The AccessControl extension allows restricting access to specific pages based on internal groups or group lists from user space.
MediaWiki in its default state is not designed as a Content Management System (CMS), but when used as a corporate or school intranet it is required to protect sensitive data. AccessControl has been developed for this purpose.
How this extension meets the requirements for site security[edit] Warning: It is recommended to use the latest stable version of MediaWiki because older versions of MediaWiki can be bypassed by different methods!false, besides the view attribute for unprotected pages. Allowed actions for authorized users depend on the permissions settings of MediaWiki and the username listed in the access list pages use.
More info about potential problems regarding security is on the page Security issues with authorization extensions .
Since version 2.1 the extension examines the embedded page or template as well.
$wgAdminCanReadAllManual (in Czech language for now) here as wiki page, but is prepared for translation. If you want to contribute to creating an English version, you must donate any amount of money to pay for a commercial translator, because the author does not have the time and skills for it. The man page (for now only Czech version) is part of the source code, and can be imported into your private MediaWiki instance if you want.
Step 1: Local Settings File[edit]$wgGroupPermissions['*']['read'] = true; $wgGroupPermissions['*']['createaccount'] = false; $wgGroupPermissions['*']['edit'] = false; $wgGroupPermissions['*']['writeapi'] = false; $wgGroupPermissions['*']['createpage'] = false; $wgGroupPermissions['*']['createtalk'] = false;
wfLoadExtension( 'AccessControl' );
Is recommend unavailable the Special pages, which may be used to compromitation the content of your wiki by anonymous bots or users. Read 'README' file, where is example protection code for
LocalSettings.php Warning: Watch out for the $wgAccessControlRedirect variable! This is only for developers to get a view at the contents of the debug messages, if needed. In production must be value everyfalse. Step 2: Read manual[edit]
Version 6.0 supports the old syntax of this extension. New syntax based on template parameters is very sophisticated. But for base use we can still use AccessList created by the old syntax, and protect pages by element accesscontrol.
The new version has a new access rights setting system, based on template parameterization. If the parser encounters any of the following parameters while processing a template, it will call AccessControl to check if the user has access to the content.
Within a single template, all of the above parameters can be used at the same time, so the indentation indicates their hierarchical position in terms of rights. You will learn more in the description of each parameter, where examples will also be given.
Using this parameter turns a regular template into a list of users. Each user whose name is specified in this parameter will have the right to edit the page into which the template with this parameter will be inserted. And also all pages that use it in the isProtectedBy parameter. If more than one user is specified, their usernames are separated by a comma.
Simple example self-protected page (i.e. 'MyPage') where is in code used 'Template:Warning':
{{Warning
|1=This page is protected
|editAllowedUsers=John Doe, Jane Doe
}}
I can be used to protection another page, if the WikiText content use any template with the parameter 'isProtectedBy', where is as value name the self-protected page 'MyPage'. See example:
… | isProtectedBy = MyPage …
It can be (not must!) edited by Page Form.
Remember that MediaWiki uses transclusion. If anybody editor use this page, for tranclusion, may unavailabeled more pages in site! AccessControl is used where the
'edit'
action is only allowed for verified users. Extensions
ConfirmAccountand
ConfirmEdit(CAPTCHA) recommend.
Using of the old syntax[edit]First create User Groups. It may be any page stored in the main namespace, only colon must be after first word in the name. User lists can be a page in the namespace titled "Department" Each username appears as a list item.
* John Doe * Jane Doe (ro)
<accesscontrol>Administrators,IT:Department,Sales(ro)</accesscontrol>
extension.json file.These can be set in LocalSettings.php:
$wgAdminCanReadAll = true; // Administrators can read all restricted pages
$wgAdminCanReadAll is set to true so that members of the sysop group can edit user group pages in any namespace.false, members of the sysop group can't read and edit pages protected with the <accesscontrol> tag, which may lead to big trouble. This can only be remedied on the code level. MediaWiki versions:
1.29 – 1.36
If for some reason you cannot upgrade your MediaWiki to version 1.39 LTS, you can continue to use version 4.1 of the form-support branch. If you have a problem with the update, because any problem occurred and blocked your actualization, write in the discussion. MediaWiki is very complexity software, and sometime a little bug may be as big problem for admins without the programming experiences.
A new version (4.0) of the extension in the separate branch
form-support
was developed for using with the
Extension:Page Forms– as accesslist you may use any template, but the old syntax of accesslists is supported.
Changes for using with the VisualEditor was implemented too.
You may get code from git:
git clone -b form-support https://gerrit.wikimedia.org/r/p/mediawiki/extensions/AccessControl.gitWarning: Versions 3.x are obsolete, and an upgrade is recommended, because these versions don't check before saving the code if the template includes itself. MediaWiki allows it, but the result is a looped and inaccessible page. The only solution for this is to disable the AccessControl extension, remove the problematic code from the page, and then reenable.
If your MediaWiki Version (≥ 2.6) isn't recommend for use, because have not support of the maintainer.
MediaWiki versions:1.21 – 1.28
Version 2.5.1 is strongly recommended to be used.
1.18 – 1.20
Warning: From version 2.0 the extension does not use wiki user groups (except sysop), only groups created by user access lists!≤ 1.17
sysop cannot be Správce, etc.$wgAdminCanReadAll is true, sysops always have edit access.Version 6.0 (based on branch
form-support
) was actualized and tested on
MediaWiki 1.39.2the current stable release of long-term support (November 2026), and merged into master branch of git repository.
form-support of git repository (see link for clone on top of this page) was tested on MediaWiki 1.35 old legacy version with long-term support (September 2023) This version is recommend for use on MediaWiki 1.29< 1.35The first version of this extension (1.x) was based on Group Based Access Control , but without bugs the original had.[1]
function controlEditAccess()). When viewing a page on a Linux server, the <accesscontrol> tags show. But on a Windows server, the tags don't show and it is fine! Still haven't figured that one out, but it is ok for my application.<accesscontrol> tag when more access lists are used. Only one comma is required. And is not necessary to use the ,, separator at the end of the element content.RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4