAP REQUIREMENT
 +
|-
 +
| Default Mediawiki || autopatrol || Have one's own edits automatically marked as patrolled - $wgUseRCPatrol must be true || bot, sysop || 1.9+ ||  ||  ||  ||  || ||  ||  ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || bigdelete || Delete pages with large histories (as determined by $wgDeleteRevisionsLimit) || sysop || 1.12+ ||  ||  ||  ||  || || X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || block || Block other users from editing - Block options include preventing editing and registering new accounts, and autoblocking other users on the same IP address || sysop || 1.5+ ||  ||  ||  ||  || || X ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || blockemail || Block a user from sending email - allows preventing use of the Special:Emailuser interface when blocking - requires the block right || sysop || 1.11+ ||  ||  ||  ||  || || X ||  ||  || X || X || X
 +
|-
 +
| Default Mediawiki || bot || Be treated as an automated process - can optionally be viewed || bot || 1.5+
 +
|-
 +
| Default Mediawiki || browsearchive || Search deleted pages - through Special:Undelete || sysop || 1.13+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X || X || X
 +
|-
 +
| Default Mediawiki || changetags || Add and remove arbitrary tags on individual revisions and log entries - currently unused by extensions || user || 1.25+ || X ||  || X ||  || X|| X ||  ||  ||  || X || X || X
 +
|-
 +
| Default Mediawiki || createaccount || Create new user accounts - register / registration || *, sysop || 1.5+ || X ||  ||  ||  || X|| X ||  || X ||  || X
 +
|-
 +
| Default Mediawiki || createpage || Create pages (which are not discussion pages) - requires the edit right || *, user || 1.6+ || X ||  || X ||  || X|| X ||  ||  ||  || X || X || X || X
 +
|-
 +
| Default Mediawiki || createtalk || Create discussion pages - requires the edit right || *, user || 1.6+ || X ||  || X ||  || ||  ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || delete || allows the deletion or undeletion of pages. || sysop || 1.5+ ||  ||  ||  ||  || X|| X ||  ||  || X || X || X || X || X
 +
|-
 +
| Default Mediawiki || deletechangetags || Delete tags from the database - currently unused by extensions || sysop || 1.28+ ||  ||  ||  ||  || ||  ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || deletedhistory || View deleted history entries, without their associated text || sysop || 1.6+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X || X || X || X
 +
|-
 +
| Default Mediawiki || deletedtext || View deleted text and changes between deleted revisions || sysop ||  ||  ||  ||  ||  || X|| X ||  ||  ||  || X || X || X || X
 +
|-
 +
| Default Mediawiki || deletelogentry || Delete and undelete specific log entries - allows deleting/undeleting information (action text, summary, user who made the action) of specific log entries - requires the deleterevision right (not available by default) || sysop || 1.20+ ||  ||  ||  ||  || X|| X
 +
|-
 +
| Default Mediawiki || deleterevision || Delete and undelete specific revisions of pages - allows deleting/undeleting information (revision text, edit summary, user who made the edit) of specific revisions Split into deleterevision and deletelogentry in 1.20 (not available by default) || sysop || 1.6+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X || X || X
 +
|-
 +
| Default Mediawiki || edit || Edit pages || *, user || 1.5+ || X ||  || X ||  || X|| X ||  ||  ||  ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || editcontentmodel || Edit the content model of a page || user || 1.23.7+ || X ||  || X ||  || X|| X ||  ||  ||  || X || X || X
 +
|-
 +
| Default Mediawiki || editinterface || Edit the user interface - contains interface messages. For editing sitewide CSS/JSON/JS, there are now segregate rights, see below. || sysop, interface-admin || 1.5+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || editmyoptions || Edit your own preferences || * || 1.22+ || X ||  ||  ||  || X|| X ||  ||  ||  || X || X || X || X
 +
|-
 +
| Default Mediawiki || editmyprivateinfo || Edit your own private data (e.g. email address, real name) || * || 1.22+ || X ||  ||  ||  || X|| X ||  ||  ||  || X || X || X || X
 +
|-
 +
| Default Mediawiki || editmyusercss || Edit your own user CSS files - prior to 1.31 it was assigned to everyone (i.e. "*") (note that this is not needed if the group already has the editusercss right) || user || 1.22+ ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || editmyuserjs || Edit your own user JavaScript files - prior to 1.31 it was assigned to everyone (i.e. "*") (note that this is not needed if the group already has the edituserjs right) || user || 1.22+ ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || editmyuserjson || Edit your own user JSON files (note that this is not needed if the group already has the edituserjson right) || user || 1.31+ ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || editmywatchlist || Edit your own watchlist. Note some actions will still add pages even without this right. || * || 1.22+ ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || editprotected || Edit pages protected as "Allow only administrators" - without cascading protection || sysop || 1.13+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X || X || X
 +
|-
 +
| Default Mediawiki || editsemiprotected || Edit pages protected as "Allow only autoconfirmed users" - without cascading protection || autoconfirmed, bot, sysop || 1.22+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X || X || X
 +
|-
 +
| Default Mediawiki || editsitecss || Edit sitewide CSS || interface-admin || 1.32+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || editsitejs || Edit sitewide JavaScript || interface-admin || 1.32+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || editsitejson || Edit sitewide JSON || sysop, interface-admin || 1.32+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || editusercss || Edit other users' CSS files || interface-admin || 1.16+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || edituserjs || Edit other users' JavaScript files || interface-admin || 1.16+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || edituserjson || Edit other users' JSON files || sysop, interface-admin || 1.31+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || hideuser || Block a username, hiding it from the public - (not available by default) || — || 1.10+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || import || Import pages from other wikis - “transwiki” || sysop || 1.5+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X ||  || X
 +
|-
 +
| Default Mediawiki || importupload || Import pages from a file upload - This right was called 'importraw' in and before version 1.5 || sysop || 1.5+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || ipblock-exempt || Bypass IP blocks, auto-blocks and range blocks || sysop || 1.9+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || managechangetags || Create and (de)activate tags - currently unused by extensions || sysop || 1.25+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || markbotedits || Mark rolled-back edits as bot edits - see Manual:Administrators#Rollback || sysop || 1.12+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || mergehistory || Merge the history of pages || sysop || 1.12+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || minoredit || Mark edits as minor || user || 1.6+ ||  ||  || X ||  || X|| X ||  ||  ||  || X ||  || X || X
 +
|-
 +
| Default Mediawiki || move || Move pages - requires the edit right || user, sysop || 1.5+ ||  ||  || X ||  || X|| X ||  ||  ||  || X ||  || X || X
 +
|-
 +
| Default Mediawiki || move-categorypages || Move category pages - requires the move right || user, sysop || 1.25+ ||  ||  || X ||  || X|| X ||  ||  ||  || X ||  || X
 +
|-
 +
| Default Mediawiki || movefile || Move files - requires the move right and $wgAllowImageMoving to be true || user, sysop || 1.14+ ||  ||  || X ||  || X|| X ||  ||  ||  || X ||  || X
 +
|-
 +
| Default Mediawiki || move-rootuserpages || Move root user pages - requires the move right || user, sysop || 1.14+ ||  ||  || X ||  || X|| X ||  ||  ||  || X ||  || X
 +
|-
 +
| Default Mediawiki || move-subpages || Move pages with their subpages - requires the move right || user, sysop || 1.13+ ||  ||  || X ||  || X|| X ||  ||  ||  || X ||  || X
 +
|-
 +
| Default Mediawiki || nominornewtalk  || Not have minor edits to discussion pages trigger the new messages prompt - requires the minor edit right || bot || 1.9+
 +
|-
 +
| Default Mediawiki || noratelimit || Not be affected by rate limits - not affected by rate limits (prior to the introduction of this right, the configuration variable $wgRateLimitsExcludedGroups was used for this purpose) || sysop, bureaucrat || 1.13+ ||  ||  ||  ||  || X|| X ||  || X ||  || X
 +
|-
 +
| Default Mediawiki || override-export-depth || Export pages including linked pages up to a depth of 5 || — || ? || X ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || pagelang || Change page language - $wgPageLanguageUseDB must be true || — || 1.24+ || X ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || patrol || Mark others' edits as patrolled - $wgUseRCPatrol must be true || sysop || 1.5+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || patrolmarks || View recent changes patrol marks || — || 1.16+ || X ||  ||  ||  || X|| X ||  ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || protect || Change protection levels and edit cascade-protected pages || sysop || 1.5+ ||  ||  ||  ||  || X|| X ||  ||  ||  ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || purge || Purge the site cache for a page - URL parameter "&action=purge" || user || 1.10+ ||  ||  || X ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || read || Read pages - when set to false, override for specific pages with $wgWhitelistRead ||  || 1.5+ || X ||  ||  || X
 +
|-
 +
| Default Mediawiki || readapi ||  || *, user, bot || 1.13+ || X ||  || X ||  || X|| X || X || X || X || X || X || X || X
 +
|-
 +
| Default Mediawiki || reupload || Overwrite existing files - requires the upload right || user, sysop || 1.6+ ||  ||  || X ||  || X|| X ||  ||  ||  || X || X || X || X
 +
|-
 +
| Default Mediawiki || reupload-own || Overwrite existing files uploaded by oneself - requires the upload right (note that this is not needed if the group already has the reupload right) || — || 1.11+ || X ||  ||  ||  || X|| X ||  ||  ||  || X || X || X || X
 +
|-
 +
| Default Mediawiki || reupload-shared || Override files on the shared media repository locally - (if one is set up) with local files (requires the upload right) || user, sysop || 1.6+ ||  ||  || X ||  || X|| X ||  ||  ||  || X || X || X || X
 +
|-
 +
| Default Mediawiki || rollback || Quickly rollback the edits of the last user who edited a particular page || sysop || 1.5+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || sendemail || Send email to other users || user || 1.16+ ||  ||  || X ||  || X|| X ||  || X || X || X || X || X || X
 +
|-
 +
| Default Mediawiki || siteadmin || Lock and unlock the database - which blocks all interactions with the web site except viewing. (not available by default) || — || 1.5+ ||  ||  ||  ||  || X|| X ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || suppressionlog || View private logs || — || 1.6+ ||  ||  ||  ||  || X|| X ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || suppressredirect || Not create redirects from source pages when moving pages || bot, sysop || 1.12+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || suppressrevision || View, hide and unhide specific revisions of pages from any user - Prior to 1.13 this right was named hiderevision (not available by default) || — || 1.6+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || unblockself || Unblock oneself - Without it, an administrator that has the capability to block cannot unblock themselves if blocked by another administrator || sysop || 1.17+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || undelete || Undelete a page - requires the deletedhistory right || sysop || 1.12+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X || X || X
 +
|-
 +
| Default Mediawiki || unwatchedpages || View a list of unwatched pages - lists pages that no user has watchlisted || sysop || 1.6+ ||  ||  ||  ||  || X|| X ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || upload || Upload files - requires the edit right and $wgEnableUploads to be true || user, sysop || 1.5+ ||  ||  || X ||  || X|| X ||  || X || X || X || X || X || X
 +
|-
 +
| Default Mediawiki || upload_by_url || Upload files from a URL - requires the upload right (Prior to 1.20 it was given to sysops) || — || 1.8+ ||  ||  ||  ||  || || X ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || userrights || Edit all user rights - allows the assignment or removal of all* groups to any user. || bureaucrat || 1.5+ ||  ||  ||  ||  || X|| X ||  || X ||  || X
 +
|-
 +
| Default Mediawiki || userrights-interwiki || Edit user rights of users on other wikis || — || 1.12+ ||  ||  ||  ||  || || X ||  ||  || X || X
 +
|-
 +
| Default Mediawiki || viewmyprivateinfo || View your own private data (e.g. email address, real name) || * || 1.22+ || X ||  ||  || X
 +
|-
 +
| Default Mediawiki || viewmywatchlist || View your own watchlist || * || 1.22+ || X ||  ||  || X
 +
|-
 +
| Default Mediawiki || viewsuppressed || View revisions hidden from any user - i.e. a more narrow alternative to "suppressrevision" (note that this is not needed if the group already has the suppressrevision right) || — || 1.24+ ||  ||  ||  ||  || X|| X ||  ||  ||  ||  ||  || X
 +
|-
 +
| Default Mediawiki || writeapi || Use of the write API || *, user, bot || 1.13+ || X ||  || X ||  || X|| X || X || X || X || X || X || X || X
 +
|-
 +
| ExtensionRevsApprove || $egApprovedRevsBlankIfUnapproved ||  || FALSE
 +
|-
 +
| ExtensionRevsApprove || $egApprovedRevsShowApproveLatest ||  || TRUE
 +
|-
 +
| ExtensionRevsApprove || $egApprovedRevsShowNotApprovedMessage  ||  || TRUE
 +
|-
 +
| ExtensionRevsApprove || approverevision ||  ||  ||  || X ||  || X ||  || X|| X ||  ||  ||  ||  || X
 +
|-
 +
| ExtensionRevsApprove || egApprovedRevsAuto$maticApprovals ||  || FALSE
 +
|-
 +
| ExtensionRevsApprove || egApprovedRevsBlan$kIfUnapproved ||  || FALSE
 +
|-
 +
| ExtensionRevsApprove || egApprovedRevsShowNotApprovedMessa$ge ||  || TRUE
 +
|-
 +
| ExtensionRevsApprove || viewapprover ||  ||  ||  || X ||  || X || X || X|| X || X || X || X || X || X || X || X
 +
|-
 +
| ExtensionRevsApprove || viewlinktolatest ||  ||  ||  || X ||  || X ||  || ||  ||  ||  ||  || X || X || X || X
 +
|-
 +
| Extention UserMerge || usermerge ||  ||  ||  ||  ||  ||  ||  || X|| X ||  || X ||  || X
 +
|-
 +
| Extension EditUser || edituser ||  ||  ||  ||  ||  ||  ||  || X|| X ||  || X
 +
|}
 +
 +
 +
<br><br>[[#Top|Back to top of this page]]
 +
<br><br>[[English|Back to Welcome Page]] <br><br>
 +
 +
=== Security matrix of our default solution set up in LocalSettings.php - restricted access ===
 +
{{#ifgroup:Micylou-restricted|
 +
<u>'''Note'''</u> : This part is only visible if user is logged and belongs to the Micylou-restricted security group.
 
