Server rental store

ACL implementation details

# ACL Implementation Details

This article details the Access Control List (ACL) implementation within our MediaWiki 1.40 server environment. Understanding these details is crucial for administrators managing user permissions and ensuring site security. ACLs control what actions users can perform on specific pages and namespaces. This document covers the underlying mechanisms, configuration options, and best practices.

Core Concepts

At its heart, MediaWiki’s ACL system leverages a combination of user groups, page permissions, and rights management. Rights management is the foundation, defining what actions a user *can* perform. These rights are then applied to specific pages or namespaces through page protection and user group membership. The system differentiates between standard users, sysops (system administrators), and bureaucrats, each having varying levels of access.

ACLs aren't directly visible as a list of rules; instead, they're an emergent property of these underlying components. This means understanding how these components interact is key to managing access. Special:ListGroupRights is an invaluable tool for viewing the rights associated with each group.

Rights and User Groups

The following table outlines some critical rights and the user groups typically associated with them. This isn’t exhaustive, but it covers the most frequently used permissions.

Right Description Common User Groups
edit Allows editing of pages. Registered users, Autoconfirmed users
create Allows creating new pages. Registered users, Autoconfirmed users
delete Allows deleting pages. Sysops
block Allows blocking users and IP addresses. Sysops
protect Allows changing page protection levels. Sysops
rollback Allows reverting edits quickly. Sysops
patroldiffs Allows marking edits as patrolled. Autoconfirmed users, Patrollers
viewsuppress Allows viewing suppressed revisions. Bureaucrats, Oversight

It's important to note that rights can be granted directly to users, but this is generally discouraged in favor of managing permissions through user groups. Special:UserRights is used to manage user rights directly.

Page Protection Levels

MediaWiki offers several levels of page protection to control editing access. These levels interact directly with the ACL system.

Protection Level Description Effects on Editing
Not Protected No restrictions. Anyone (depending on user group rights) can edit.
Fully Protected Only sysops can edit. Prevents editing by all non-sysop users.
Sysop Protected Only bureaucrats and sysops can edit. Prevents editing by all non-bureaucrat/sysop users.
Template Protected Only template editors and sysops can edit. