Mediawiki Security Matrix

From Micylou WIKI
Revision as of 14:25, 26 February 2021 by DochyJP (talk | contribs) (Changed Infobox)
Jump to navigation Jump to search
Mediawiki Security Matrix
Source: DataSource
Language: English
Topic: Mediawiki
SubTopic: Security
Last Edit By: DochyJP
LastEdit: 2021-02-26
Document type: Documentation
Status: Active

Micylou Standard Mediawiki Security Matrix

Defaults

Micylou builds a start-up solution based on the original Mediawiki LTS package and includes additional extensions to build its start-up solution.

Therefore, the roles and rights included in these extensions are taken into account, even if the extension is not activated.

Roles by groups

Source Permission Description By default As from * Reset * Granted User Reset User Granted sysop Granted Bot Granted Bureaucrat Granted Linux-Admin Granted Wiki-Admin Granted Wiki-Moderator Granted Wiki-Editor Granted Wiki-Updater Granted
Default Mediawiki apihighlimits Use higher limits in API queries bot, sysop 1.12+
Default Mediawiki applychangetags Apply tags along with one's changes user 1.25+ X X X X
Default Mediawiki autoconfirmed Not be affected by IP-based rate limits - used for the 'autoconfirmed' group, see the other table below for more information autoconfirmed, bot, sysop 1.6+
Default Mediawiki autocreateaccount Automatically log in with an external user account - a more limited version of createaccount — 1.27+ X LDAP REQUIREMENT
Default Mediawiki autopatrol Have one's own edits automatically marked as patrolled - $wgUseRCPatrol must be true bot, sysop 1.9+ X X
Default Mediawiki bigdelete Delete pages with large histories (as determined by $wgDeleteRevisionsLimit) sysop 1.12+ X X
Default Mediawiki block Block other users from editing - Block options include preventing editing and registering new accounts, and autoblocking other users on the same IP address sysop 1.5+ X X X
Default Mediawiki blockemail Block a user from sending email - allows preventing use of the Special:Emailuser interface when blocking - requires the block right sysop 1.11+ X X X X
Default Mediawiki bot Be treated as an automated process - can optionally be viewed bot 1.5+
Default Mediawiki browsearchive Search deleted pages - through Special:Undelete sysop 1.13+ X X X X X
Default Mediawiki changetags Add and remove arbitrary tags on individual revisions and log entries - currently unused by extensions user 1.25+ X X X X X X X
Default Mediawiki createaccount Create new user accounts - register / registration *, sysop 1.5+ X X X X X
Default Mediawiki createpage Create pages (which are not discussion pages) - requires the edit right *, user 1.6+ X X X X X X X X
Default Mediawiki createtalk Create discussion pages - requires the edit right *, user 1.6+ X X X
Default Mediawiki delete allows the deletion or undeletion of pages. sysop 1.5+ X X X X X X X
Default Mediawiki deletechangetags Delete tags from the database - currently unused by extensions sysop 1.28+ X
Default Mediawiki deletedhistory View deleted history entries, without their associated text sysop 1.6+ X X X X X X
Default Mediawiki deletedtext View deleted text and changes between deleted revisions sysop X X X X X X
Default Mediawiki deletelogentry Delete and undelete specific log entries - allows deleting/undeleting information (action text, summary, user who made the action) of specific log entries - requires the deleterevision right (not available by default) sysop 1.20+ X X
Default Mediawiki deleterevision Delete and undelete specific revisions of pages - allows deleting/undeleting information (revision text, edit summary, user who made the edit) of specific revisions Split into deleterevision and deletelogentry in 1.20 (not available by default) sysop 1.6+ X X X X X
Default Mediawiki edit Edit pages *, user 1.5+ X X X X X X
Default Mediawiki editcontentmodel Edit the content model of a page user 1.23.7+ X X X X X X X
Default Mediawiki editinterface Edit the user interface - contains interface messages. For editing sitewide CSS/JSON/JS, there are now segregate rights, see below. sysop, interface-admin 1.5+ X X X
Default Mediawiki editmyoptions Edit your own preferences * 1.22+ X X X X X X X
Default Mediawiki editmyprivateinfo Edit your own private data (e.g. email address, real name) * 1.22+ X X X X X X X
Default Mediawiki editmyusercss Edit your own user CSS files - prior to 1.31 it was assigned to everyone (i.e. "*") (note that this is not needed if the group already has the editusercss right) user 1.22+ X
Default Mediawiki editmyuserjs Edit your own user JavaScript files - prior to 1.31 it was assigned to everyone (i.e. "*") (note that this is not needed if the group already has the edituserjs right) user 1.22+ X
Default Mediawiki editmyuserjson Edit your own user JSON files (note that this is not needed if the group already has the edituserjson right) user 1.31+ X
Default Mediawiki editmywatchlist Edit your own watchlist. Note some actions will still add pages even without this right. * 1.22+ X
Default Mediawiki editprotected Edit pages protected as "Allow only administrators" - without cascading protection sysop 1.13+ X X X X X
Default Mediawiki editsemiprotected Edit pages protected as "Allow only autoconfirmed users" - without cascading protection autoconfirmed, bot, sysop 1.22+ X X X X X
Default Mediawiki editsitecss Edit sitewide CSS interface-admin 1.32+ X X X
Default Mediawiki editsitejs Edit sitewide JavaScript interface-admin 1.32+ X X X
Default Mediawiki editsitejson Edit sitewide JSON sysop, interface-admin 1.32+ X X X
Default Mediawiki editusercss Edit other users' CSS files interface-admin 1.16+ X X X
Default Mediawiki edituserjs Edit other users' JavaScript files interface-admin 1.16+ X X X
Default Mediawiki edituserjson Edit other users' JSON files sysop, interface-admin 1.31+ X X X