<pre>
 
<pre>
 
# Security settings
 
# Security settings
−
###########################################
+
################################################
−
# Group restricted categories added by JP #
+
# Group restricted categories added by Micylou #
−
###########################################
+
################################################
 
# Activation of the extension            ############################################################
 
# Activation of the extension            ############################################################
 
require_once "$IP/extensions/RestrictAccessByCategoryAndGroup/RestrictAccessByCategoryAndGroup.php"; #
 
require_once "$IP/extensions/RestrictAccessByCategoryAndGroup/RestrictAccessByCategoryAndGroup.php"; #
Line 28: Line 244:
 
         $wgGroupPermissions['sysop']['Semantic-DBA'] = true;
 
         $wgGroupPermissions['sysop']['Semantic-DBA'] = true;
  
−
##################################
+
###############################################################################
−
# GLOBAL Group permissions reset # other default permissions remain unchanged
+
# GLOBAL Group permissions reset # other default permissions remain unchanged #
−
#############################################################################
+
###########################################################################################################
−
# Setting '*' to false doesn't disable rights for groups that have the right separately set to true!
+
# Setting '*' to false doesn't disable rights for groups that have the right separately set to true!     #
−
####################################################################################################
+
# To avoid bypass of security because of an update, each right disable command is repeated for each group #
 +
###########################################################################################################
 
# Non-registered users rights disabling
 
# Non-registered users rights disabling
 
$wgGroupPermissions['*']['approverevision']    = false;
 
$wgGroupPermissions['*']['approverevision']    = false;
Line 76: Line 293:
 
