Version 0.6 of AccessControl Extension for MediaWiki

Thursday, November 23. 2006

Version 0.6 of AccessControl Extension for MediaWiki

another bugixed Version is out.

the extension can be downloaded under http://www.pagansoft.de/download/accesscontrol-0.6.zip

Changes:

Bugfix release, touching the article didn't work, so I use a header redirect (bad hack, but works).
works now also for anonymous users

My original article with the last version can be found here

The previous version can be found here.

Posted by Martin Gondermann in Eigene Software-Projekte at 19:08 | Comments (39) | Trackback (1)

Trackbacks

Trackback specific URI for this entry

Version 0.7 of AccessControl Extension for MediaWiki
another Version with new features is out. the extension can be downloaded under http://www.pagansoft.de/download/accesscontrol-0.7.zip read on for details Changes: now it's possible to have read-only groups. the english language is set as default

Weblog: Monty's Sammelsurium
Tracked: Jan 12, 14:38

Comments

Display comments as (Linear | Threaded)

Hi Martin,

I recently installed your Group Access Control Extension and I have a question regarding READ permissions.

Setting access control in a page correctly prohibits non-group members to modify the page. But it appears that the world still can view and read the page. I need some pages to be accessible (read/write/delete) by group members only. What am I doing wrong? Or how do I need to fix it. BTW, I'm used to be a developer, but I'm definitely no expert, and PHP experience is non-existent.

Perhaps we can continue our dialogue through email?

Looking forward to your reply (and possible fix).

Succes en plezier,

Martien.

#1 Martien van Steenbergen (Homepage) on 2006-11-26 14:03

Do you have tried the current version 0.6? In this version these problems shouldn't anymore occur. Please tell me, if these problems still exists. Thx Martin

#1.1 MagicMonty (Homepage) on 2006-11-26 17:40

Great! It works! Thanks so much. BTW, perhaps you can make the English version the default one.

And I have pages with only one group in the access list, but the message still refers to groupS rather than group.

Succes en plezier,
Martien.

#1.1.1 Martien van Steenbergen (Homepage) on 2006-11-28 09:11

Sorry, this is a little "bug" in the english example in the accesscontrolSettings.php. There is two times the setting $wgGroupLineText. The second one has to be $wgGroupsLineText.

#1.1.1.1 MagicMonty (Homepage) on 2006-11-30 18:44

One question still: I have an RSS reader on changes on my Wiki and I can still see all content changes there, even those behind access control…

Also, anonymous user can also see page references to inaccessible pages in the Special:Recentchanges…

Not sure if this can be fixed at all.

#1.1.2 Martien van Steenbergen (Homepage) on 2006-11-28 10:30

Thanks for the suggestions, I will try to consider them in the next version.

#1.1.2.1 MagicMonty (Homepage) on 2006-11-29 12:31

Martin,

Great extension by the way! I just installed 0.6 and no bugs from what I've tested. I wouldn't call it a bug, but its an enhancement: When a user does a search, it does not take the security from this extension into consideration. Any attempt on that in the near future ?

Thanks,

Damian.

#2 Damian Gomes on 2006-11-28 07:30

Thanks, I will try to consider them in the next version.

#2.1 MagicMonty (Homepage) on 2006-11-29 12:31

Hello, I am attempting to install this for the first time, and I am unable to get this to work at all. It is protecting the pages properly, but I am unable to get the groups to be properly reconginzed. I have followed the instructions to the letter, and even made the minor change in regards to the typo in the settings file, but I am still unable to get this to work. The Usergroup page has both the test accounts username and real name.

#3 Eric Ireland on 2006-12-01 01:38

Can you send me the WikiText for the Usergroup page and the text for the protected page? Which version of MediaWiki do you use?

#3.1 MagicMonty (Homepage) on 2006-12-01 19:01

I experience the same problem.

#3.1.1 Matt on 2006-12-08 23:36

Protected Page:
Eric's Test Zone
< accesscontrol >Eric< / accesscontrol >
Group Page:
*Eric Ireland

*Artanin
---
With Eric Ireland being the real name, and artanin being the account name. Mediawiki version 1.6.8.

#3.1.2 Eric Ireland on 2006-12-21 01:02

The name on the Group page (which is called "Usergroup:Eric" if I understand right) should be "Eric_Ireland" instead
of "Eric Ireland" becaus MediaWiki converts spaces into underscores. Hope that helps.

#3.1.2.1 MagicMonty (Homepage) on 2006-12-24 15:12

Thank you for the great extension! My users have been requesting this for quite a while.