Default Mediawiki hideuser Block a username, hiding it from the public - (not available by default) — 1.10+ X X X X
Default Mediawiki import Import pages from other wikis - “transwiki” sysop 1.5+ X X X X
Default Mediawiki importupload Import pages from a file upload - This right was called 'importraw' in and before version 1.5 sysop 1.5+ X X X
Default Mediawiki ipblock-exempt Bypass IP blocks, auto-blocks and range blocks sysop 1.9+ X X X
Default Mediawiki managechangetags Create and (de)activate tags - currently unused by extensions sysop 1.25+ X X X
Default Mediawiki markbotedits Mark rolled-back edits as bot edits - see Manual:Administrators#Rollback sysop 1.12+ X X X
Default Mediawiki mergehistory Merge the history of pages sysop 1.12+ X X X
Default Mediawiki minoredit Mark edits as minor user 1.6+ X X X X X X
Default Mediawiki move Move pages - requires the edit right user, sysop 1.5+ X X X X X X
Default Mediawiki move-categorypages Move category pages - requires the move right user, sysop 1.25+ X X X X X
Default Mediawiki movefile Move files - requires the move right and $wgAllowImageMoving to be true user, sysop 1.14+ X X X X X
Default Mediawiki move-rootuserpages Move root user pages - requires the move right user, sysop 1.14+ X X X X X
Default Mediawiki move-subpages Move pages with their subpages - requires the move right user, sysop 1.13+ X X X X X
Default Mediawiki nominornewtalk Not have minor edits to discussion pages trigger the new messages prompt - requires the minor edit right bot 1.9+
Default Mediawiki noratelimit Not be affected by rate limits - not affected by rate limits (prior to the introduction of this right, the configuration variable $wgRateLimitsExcludedGroups was used for this purpose) sysop, bureaucrat 1.13+ X X X X
Default Mediawiki override-export-depth Export pages including linked pages up to a depth of 5 — ? X X X X
Default Mediawiki pagelang Change page language - $wgPageLanguageUseDB must be true — 1.24+ X X X X
Default Mediawiki patrol Mark others' edits as patrolled - $wgUseRCPatrol must be true sysop 1.5+ X X X
Default Mediawiki patrolmarks View recent changes patrol marks — 1.16+ X X X X X
Default Mediawiki protect Change protection levels and edit cascade-protected pages sysop 1.5+ X X X X
Default Mediawiki purge Purge the site cache for a page - URL parameter "&action=purge" user 1.10+ X X X X
Default Mediawiki read Read pages - when set to false, override for specific pages with $wgWhitelistRead 1.5+ X X
Default Mediawiki readapi *, user, bot 1.13+ X X X X X X X X X X X
Default Mediawiki reupload Overwrite existing files - requires the upload right user, sysop 1.6+ X X X X X X X
Default Mediawiki reupload-own Overwrite existing files uploaded by oneself - requires the upload right (note that this is not needed if the group already has the reupload right) — 1.11+ X X X X X X X
Default Mediawiki reupload-shared Override files on the shared media repository locally - (if one is set up) with local files (requires the upload right) user, sysop 1.6+ X X X X X X X
Default Mediawiki rollback Quickly rollback the edits of the last user who edited a particular page sysop 1.5+ X X X X
Default Mediawiki sendemail Send email to other users user 1.16+ X X X X X X X X X
Default Mediawiki siteadmin Lock and unlock the database - which blocks all interactions with the web site except viewing. (not available by default) — 1.5+ X X X X
Default Mediawiki suppressionlog View private logs — 1.6+ X X X X
Default Mediawiki suppressredirect Not create redirects from source pages when moving pages bot, sysop 1.12+ X X X
Default Mediawiki suppressrevision View, hide and unhide specific revisions of pages from any user - Prior to 1.13 this right was named hiderevision (not available by default) — 1.6+ X X X
Default Mediawiki unblockself Unblock oneself - Without it, an administrator that has the capability to block cannot unblock themselves if blocked by another administrator sysop 1.17+ X X X
Default Mediawiki undelete Undelete a page - requires the deletedhistory right sysop 1.12+ X X X X X
Default Mediawiki unwatchedpages View a list of unwatched pages - lists pages that no user has watchlisted sysop 1.6+ X X X
Default Mediawiki upload Upload files - requires the edit right and $wgEnableUploads to be true user, sysop 1.5+ X X X X X X X X X
Default Mediawiki upload_by_url Upload files from a URL - requires the upload right (Prior to 1.20 it was given to sysops) — 1.8+ X X X
Default Mediawiki userrights Edit all user rights - allows the assignment or removal of all* groups to any user. bureaucrat 1.5+ X X X X
Default Mediawiki userrights-interwiki Edit user rights of users on other wikis — 1.12+ X X X
Default Mediawiki viewmyprivateinfo View your own private data (e.g. email address, real name) * 1.22+ X X
Default Mediawiki viewmywatchlist View your own watchlist * 1.22+ X X
Default Mediawiki viewsuppressed View revisions hidden from any user - i.e. a more narrow alternative to "suppressrevision" (note that this is not needed if the group already has the suppressrevision right) — 1.24+ X X X
Default Mediawiki writeapi Use of the write API *, user, bot 1.13+ X X X X X X X X X X X
ExtensionRevsApprove $egApprovedRevsBlankIfUnapproved FALSE
ExtensionRevsApprove $egApprovedRevsShowApproveLatest TRUE
ExtensionRevsApprove $egApprovedRevsShowNotApprovedMessage TRUE
ExtensionRevsApprove approverevision X X X X X
ExtensionRevsApprove egApprovedRevsAuto$maticApprovals FALSE
ExtensionRevsApprove egApprovedRevsBlan$kIfUnapproved FALSE
ExtensionRevsApprove egApprovedRevsShowNotApprovedMessa$ge TRUE
ExtensionRevsApprove viewapprover X X X X X X X X X X X X
ExtensionRevsApprove viewlinktolatest X X X X X X
Extention UserMerge usermerge X X X X
Extension EditUser edituser X X X




Back to top of this page

Back to Welcome Page


Security matrix of our default solution set up in LocalSettings.php

# Security settings
################################################
# Group restricted categories added by Micylou #
################################################
# Activation of the extension             ############################################################
require_once "$IP/extensions/RestrictAccessByCategoryAndGroup/RestrictAccessByCategoryAndGroup.php"; #
######################################################################################################
# PRIVATE GROUPS WITH RESTRICTED ACCESS #
#########################################
$wgGroupPermissions['Linux-Admin']['private'] = true;
$wgGroupPermissions['Wiki-Admin']['private'] = true;
$wgGroupPermissions['TKI-Restricted']['private'] = true;
$wgGroupPermissions['NTRK-Restricted']['private'] = true;
$wgGroupPermissions['Process-Restricted']['private'] = true;
$wgGroupPermissions['Wiki-Admin']['private'] = true;

# add an additional protection level restricting edit/move/etc.
        $wgRestrictionLevels[] = 'Process-Editor';
        $wgGroupPermissions['sysop']['Process-Editor'] = true;
        $wgGroupPermissions['Process-Restricted']['Process-Editor'] = true;
        $wgGroupPermissions['administrator']['Process-Editor'] = true;
        $wgGroupPermissions['Wiki-Admin']['Process-Editor'] = true;
        $wgGroupPermissions['Wiki-Admin']['Semantic-DBA'] = true;
        $wgGroupPermissions['administrator']['Semantic-DBA'] = true;
        $wgGroupPermissions['sysop']['Semantic-DBA'] = true;

###############################################################################
# GLOBAL Group permissions reset # other default permissions remain unchanged #
###########################################################################################################
# Setting '*' to false doesn't disable rights for groups that have the right separately set to true!      #
# To avoid bypass of security because of an update, each right disable command is repeated for each group #
###########################################################################################################
# Non-registered users rights disabling
$wgGroupPermissions['*']['approverevision']    = false;	
$wgGroupPermissions['*']['approverevision']    = false;
$wgGroupPermissions['*']['viewapprover']    = false;	
$wgGroupPermissions['*']['viewapprover']    = false;
$wgGroupPermissions['*']['viewlinktolatest']    = false;	
$wgGroupPermissions['*']['viewlinktolatest']    = false;
$wgGroupPermissions['*']['applychangetags']    = false;
$wgGroupPermissions['*']['changetags']    = false;	
$wgGroupPermissions['*']['changetags']    = false;
$wgGroupPermissions['*']['createaccount']    = false;	
$wgGroupPermissions['*']['createpage']    = false;	
$wgGroupPermissions['*']['createpage']    = false;
$wgGroupPermissions['*']['createtalk']    = false;	
$wgGroupPermissions['*']['createtalk']    = false;
$wgGroupPermissions['*']['edit']    = false;	
$wgGroupPermissions['*']['edit']    = false;
$wgGroupPermissions['*']['editcontentmodel']    = false;	
$wgGroupPermissions['*']['editcontentmodel']    = false;
$wgGroupPermissions['*']['editmyoptions']    = false;	
$wgGroupPermissions['*']['editmyprivateinfo']    = false;	
$wgGroupPermissions['*']['minoredit']    = false;
$wgGroupPermissions['*']['move']    = false;
$wgGroupPermissions['*']['move-categorypages']    = false;
$wgGroupPermissions['*']['movefile']    = false;
$wgGroupPermissions['*']['move-rootuserpages']    = false;
$wgGroupPermissions['*']['move-subpages']    = false;
$wgGroupPermissions['*']['override-export-depth']    = false;	
$wgGroupPermissions['*']['pagelang']    = false;	
$wgGroupPermissions['*']['patrolmarks']    = false;	
$wgGroupPermissions['*']['purge']    = false;
$wgGroupPermissions['*']['read']    = false;	
$wgGroupPermissions['*']['readapi']    = false;	
$wgGroupPermissions['*']['readapi']    = false;
$wgGroupPermissions['*']['reupload']    = false;
$wgGroupPermissions['*']['reupload-own']    = false;	
$wgGroupPermissions['*']['reupload-shared']    = false;
$wgGroupPermissions['*']['sendemail']    = false;
$wgGroupPermissions['*']['upload']    = false;
$wgGroupPermissions['*']['viewmyprivateinfo']    = false;	
$wgGroupPermissions['*']['viewmywatchlist']    = false;	
$wgGroupPermissions['*']['writeapi']    = false;	
$wgGroupPermissions['*']['writeapi']    = false;
# Registered user group
$wgGroupPermissions['user']['approverevision']    = false;	
$wgGroupPermissions['user']['approverevision']    = false;
$wgGroupPermissions['user']['viewapprover']    = false;	
$wgGroupPermissions['user']['viewapprover']    = false;
$wgGroupPermissions['user']['viewlinktolatest']    = false;	
$wgGroupPermissions['user']['viewlinktolatest']    = false;
$wgGroupPermissions['user']['applychangetags']    = false;
$wgGroupPermissions['user']['changetags']    = false;	
$wgGroupPermissions['user']['changetags']    = false;
$wgGroupPermissions['user']['createaccount']    = false;	
$wgGroupPermissions['user']['createpage']    = false;	
$wgGroupPermissions['user']['createpage']    = false;
$wgGroupPermissions['user']['createtalk']    = false;	
$wgGroupPermissions['user']['createtalk']    = false;
$wgGroupPermissions['user']['edit']    = false;	
$wgGroupPermissions['user']['edit']    = false;
$wgGroupPermissions['user']['editcontentmodel']    = false;	
$wgGroupPermissions['user']['editcontentmodel']    = false;
$wgGroupPermissions['user']['editmyoptions']    = false;	
$wgGroupPermissions['user']['editmyprivateinfo']    = false;	
$wgGroupPermissions['user']['minoredit']    = false;
$wgGroupPermissions['user']['move']    = false;
$wgGroupPermissions['user']['move-categorypages']    = false;
$wgGroupPermissions['user']['movefile']    = false;
$wgGroupPermissions['user']['move-rootuserpages']    = false;
$wgGroupPermissions['user']['move-subpages']    = false;
$wgGroupPermissions['user']['override-export-depth']    = false;	
$wgGroupPermissions['user']['pagelang']    = false;	
$wgGroupPermissions['user']['patrolmarks']    = false;	
$wgGroupPermissions['user']['purge']    = false;
$wgGroupPermissions['user']['read']    = true;	# Registered users can ready public files on the wiki.
$wgGroupPermissions['user']['readapi']    = false;	
$wgGroupPermissions['user']['readapi']    = false;
$wgGroupPermissions['user']['reupload']    = false;
$wgGroupPermissions['user']['reupload-own']    = false;	
$wgGroupPermissions['user']['reupload-shared']    = false;
$wgGroupPermissions['user']['sendemail']    = false;
$wgGroupPermissions['user']['upload']    = false;
$wgGroupPermissions['user']['viewmyprivateinfo']    = false;	
$wgGroupPermissions['user']['viewmywatchlist']    = false;	
$wgGroupPermissions['user']['writeapi']    = false;	
$wgGroupPermissions['user']['writeapi']    = false;