$wgGroupPermissions['*']['writeapi']    = false;
 
$wgGroupPermissions['*']['writeapi']    = false;
 
$wgGroupPermissions['*']['writeapi']    = false;
 
$wgGroupPermissions['*']['writeapi']    = false;
−
# Registered users rights disabling - to avoid right given by system/extension update
+
# Registered user group
 
$wgGroupPermissions['user']['approverevision']    = false;
 
$wgGroupPermissions['user']['approverevision']    = false;
 
$wgGroupPermissions['user']['approverevision']    = false;
 
$wgGroupPermissions['user']['approverevision']    = false;
Line 119: Line 336:
 
$wgGroupPermissions['user']['writeapi']    = false;
 
$wgGroupPermissions['user']['writeapi']    = false;
 
$wgGroupPermissions['user']['writeapi']    = false;
 
$wgGroupPermissions['user']['writeapi']    = false;
−
 
−
 
  
 
### Specific permissions (sub-)linked to user groups
 
### Specific permissions (sub-)linked to user groups
 
##### Image moving#####
 
##### Image moving#####
 
$wgAllowImageMoving = true; // by default to registered user groups who do have the $wgBlockDisablesLogin = true; // for sysop group
 
$wgAllowImageMoving = true; // by default to registered user groups who do have the $wgBlockDisablesLogin = true; // for sysop group
−
 
−
 
  
 
##### applychangetags #####
 
##### applychangetags #####
Line 582: Line 795:
  
 
##### upload #####
 
##### upload #####
−
##### To enable image uploads, make sure the 'images' directory is writable (chmod777), the $wgEnableUploads = true;
+
##### To enable image/file uploads, make sure the 'images' directory is writable (chmod777), and the $wgEnableUploads = true;
 
#####  Upload permissions ##### restricted to groups (requires createpage permission as well - each upload has one page create>
 
#####  Upload permissions ##### restricted to groups (requires createpage permission as well - each upload has one page create>
 +
$wgEnableUploads = true; // Enable uploads
 +
 
$wgGroupPermissions['administrator']['upload'] = true;
 
$wgGroupPermissions['administrator']['upload'] = true;
 
$wgGroupPermissions['sysop']['upload'] = true;
 
$wgGroupPermissions['sysop']['upload'] = true;
Line 592: Line 807:
 
$wgGroupPermissions['Wiki-Editor']['upload'] = true;
 
$wgGroupPermissions['Wiki-Editor']['upload'] = true;
 
$wgGroupPermissions['Wiki-Updater']['upload'] = true;
 
$wgGroupPermissions['Wiki-Updater']['upload'] = true;
 +
  # Configuration
 +
    #$wgUseImageMagick = true;
 +
    #$wgImageMagickConvertCommand = "/usr/bin/convert";
 +
    $wgEnableWriteAPI = true; // Enable the API
 +
    $wgAllowJavaUploads = true; // Solves problem with Office 2007 and newer files (docx, xlsx, etc.)
 +
    $wgFileExtensions = array('png','svg','gif','jpg','jpeg','doc','xls','pdf','ppt','tiff','bmp','docx','xlsx','pptx');
  
 
##### upload_by_url #####
 
##### upload_by_url #####
Line 630: Line 851:
 
$wgGroupPermissions['Wiki-Editor']['viewsuppressed'] = true;
 
$wgGroupPermissions['Wiki-Editor']['viewsuppressed'] = true;
  
−
##### writeapi #####
+
##### writeapi #####  
 
$wgGroupPermissions['administrator']['writeapi'] = true;
 
$wgGroupPermissions['administrator']['writeapi'] = true;
 
$wgGroupPermissions['sysop']['writeapi'] = true;
 
$wgGroupPermissions['sysop']['writeapi'] = true;
Line 668: Line 889:
  
  
 +
</pre>
 +
|<strong><big>View of the detailed Mediawiki Security Configuration is restricted.</big></strong>
  
−
 
+
<br><br>[[#Top|Back to top of this page]]
−
</pre>
+
<br><br>[[English|Back to Welcome Page]] <br><br>
 +
}}
  
 
[[Category:Wiki Administration]]
 
[[Category:Wiki Administration]]

Latest revision as of 13:56, 14 April 2021

Mediawiki Security Matrix
Source: DataSource
Language: English
Topic: Mediawiki
SubTopic: Security
Last Edit By: DochyJP
LastEdit: 2021-04-14
Document type: Documentation
Status: Active
Access: free

Micylou Standard Mediawiki Security Matrix

Defaults

Micylou builds a start-up solution based on the original Mediawiki LTS package and includes additional extensions to build its start-up solution.