One question: according to http://meta.wikimedia.org/wiki/Page_by_page_access,
one my reference not only groups by individual users within an accesscontrol tag. That does not work for me. As far as you know, does that work?

#4 Bill Smith on 2006-12-04 19:38

Sorry, let me repeat the question. According to http://meta.wikimedia.org/wiki/Page_by_page_ac cess, one can list not only groups but also individual users with an accesscontrol tag. That doesn't work for me, and I would like to know whether it works for anyone else.

#5 Bill Smith on 2006-12-04 23:41

I have a new version of accesscontrol.php that allows referencing both users and groups within the tag.

Please let me know if you are interested in the changes.

#5.1 Bill Smith on 2006-12-05 18:26

Sure I'm interested

Please send me the changes to my Email address. Thx for the help.

#5.1.1 Monty (Homepage) on 2006-12-06 19:00

When I add the security options to a page, it does not allow access to the group, unless I add two groups with the ,, in between them.
I added a single group in between the , and it fails for users in the group.
As soon as I add a second group, even if the second group page has not been created, then it works for the first group.

#6 Scott on 2006-12-04 23:59

Sorry, but it is not intended yet, to use single users. My intention was originally not to write so much for every page (especially, if someone leaves the company or comes into the company). Maybe I make it possible in the next version. Meanwhile you could use a group with only one user.

#6.1 Monty (Homepage) on 2006-12-05 18:17

Sorry, but I can't reproduce this behaviour. Could you give me more information (maybe per Email)? Which Version of MediaWiki and AccessControl you use? What is the text of the Usergroup page? Which settings you have made in LocalSettings.php and accessControlSettings.php?

#6.2 Monty (Homepage) on 2006-12-05 18:22

Hmm, for some reason it is working now. When I take out the second group, all the people in the first group are able to see the page still. I wonder if it has something to do with the caching. I read somewhere that sometimes you need to touch the LocalSettings.php to get the Wiki to purge the cache and update pages.

Anyway, it is working now. Thanks Monty. Great work!

#6.2.1 Scott on 2006-12-07 18:55

Another option ist to call the page with the option "action=purge", i.e. if the page is http://wiki/Startpage you have to call it with http://wiki/Startpage?action=purge to purge the page from the cache.

#6.2.1.1 Monty (Homepage) on 2006-12-07 19:17

First of all: Great Extension! Thanks!

I had the same problem as Scott. This problem accours only if you put the
< accesscontrol >Groupname< /accesscontrol > in the aboslutely last line of a page, that contains text.

When you put the accesscontroll line at the beginning of a text or, if it is the only line on a page everthing works fine.

#6.2.1.1.1 Sebastian on 2006-12-08 17:10

Yes, that's right. You have to put the accesscontrol-tag first on the page. This behaviour will be eventually removed with the next version I think. Then it will be also possible to have more than one accesscontrol-tag

#6.2.1.1.1.1 MagicMonty (Homepage) on 2006-12-08 17:34

Monty,

I have a Usergroup:Developers page defined with content *G9053. When I mark a page with Developers and view the page as an Admin I correctly see the footer linking to the Usergroup:Developers entry. On the entry page for Usergroup:Developers I correctly see the bulleted G9053. However, when I log on as G9053 and try to access the protected page the user is denied access.

#7 Matt on 2006-12-08 23:31

Did you put the accesscontrol-Tag first in the wikitext? If not, it will not work correctly yet. This is a known bug and will be fixed in the next version.

#7.1 MagicMonty (Homepage) on 2006-12-12 20:19

beware that the usernames which contain "_" (underscore) will not be correctly identified because the underscore char will be converted to space.

So,as an example if you must add a user named "user_a" in a acces group, you must insert it as "user a" (undescore becomes space).

I don't have much experience dealing with wiki pages, so it took me while to figure this out

#8 mucu on 2006-12-20 13:31

Function to use mediawiki groups instead of defining groups on pages

function _UserHasAccess(&$user, $groups)
{
global $wgAccessControlNoAccessPage;
global $wgOut;
global $wgAdminCanReadAll;
if (trim($wgAccessControlNoAccessPage)=="") $wgAccessControlNoAccessPage="/index.php/No_Access";
require_once("includes/User.php");
debugme("_UserHasAccess ".$user->getName());
foreach($groups as $group) {
debugme("g: " . $group);
if(in_array($group, $user->mGroups)){
debugme("in_array: true ");
return true;
}
}
if(in_array("sysop", $user->mGroups) && $wgAdminCanReadAll){
debugme("sysop: true ");
return true;
}
if (in_array($user->getName(), $groups)) {
debugme("user: true ");
return true;
}
debugme("_UserHasAccess: FALSE ");
if ((is_object( $wgOut )) && (is_a( $wgOut, 'StubObject' )))
{
header("Location: ".$wgAccessControlNoAccessPage);
exit;
}
else
{
// redirect to the no-access-page if current user doesn't match the
// accesscontrol list
$wgOut->redirect($wgAccessControlNoAccessPage);
}
return false;
}