### Specific permissions (sub-)linked to user groups
##### Image moving#####
$wgAllowImageMoving = true; // by default to registered user groups who do have the $wgBlockDisablesLogin = true; // for sysop group

##### applychangetags #####
$wgGroupPermissions['administrator']['applychangetags'] = true;
$wgGroupPermissions['sysop']['applychangetags'] = true;
$wgGroupPermissions['Wiki-Editor']['applychangetags'] = true;

#### REVISIONS ####

# enabling ApproveRevs extension
        wfLoadExtension( 'ApprovedRevs' );
        $wgGroupPermissions['*']['viewlinktolatest'] = false;
        $wgGroupPermissions['sysop']['viewlinktolatest'] = true;
        $wgGroupPermissions['Wikidoc-Admin']['viewlinktolatest'] = true;
        $wgGroupPermissions['Wikidoc-Admin-Rev']['viewlinktolatest'] = true;

//'approverevisions' is the permission to approve and unapprove revisions of pages.
//       By default it is given to all members of the 'sysop' group
//'viewlinktolatest' is the "permission" to see a note at the top of pages that have an approved revision,
//       explaining that what the user is seeing is not necessarily the latest revision
//'viewapprover' is the "permission" to see another note at the top of pages that have an approved revision,
//       stating who last approved it. By default it is given to all members of the 'sysop' group
##### Approve Revision #####
        $wgGroupPermissions['administrator']['approverevisions'] = true;
        $wgGroupPermissions['sysop']['approverevisions'] = true; ### this is normally by default
        $wgGroupPermissions['Wikidoc-Admin-Rev']['approverevision'] = true;

##### View latest version link #####
        $wgGroupPermissions['*']['viewlinktolatest'] = false;
        $wgGroupPermissions['user']['viewlinktolatest'] = false;
        $wgGroupPermissions['sysop']['viewlinktolatest'] = true;
        $wgGroupPermissions['Wikidoc-Admin']['viewlinktolatest'] = true;
        $wgGroupPermissions['Wikidoc-Admin-Rev']['viewlinktolatest'] = true;

##### View Approver #####
        $wgGroupPermissions['user']['viewapprover'] = true;

##### Delete Revision #####
        $wgGroupPermissions['administrator']['deleterevision'] = true;
        $wgGroupPermissions['sysop']['deleterevision'] = true;
        $wgGroupPermissions['Wikidoc-Admin-Rev']['deleterevision'] = true;

//automatic approvals by groups with approverevision true
        $egApprovedRevsAutomaticApprovals = false;

//Displaying unapproved pages as blank
        $egApprovedRevsBlankIfUnapproved = false; ### to be set to true for clean-up

//Indicating unapproved pages
        $egApprovedRevsShowNotApprovedMessage = true;
        $egApprovedRevsShowApproveLatest = true;

##### ['autocreateaccount'] #####
$wgGroupPermissions['*']['autocreateaccount'] = true;

##### autopatrol #####
$wgGroupPermissions['Wiki-Admin']['autopatrol'] = true;
$wgGroupPermissions['Wiki-Moderator']['autopatrol'] = true;

##### bigdelete #####
$wgGroupPermissions['sysop']['bigdelete'] = true;
$wgGroupPermissions['Wiki-Admin']['bigdelete'] = true;

##### block #####
$wgGroupPermissions['sysop']['block'] = true;
$wgGroupPermissions['Linux-Admin']['block'] = true;
$wgGroupPermissions['Wiki-Admin']['block'] = true;

##### blockemail #####
$wgGroupPermissions['sysop']['blockemail'] = true;
$wgGroupPermissions['Linux-Admin']['blockemail'] = true;
$wgGroupPermissions['Wiki-Admin']['blockemail'] = true;
$wgGroupPermissions['Wiki-Moderator']['blockemail'] = true;

##### browsearchive #####
$wgGroupPermissions['administrator']['browsearchive'] = true;
$wgGroupPermissions['sysop']['browsearchive'] = true;
$wgGroupPermissions['Wiki-Admin']['browsearchive'] = true;
$wgGroupPermissions['Wiki-Moderator']['browsearchive'] = true;
$wgGroupPermissions['Wiki-Editor']['browsearchive'] = true;

##### changetags #####
$wgGroupPermissions['administrator']['changetags'] = true;
$wgGroupPermissions['sysop']['changetags'] = true;
$wgGroupPermissions['Wiki-Admin']['changetags'] = true;
$wgGroupPermissions['Wiki-Moderator']['changetags'] = true;
$wgGroupPermissions['Wiki-Editor']['changetags'] = true;

##### createaccount #####
$wgGroupPermissions['administrator']['createaccount'] = true;
$wgGroupPermissions['sysop']['createaccount'] = true;
$wgGroupPermissions['Bureaucrat']['createaccount'] = true;
$wgGroupPermissions['Wiki-Admin']['createaccount'] = true;