Therefore, the roles and rights included in these extensions are taken into account, even if the extension is not activated.

Roles by groups

Source Permission Description By default As from * Reset * Granted User Reset User Granted sysop Granted Bot Granted Bureaucrat Granted Linux-Admin Granted Wiki-Admin Granted Wiki-Moderator Granted Wiki-Editor Granted Wiki-Updater Granted
Default Mediawiki apihighlimits Use higher limits in API queries bot, sysop 1.12+
Default Mediawiki applychangetags Apply tags along with one's changes user 1.25+ X X X X
Default Mediawiki autoconfirmed Not be affected by IP-based rate limits - used for the 'autoconfirmed' group, see the other table below for more information autoconfirmed, bot, sysop 1.6+
Default Mediawiki autocreateaccount Automatically log in with an external user account - a more limited version of createaccount — 1.27+ X LDAP REQUIREMENT
Default Mediawiki autopatrol Have one's own edits automatically marked as patrolled - $wgUseRCPatrol must be true bot, sysop 1.9+ X X
Default Mediawiki bigdelete Delete pages with large histories (as determined by $wgDeleteRevisionsLimit) sysop 1.12+ X X
Default Mediawiki block Block other users from editing - Block options include preventing editing and registering new accounts, and autoblocking other users on the same IP address sysop 1.5+ X X X
Default Mediawiki blockemail Block a user from sending email - allows preventing use of the Special:Emailuser interface when blocking - requires the block right sysop 1.11+ X X X X
Default Mediawiki bot Be treated as an automated process - can optionally be viewed bot 1.5+
Default Mediawiki browsearchive Search deleted pages - through Special:Undelete sysop 1.13+ X X X X X
Default Mediawiki changetags Add and remove arbitrary tags on individual revisions and log entries - currently unused by extensions user 1.25+ X X X X X X X
Default Mediawiki createaccount Create new user accounts - register / registration *, sysop 1.5+ X X X X X
Default Mediawiki createpage Create pages (which are not discussion pages) - requires the edit right *, user 1.6+ X X X X X X X X
Default Mediawiki createtalk Create discussion pages - requires the edit right *, user 1.6+ X X X
Default Mediawiki delete allows the deletion or undeletion of pages. sysop 1.5+ X X X X X X X
Default Mediawiki deletechangetags Delete tags from the database - currently unused by extensions sysop 1.28+ X
Default Mediawiki deletedhistory View deleted history entries, without their associated text sysop 1.6+ X X X X X X
Default Mediawiki deletedtext View deleted text and changes between deleted revisions sysop X X X X X X
Default Mediawiki deletelogentry Delete and undelete specific log entries - allows deleting/undeleting information (action text, summary, user who made the action) of specific log entries - requires the deleterevision right (not available by default) sysop 1.20+ X X
Default Mediawiki deleterevision Delete and undelete specific revisions of pages - allows deleting/undeleting information (revision text, edit summary, user who made the edit) of specific revisions Split into deleterevision and deletelogentry in 1.20 (not available by default) sysop 1.6+ X X X X X
Default Mediawiki edit Edit pages *, user 1.5+ X X X X X X
Default Mediawiki editcontentmodel Edit the content model of a page user 1.23.7+ X X X X X X X
Default Mediawiki editinterface Edit the user interface - contains interface messages. For editing sitewide CSS/JSON/JS, there are now segregate rights, see below. sysop, interface-admin 1.5+ X X X
Default Mediawiki editmyoptions Edit your own preferences * 1.22+ X X X X X X X
Default Mediawiki editmyprivateinfo Edit your own private data (e.g. email address, real name) * 1.22+ X X X X X X X