use instead of controlUserAccess

should be faster and prevents the creation of another administration layer (you can just use SpecialPages:Userrights)

regards
DomQ

#9 DomQ on 2006-12-31 10:54

This idea seems much easier to user manage. If i add this onto the end of the existing code at what point do i call it, or are you looking at replacing all the code (ie almost a new extension?)

#9.1 Jimmy L on 2007-01-02 13:51

Hi Martin,
I have a wiki set up for group projects and I would like to restrict editing ability of some pages to particular groups but would like these pages to be visible to all. Is this possible with the AccessControl extension?

I made a page No_Access which does not show up when a restricted page is accessed.

Thanks so much for your help and for this marvelous extension.

Bob

#10 Bob on 2007-01-02 22:52

The support for readonly access is intended for the next version. Please be patient, I'm a bit busy at this time. I will (hopefully

) work next week again on the extension.

Regards
Martin

#10.1 MagicMonty (Homepage) on 2007-01-06 09:02

Hi,

I just installed accesscontrol-0.6 on my MediaWiki: 1.8.2 (r18486). I can restrict access to a test page to group named "Executive", but not to an additional group named "Developer"

Here is the protected test page:

This is the Access Control Test Page

You should only be able to see this page if you belong to the access group.

< accesscontrol / >Executive,,Developer< / accesscontrol >

Here is the Usergroup:Executive page:

* ronsheely

Here is the Usergroup:Developer page:

*arthurking
*annekolstad

Neither arthurking nor annekolstad can access the restricted test page. I enabled the debug output. Here is a snapshot where arthur and anne failed to be part of the group.

accesscontrol tag found
Executive,,Developer< / accesscontrol >
testing for access for user Arthurking
user Arthurking not in group(s) [[Usergroup:Executive|Executive]]/[[Usergroup:Developer|Developer]], testing for sysop rights
user Arthurking is not sysop or wgAdminCanReadAll is not true, so access is not allowed
checking if $wgOut is a StubObject

accesscontrol tag found
Executive ,, Developer< / accesscontrol >
testing for access for user Annekolstad
user Annekolstad not in group(s) [[Usergroup:Executive|Executive]]/[[Usergroup:Developer|Developer]], testing for sysop rights
user Annekolstad is not sysop or wgAdminCanReadAll is not true, so access is not allowed
checking if $wgOut is a StubObject

Thanks in advance.

-Ron

PS - I don't know how to correctly escape tag source in you blog. the tag elements are truncated.

#11 Ron Sheely (Homepage) on 2007-01-05 03:26

Hi Ron,

I'm currently on holiday, so I'm not able to check this, but it seems as this is a bug. Which version of accesscontrol do you use? I will check this as soon as I can.

Thx Martin

#11.1 MagicMonty (Homepage) on 2007-01-06 08:59

Hello Ron,
You'd better use tags like this:

< accesscontrol >
......
< /accesscontrol >

I have found that you have typed one slash in your code.

Maybe that is the problem.

B.R
diverson

#11.2 Diverson (Homepage) on 2007-01-11 07:19

Hello Martin,
I have imported your code into my wiki. But it seems that if I restrict users from one page by adding the tags for allowed groups.
Right now I want every one can read that page but definite groups to edit.
How can I change the accesscontrolsettings?

Thank you.

B.R
Diverson

#12 Diverson (Homepage) on 2007-01-11 06:47

Sorry, but this feature isn't implemented yet. I will put it in in the next version.
The next version will hopefully be out in the next one or two weeks.

#12.1 Monty (Homepage) on 2007-01-11 13:12

OK.

I'm looking forward to the next version.

#12.1.1 Diverson (Homepage) on 2007-01-12 06:39

We just happened upon a huge bug in this extension. If you create a redirect page that redirects to a protected page, then the protection fails. So anyone can create their own redirect page to a private page and view it.

#13 Flash on 2007-02-17 18:24

Hello all maybe someone can help me. I want to install that plugin with my wiki. But my mediawiki get users and groups near ldap. How i can use ldap group with that extension? cn=name,ou=groups,dc=lppt,dc=lv - not work... I have the latest version of this script

#14 Dmitry Vasiljev (Homepage) on 2007-03-26 14:12

The author does not allow comments to this entry