##### createpage #####
$wgGroupPermissions['administrator']['createpage'] = true;
$wgGroupPermissions['sysop']['createpage'] = true;
$wgGroupPermissions['Wiki-Admin']['createpage'] = true;
$wgGroupPermissions['Wiki-Moderator']['createpage'] = true;
$wgGroupPermissions['Wiki-Editor']['createpage'] = true;
$wgGroupPermissions['Wiki-Updater']['createpage'] = true;

##### createtalk #####
$wgGroupPermissions['administrator']['createtalk'] = true;
$wgGroupPermissions['sysop']['createtalk'] = true;
$wgGroupPermissions['Wiki-Admin']['createtalk'] = true;

##### delete #####
$wgGroupPermissions['administrator']['delete'] = true;
$wgGroupPermissions['sysop']['delete'] = true;
$wgGroupPermissions['Linux-Admin']['delete'] = true;	
$wgGroupPermissions['Wiki-Admin']['delete'] = true;	
$wgGroupPermissions['Wiki-Moderator']['delete'] = true;	
$wgGroupPermissions['Wiki-Editor']['delete'] = true;	
$wgGroupPermissions['Wiki-Updater']['delete'] = true;

##### deletechangetags #####
$wgGroupPermissions['Wiki-Admin']['deletechangetags'] = true;

##### deletedhistory #####
$wgGroupPermissions['administrator']['deletedhistory'] = true;	
$wgGroupPermissions['sysop']['deletedhistory'] = true;
$wgGroupPermissions['Wiki-Admin']['deletedhistory'] = true;	
$wgGroupPermissions['Wiki-Moderator']['deletedhistory'] = true;	
$wgGroupPermissions['Wiki-Editor']['deletedhistory'] = true;	
$wgGroupPermissions['Wiki-Updater']['deletedhistory'] = true;

##### deletedtext #####
$wgGroupPermissions['administrator']['deletedtext'] = true;	
$wgGroupPermissions['sysop']['deletedtext'] = true;
$wgGroupPermissions['Wiki-Admin']['deletedtext'] = true;	
$wgGroupPermissions['Wiki-Moderator']['deletedtext'] = true;	
$wgGroupPermissions['Wiki-Editor']['deletedtext'] = true;	
$wgGroupPermissions['Wiki-Updater']['deletedtext'] = true;

##### deletelogentry #####
$wgGroupPermissions['administrator']['deletelogentry'] = true;	
$wgGroupPermissions['sysop']['deletelogentry'] = true;

##### deleterevision #####
$wgGroupPermissions['administrator']['deleterevision'] = true;	
$wgGroupPermissions['sysop']['deleterevision'] = true;
$wgGroupPermissions['Wiki-Admin']['deleterevision'] = true;	
$wgGroupPermissions['Wiki-Moderator']['deleterevision'] = true;	
$wgGroupPermissions['Wiki-Editor']['deleterevision'] = true;


##### edit #####
$wgGroupPermissions['administrator']['edit'] = true;	
$wgGroupPermissions['sysop']['edit'] = true;
$wgGroupPermissions['Wiki-Editor']['edit'] = true;	
$wgGroupPermissions['Wiki-Updater']['edit'] = true;

##### editcontentmodel #####
$wgGroupPermissions['administrator']['editcontentmodel'] = true;
$wgGroupPermissions['sysop']['editcontentmodel'] = true;
$wgGroupPermissions['Wiki-Admin']['editcontentmodel'] = true;	
$wgGroupPermissions['Wiki-Moderator']['editcontentmodel'] = true;	
$wgGroupPermissions['Wiki-Editor']['editcontentmodel'] = true;

##### editinterface #####
$wgGroupPermissions['administrator']['editinterface'] = true;	
$wgGroupPermissions['sysop']['editinterface'] = true;
$wgGroupPermissions['Wiki-Admin']['editinterface'] = true;

##### editmyoptions #####
$wgGroupPermissions['administrator']['editmyoptions'] = true;	
$wgGroupPermissions['sysop']['editmyoptions'] = true;
$wgGroupPermissions['Wiki-Admin']['editmyoptions'] = true;	
$wgGroupPermissions['Wiki-Moderator']['editmyoptions'] = true;	
$wgGroupPermissions['Wiki-Editor']['editmyoptions'] = true;	
$wgGroupPermissions['Wiki-Updater']['editmyoptions'] = true;

##### editmyprivateinfo #####
$wgGroupPermissions['administrator']['editmyprivateinfo'] = true;	
$wgGroupPermissions['sysop']['editmyprivateinfo'] = true;
$wgGroupPermissions['Wiki-Admin']['editmyprivateinfo'] = true;	
$wgGroupPermissions['Wiki-Moderator']['editmyprivateinfo'] = true;	
$wgGroupPermissions['Wiki-Editor']['editmyprivateinfo'] = true;	
$wgGroupPermissions['Wiki-Updater']['editmyprivateinfo'] = true;

##### editmyusercss #####
$wgGroupPermissions['user']['editmyusercss'] = true;

##### editmyuserjs #####
$wgGroupPermissions['user']['editmyuserjs'] = true;

##### editmyuserjson #####
$wgGroupPermissions['user']['editmyuserjson'] = true;

##### editmywatchlist #####
$wgGroupPermissions['user']['editmywatchlist'] = true;

##### editprotected #####
$wgGroupPermissions['administrator']['editprotected'] = true;	
$wgGroupPermissions['sysop']['editprotected'] = true;
$wgGroupPermissions['Wiki-Admin']['editprotected'] = true;	
$wgGroupPermissions['Wiki-Moderator']['editprotected'] = true;	
$wgGroupPermissions['Wiki-Editor']['editprotected'] = true;

##### editsemiprotected #####
$wgGroupPermissions['administrator']['editsemiprotected'] = true;	
$wgGroupPermissions['sysop']['editsemiprotected'] = true;
$wgGroupPermissions['Wiki-Admin']['editsemiprotected'] = true;	
$wgGroupPermissions['Wiki-Moderator']['editsemiprotected'] = true;	
$wgGroupPermissions['Wiki-Editor']['editsemiprotected'] = true;

##### editsitecss #####
$wgGroupPermissions['administrator']['editsitecss'] = true;	
$wgGroupPermissions['sysop']['editsitecss'] = true;
$wgGroupPermissions['Wiki-Admin']['editsitecss'] = true;

##### editsitejs #####
$wgGroupPermissions['administrator']['editsitejs'] = true;	
$wgGroupPermissions['sysop']['editsitejs'] = true;
$wgGroupPermissions['Wiki-Admin']['editsitejs'] = true;

##### editsitejson #####
$wgGroupPermissions['administrator']['editsitejson'] = true;	
$wgGroupPermissions['sysop']['editsitejson'] = true;
$wgGroupPermissions['Wiki-Admin']['editsitejson'] = true;

##### editusercss #####
$wgGroupPermissions['administrator']['editusercss'] = true;	
$wgGroupPermissions['sysop']['editusercss'] = true;
$wgGroupPermissions['Wiki-Admin']['editusercss'] = true;

##### Extension EditUser #####
        // Activation
        wfLoadExtension( 'EditUser' );
        // Configuration
        $wgGroupPermissions['bureaucrat']['edituser'] = true;
        $wgGroupPermissions['sysop']['edituser-exempt'] = true;
	$wgGroupPermissions['administrator']['edituser'] = true;

##### edituserjs #####
$wgGroupPermissions['administrator']['edituserjs'] = true;	
$wgGroupPermissions['sysop']['edituserjs'] = true;
$wgGroupPermissions['Wiki-Admin']['edituserjs'] = true;

##### edituserjson  #####
$wgGroupPermissions['administrator']['edituserjson'] = true;	
$wgGroupPermissions['sysop']['edituserjson'] = true;
$wgGroupPermissions['Wiki-Admin']['edituserjson'] = true;

##### hideuser #####
$wgGroupPermissions['administrator']['hideuser'] = true;	
$wgGroupPermissions['sysop']['hideuser'] = true;
$wgGroupPermissions['Wiki-Admin']['hideuser'] = true;	$wgGroupPermissions['Wiki-Moderator']['hideuser'] = true;

##### import #####
$wgGroupPermissions['administrator']['import'] = true;
$wgGroupPermissions['sysop']['import'] = true;
$wgGroupPermissions['Wiki-Admin']['import'] = true;
$wgGroupPermissions['Wiki-Editor']['import'] = true;

##### importupload #####
$wgGroupPermissions['administrator']['importupload'] = true;	
$wgGroupPermissions['sysop']['importupload'] = true;
$wgGroupPermissions['Wiki-Admin']['importupload'] = true;

##### ipblock-exempt #####
$wgGroupPermissions['administrator']['ipblock-exempt'] = true;	
$wgGroupPermissions['sysop']['ipblock-exempt'] = true;	
$wgGroupPermissions['Wiki-Admin']['ipblock-exempt'] = true;

##### managechangetags #####
$wgGroupPermissions['administrator']['managechangetags'] = true;	
$wgGroupPermissions['sysop']['managechangetags'] = true;
$wgGroupPermissions['Wiki-Admin']['managechangetags'] = true;

##### markbotedits #####
$wgGroupPermissions['administrator']['markbotedits'] = true;	
$wgGroupPermissions['sysop']['markbotedits'] = true;	
$wgGroupPermissions['Wiki-Admin']['markbotedits'] = true;

##### mergehistory #####
$wgGroupPermissions['administrator']['mergehistory'] = true;	
$wgGroupPermissions['sysop']['mergehistory'] = true;
$wgGroupPermissions['Wiki-Admin']['mergehistory'] = true;

##### minoredit #####
$wgGroupPermissions['administrator']['minoredit'] = true;	
$wgGroupPermissions['sysop']['minoredit'] = true;
$wgGroupPermissions['Wiki-Admin']['minoredit'] = true;	
$wgGroupPermissions['Wiki-Editor']['minoredit'] = true;	
$wgGroupPermissions['Wiki-Updater']['minoredit'] = true;

##### move #####
$wgGroupPermissions['administrator']['move'] = true;	
$wgGroupPermissions['sysop']['move'] = true;				
$wgGroupPermissions['Wiki-Admin']['move'] = true;		
$wgGroupPermissions['Wiki-Editor']['move'] = true;	
$wgGroupPermissions['Wiki-Updater']['move'] = true;

##### move-categorypages #####
$wgGroupPermissions['administrator']['move-categorypages'] = true;	
$wgGroupPermissions['sysop']['move-categorypages'] = true;
$wgGroupPermissions['Wiki-Admin']['move-categorypages'] = true;	
$wgGroupPermissions['Wiki-Editor']['move-categorypages'] = true;

##### movefile #####
$wgGroupPermissions['administrator']['movefile'] = true;
$wgGroupPermissions['sysop']['movefile'] = true;	
$wgGroupPermissions['Wiki-Admin']['movefile'] = true;
$wgGroupPermissions['Wiki-Editor']['movefile'] = true;

##### move-rootuserpages #####
$wgGroupPermissions['administrator']['move-rootuserpages'] = true;	
$wgGroupPermissions['sysop']['move-rootuserpages'] = true;	
$wgGroupPermissions['Wiki-Admin']['move-rootuserpages'] = true;	
$wgGroupPermissions['Wiki-Editor']['move-rootuserpages'] = true;

##### move-subpages #####
$wgGroupPermissions['administrator']['move-subpages'] = true;
$wgGroupPermissions['sysop']['move-subpages'] = true;
$wgGroupPermissions['Wiki-Admin']['move-subpages'] = true;
$wgGroupPermissions['Wiki-Editor']['move-subpages'] = true;