Default Mediawiki editmyusercss Edit your own user CSS files - prior to 1.31 it was assigned to everyone (i.e. "*") (note that this is not needed if the group already has the editusercss right) user 1.22+ X
Default Mediawiki editmyuserjs Edit your own user JavaScript files - prior to 1.31 it was assigned to everyone (i.e. "*") (note that this is not needed if the group already has the edituserjs right) user 1.22+ X
Default Mediawiki editmyuserjson Edit your own user JSON files (note that this is not needed if the group already has the edituserjson right) user 1.31+ X
Default Mediawiki editmywatchlist Edit your own watchlist. Note some actions will still add pages even without this right. * 1.22+ X
Default Mediawiki editprotected Edit pages protected as "Allow only administrators" - without cascading protection sysop 1.13+ X X X X X
Default Mediawiki editsemiprotected Edit pages protected as "Allow only autoconfirmed users" - without cascading protection autoconfirmed, bot, sysop 1.22+ X X X X X
Default Mediawiki editsitecss Edit sitewide CSS interface-admin 1.32+ X X X
Default Mediawiki editsitejs Edit sitewide JavaScript interface-admin 1.32+ X X X
Default Mediawiki editsitejson Edit sitewide JSON sysop, interface-admin 1.32+ X X X
Default Mediawiki editusercss Edit other users' CSS files interface-admin 1.16+ X X X
Default Mediawiki edituserjs Edit other users' JavaScript files interface-admin 1.16+ X X X
Default Mediawiki edituserjson Edit other users' JSON files sysop, interface-admin 1.31+ X X X
Default Mediawiki hideuser Block a username, hiding it from the public - (not available by default) — 1.10+ X X X X
Default Mediawiki import Import pages from other wikis - “transwiki” sysop 1.5+ X X X X
Default Mediawiki importupload Import pages from a file upload - This right was called 'importraw' in and before version 1.5 sysop 1.5+ X X X
Default Mediawiki ipblock-exempt Bypass IP blocks, auto-blocks and range blocks sysop 1.9+ X X X
Default Mediawiki managechangetags Create and (de)activate tags - currently unused by extensions sysop 1.25+ X X X
Default Mediawiki markbotedits Mark rolled-back edits as bot edits - see Manual:Administrators#Rollback sysop 1.12+ X X X
Default Mediawiki mergehistory Merge the history of pages sysop 1.12+ X X X
Default Mediawiki minoredit Mark edits as minor user 1.6+ X X X X X X
Default Mediawiki move Move pages - requires the edit right user, sysop 1.5+ X X X X X X
Default Mediawiki move-categorypages Move category pages - requires the move right user, sysop 1.25+ X X X X X
Default Mediawiki movefile Move files - requires the move right and $wgAllowImageMoving to be true user, sysop 1.14+ X X X X X
Default Mediawiki move-rootuserpages Move root user pages - requires the move right user, sysop 1.14+ X X X X X
Default Mediawiki move-subpages Move pages with their subpages - requires the move right user, sysop 1.13+ X X X X X
Default Mediawiki nominornewtalk Not have minor edits to discussion pages trigger the new messages prompt - requires the minor edit right bot 1.9+
Default Mediawiki noratelimit Not be affected by rate limits - not affected by rate limits (prior to the introduction of this right, the configuration variable $wgRateLimitsExcludedGroups was used for this purpose) sysop, bureaucrat 1.13+ X X X X
Default Mediawiki override-export-depth Export pages including linked pages up to a depth of 5 — ? X X X X
Default Mediawiki pagelang Change page language - $wgPageLanguageUseDB must be true — 1.24+ X X X X
Default Mediawiki patrol Mark others' edits as patrolled - $wgUseRCPatrol must be true sysop 1.5+ X X X
Default Mediawiki patrolmarks View recent changes patrol marks — 1.16+ X X X X X
Default Mediawiki protect Change protection levels and edit cascade-protected pages sysop 1.5+ X X X X
Default Mediawiki purge Purge the site cache for a page - URL parameter "&action=purge" user 1.10+ X X X X