##### nominornewtalk #####


##### noratelimit #####
$wgGroupPermissions['administrator']['noratelimit'] = true;	
$wgGroupPermissions['sysop']['noratelimit'] = true;		
$wgGroupPermissions['Bureaucrat']['noratelimit'] = true;		
$wgGroupPermissions['Wiki-Admin']['noratelimit'] = true;

##### override-export-depth #####
$wgGroupPermissions['administrator']['override-export-depth'] = true;
$wgGroupPermissions['sysop']['override-export-depth'] = true;
$wgGroupPermissions['Wiki-Admin']['override-export-depth'] = true;

##### pagelang #####
$wgGroupPermissions['administrator']['pagelang'] = true;
$wgGroupPermissions['sysop']['pagelang'] = true;
$wgGroupPermissions['Wiki-Admin']['pagelang'] = true;

##### patrol #####
$wgGroupPermissions['administrator']['patrol'] = true;	
$wgGroupPermissions['sysop']['patrol'] = true;	
$wgGroupPermissions['Wiki-Admin']['patrol'] = true;

##### patrolmarks #####
$wgGroupPermissions['administrator']['patrolmarks'] = true;
$wgGroupPermissions['sysop']['patrolmarks'] = true;
$wgGroupPermissions['Wiki-Admin']['patrolmarks'] = true;
$wgGroupPermissions['Wiki-Moderator']['patrolmarks'] = true;

##### protect #####
$wgGroupPermissions['administrator']['protect'] = true;	
$wgGroupPermissions['sysop']['protect'] = true;	
$wgGroupPermissions['Wiki-Admin']['protect'] = true;
$wgGroupPermissions['Wiki-Editor']['protect'] = true;
$wgGroupPermissions['Wiki-Updater']['protect'] = true;

##### purge #####
$wgGroupPermissions['administrator']['purge'] = true;	
$wgGroupPermissions['sysop']['purge'] = true;
$wgGroupPermissions['Wiki-Admin']['purge'] = true;

##### read #####
$wgGroupPermissions['user']['read'] = true;


##### readapi #####
$wgGroupPermissions['administrator']['readapi'] = true;	
$wgGroupPermissions['sysop']['readapi'] = true;	
$wgGroupPermissions['Bot']['readapi'] = true;	
$wgGroupPermissions['Bureaucrat']['readapi'] = true;	
$wgGroupPermissions['Linux-Admin']['readapi'] = true;	
$wgGroupPermissions['Wiki-Admin']['readapi'] = true;	
$wgGroupPermissions['Wiki-Moderator']['readapi'] = true;	
$wgGroupPermissions['Wiki-Editor']['readapi'] = true;	
$wgGroupPermissions['Wiki-Updater']['readapi'] = true;

##### reupload #####
$wgGroupPermissions['administrator']['reupload'] = true;
$wgGroupPermissions['sysop']['reupload'] = true;
$wgGroupPermissions['Wiki-Admin']['reupload'] = true;
$wgGroupPermissions['Wiki-Moderator']['reupload'] = true;
$wgGroupPermissions['Wiki-Editor']['reupload'] = true;
$wgGroupPermissions['Wiki-Updater']['reupload'] = true;

##### reupload-own #####
$wgGroupPermissions['administrator']['reupload-own'] = true;
$wgGroupPermissions['sysop']['reupload-own'] = true;
$wgGroupPermissions['Wiki-Admin']['reupload-own'] = true;
$wgGroupPermissions['Wiki-Moderator']['reupload-own'] = true;
$wgGroupPermissions['Wiki-Editor']['reupload-own'] = true;
$wgGroupPermissions['Wiki-Updater']['reupload-own'] = true;

##### reupload-shared #####
$wgGroupPermissions['administrator']['reupload-shared'] = true;
$wgGroupPermissions['sysop']['reupload-shared'] = true;	
$wgGroupPermissions['Wiki-Admin']['reupload-shared'] = true;
$wgGroupPermissions['Wiki-Moderator']['reupload-shared'] = true;
$wgGroupPermissions['Wiki-Editor']['reupload-shared'] = true;
$wgGroupPermissions['Wiki-Updater']['reupload-shared'] = true;

##### rollback #####
$wgGroupPermissions['administrator']['rollback'] = true;
$wgGroupPermissions['sysop']['rollback'] = true;
$wgGroupPermissions['Wiki-Admin']['rollback'] = true;
$wgGroupPermissions['Wiki-Moderator']['rollback'] = true;

##### sendemail #####
$wgGroupPermissions['administrator']['sendemail'] = true;
$wgGroupPermissions['sysop']['sendemail'] = true;
$wgGroupPermissions['Bureaucrat']['sendemail'] = true;
$wgGroupPermissions['Linux-Admin']['sendemail'] = true;
$wgGroupPermissions['Wiki-Admin']['sendemail'] = true;
$wgGroupPermissions['Wiki-Moderator']['sendemail'] = true;
$wgGroupPermissions['Wiki-Editor']['sendemail'] = true;
$wgGroupPermissions['Wiki-Updater']['sendemail'] = true;

##### siteadmin #####
$wgGroupPermissions['administrator']['siteadmin'] = true;
$wgGroupPermissions['sysop']['siteadmin'] = true;
$wgGroupPermissions['Linux-Admin']['siteadmin'] = true;
$wgGroupPermissions['Wiki-Admin']['siteadmin'] = true;

##### suppressionlog #####
$wgGroupPermissions['administrator']['suppressionlog'] = true;
$wgGroupPermissions['sysop']['suppressionlog'] = true;	
$wgGroupPermissions['Linux-Admin']['suppressionlog'] = true;
$wgGroupPermissions['Wiki-Admin']['suppressionlog'] = true;

##### suppressredirect #####
$wgGroupPermissions['administrator']['suppressredirect'] = true;
$wgGroupPermissions['sysop']['suppressredirect'] = true;
$wgGroupPermissions['Wiki-Admin']['suppressredirect'] = true;