Default Mediawiki read Read pages - when set to false, override for specific pages with $wgWhitelistRead 1.5+ X X
Default Mediawiki readapi *, user, bot 1.13+ X X X X X X X X X X X
Default Mediawiki reupload Overwrite existing files - requires the upload right user, sysop 1.6+ X X X X X X X
Default Mediawiki reupload-own Overwrite existing files uploaded by oneself - requires the upload right (note that this is not needed if the group already has the reupload right) — 1.11+ X X X X X X X
Default Mediawiki reupload-shared Override files on the shared media repository locally - (if one is set up) with local files (requires the upload right) user, sysop 1.6+ X X X X X X X
Default Mediawiki rollback Quickly rollback the edits of the last user who edited a particular page sysop 1.5+ X X X X
Default Mediawiki sendemail Send email to other users user 1.16+ X X X X X X X X X
Default Mediawiki siteadmin Lock and unlock the database - which blocks all interactions with the web site except viewing. (not available by default) — 1.5+ X X X X
Default Mediawiki suppressionlog View private logs — 1.6+ X X X X
Default Mediawiki suppressredirect Not create redirects from source pages when moving pages bot, sysop 1.12+ X X X
Default Mediawiki suppressrevision View, hide and unhide specific revisions of pages from any user - Prior to 1.13 this right was named hiderevision (not available by default) — 1.6+ X X X
Default Mediawiki unblockself Unblock oneself - Without it, an administrator that has the capability to block cannot unblock themselves if blocked by another administrator sysop 1.17+ X X X
Default Mediawiki undelete Undelete a page - requires the deletedhistory right sysop 1.12+ X X X X X
Default Mediawiki unwatchedpages View a list of unwatched pages - lists pages that no user has watchlisted sysop 1.6+ X X X
Default Mediawiki upload Upload files - requires the edit right and $wgEnableUploads to be true user, sysop 1.5+ X X X X X X X X X
Default Mediawiki upload_by_url Upload files from a URL - requires the upload right (Prior to 1.20 it was given to sysops) — 1.8+ X X X
Default Mediawiki userrights Edit all user rights - allows the assignment or removal of all* groups to any user. bureaucrat 1.5+ X X X X
Default Mediawiki userrights-interwiki Edit user rights of users on other wikis — 1.12+ X X X
Default Mediawiki viewmyprivateinfo View your own private data (e.g. email address, real name) * 1.22+ X X
Default Mediawiki viewmywatchlist View your own watchlist * 1.22+ X X
Default Mediawiki viewsuppressed View revisions hidden from any user - i.e. a more narrow alternative to "suppressrevision" (note that this is not needed if the group already has the suppressrevision right) — 1.24+ X X X
Default Mediawiki writeapi Use of the write API *, user, bot 1.13+ X X X X X X X X X X X
ExtensionRevsApprove $egApprovedRevsBlankIfUnapproved FALSE
ExtensionRevsApprove $egApprovedRevsShowApproveLatest TRUE
ExtensionRevsApprove $egApprovedRevsShowNotApprovedMessage TRUE
ExtensionRevsApprove approverevision X X X X X
ExtensionRevsApprove egApprovedRevsAuto$maticApprovals FALSE
ExtensionRevsApprove egApprovedRevsBlan$kIfUnapproved FALSE
ExtensionRevsApprove egApprovedRevsShowNotApprovedMessa$ge TRUE
ExtensionRevsApprove viewapprover X X X X X X X X X X X X
ExtensionRevsApprove viewlinktolatest X X X X X X
Extention UserMerge usermerge X X X X
Extension EditUser edituser X X X




Back to top of this page

Back to Welcome Page

Security matrix of our default solution set up in LocalSettings.php - restricted access

View of the detailed Mediawiki Security Configuration is restricted.



Back to top of this page

Back to Welcome Page

Retrieved from "https://wiki.micylou.com/index.php?title=Mediawiki_Security_Matrix&oldid=773"