##### suppressrevision #####
$wgGroupPermissions['administrator']['suppressrevision'] = true;
$wgGroupPermissions['sysop']['suppressrevision'] = true;
$wgGroupPermissions['Wiki-Admin']['suppressrevision'] = true;

##### unblockself #####
$wgGroupPermissions['administrator']['unblockself'] = true;
$wgGroupPermissions['sysop']['unblockself'] = true;
$wgGroupPermissions['Wiki-Admin']['unblockself'] = true;

##### undelete #####
$wgGroupPermissions['administrator']['undelete'] = true;
$wgGroupPermissions['sysop']['undelete'] = true;
$wgGroupPermissions['Wiki-Admin']['undelete'] = true;
$wgGroupPermissions['Wiki-Moderator']['undelete'] = true;
$wgGroupPermissions['Wiki-Editor']['undelete'] = true;

##### unwatchedpages #####
$wgGroupPermissions['administrator']['unwatchedpages'] = true;
$wgGroupPermissions['sysop']['unwatchedpages'] = true;	
$wgGroupPermissions['Wiki-Admin']['unwatchedpages'] = true;

##### upload #####
##### To enable image/file uploads, make sure the 'images' directory is writable (chmod777), and the $wgEnableUploads = true;
#####  Upload permissions ##### restricted to groups (requires createpage permission as well - each upload has one page create>
$wgEnableUploads = true; // Enable uploads

$wgGroupPermissions['administrator']['upload'] = true;
$wgGroupPermissions['sysop']['upload'] = true;
$wgGroupPermissions['Bureaucrat']['upload'] = true;
$wgGroupPermissions['Linux-Admin']['upload'] = true;
$wgGroupPermissions['Wiki-Admin']['upload'] = true;
$wgGroupPermissions['Wiki-Moderator']['upload'] = true;
$wgGroupPermissions['Wiki-Editor']['upload'] = true;
$wgGroupPermissions['Wiki-Updater']['upload'] = true;
   # Configuration
     #$wgUseImageMagick = true;
     #$wgImageMagickConvertCommand = "/usr/bin/convert";
     $wgEnableWriteAPI = true; // Enable the API
     $wgAllowJavaUploads = true; // Solves problem with Office 2007 and newer files (docx, xlsx, etc.)
     $wgFileExtensions = array('png','svg','gif','jpg','jpeg','doc','xls','pdf','ppt','tiff','bmp','docx','xlsx','pptx');

##### upload_by_url #####
$wgGroupPermissions['sysop']['upload_by_url'] = true;
$wgGroupPermissions['Linux-Admin']['upload_by_url'] = true;
$wgGroupPermissions['Wiki-Admin']['upload_by_url'] = true;

##### User Merge #####
        wfLoadExtension( 'UserMerge' );
        // By default nobody can use this function, enable for bureaucrat?
        $wgGroupPermissions['bureaucrat']['usermerge'] = true;
        $wgGroupPermissions['Wiki-Server-Admin']['usermerge'] = true;
        $wgGroupPermissions['sysop']['usermerge'] = true;
        // optional: default is array( 'sysop' )
        // $wgUserMergeProtectedGroups = array( 'groupname' );


##### userrights #####
$wgGroupPermissions['administrator']['userrights'] = true;
$wgGroupPermissions['sysop']['userrights'] = true;	
$wgGroupPermissions['Bureaucrat']['userrights'] = true;	
$wgGroupPermissions['Wiki-Admin']['userrights'] = true;

##### userrights-interwiki #####
$wgGroupPermissions['sysop']['userrights-interwiki'] = true;
$wgGroupPermissions['Linux-Admin']['userrights-interwiki'] = true;
$wgGroupPermissions['Wiki-Admin']['userrights-interwiki'] = true;

##### viewmyprivateinfo #####
$wgGroupPermissions['user']['viewmyprivateinfo'] = true;

##### viewmywatchlist #####
$wgGroupPermissions['user']['viewmywatchlist'] = true;

##### viewsuppressed #####
$wgGroupPermissions['administrator']['viewsuppressed'] = true;
$wgGroupPermissions['sysop']['viewsuppressed'] = true;	
$wgGroupPermissions['Wiki-Editor']['viewsuppressed'] = true;

##### writeapi ##### 
$wgGroupPermissions['administrator']['writeapi'] = true;
$wgGroupPermissions['sysop']['writeapi'] = true;
$wgGroupPermissions['Bot']['writeapi'] = true;
$wgGroupPermissions['Bureaucrat']['writeapi'] = true;
$wgGroupPermissions['Linux-Admin']['writeapi'] = true;
$wgGroupPermissions['Wiki-Admin']['writeapi'] = true;
$wgGroupPermissions['Wiki-Moderator']['writeapi'] = true;
$wgGroupPermissions['Wiki-Editor']['writeapi'] = true;
$wgGroupPermissions['Wiki-Updater']['writeapi'] = true;



##################################################################################
#
# END OF THE PERMISSION SET UP
#
##################################################################################


# Extension RightFunctions
        // Activation
        require_once "$IP/extensions/RightFunctions/RightFunctions.php";

# Extension RestrictAccessByCategoryAndGroup
        // Activation
        require_once "$IP/extensions/RestrictAccessByCategoryAndGroup/RestrictAccessByCategoryAndGroup.php";
        $wgGroupPermissions['Financial no public data']['*'] = true;
        $wgGroupPermissions['Financial private data']['private'] = true;

# Extension EditUser
        // Activation
        wfLoadExtension( 'EditUser' );
        // Configuration
        $wgGroupPermissions['bureaucrat']['edituser'] = true;
        $wgGroupPermissions['sysop']['edituser-exempt'] = true;




Back to top of this page

Back to Welcome Page

Retrieved from "https://wiki.micylou.com/index.php?title=Mediawiki_Security_Matrix&oldid=403"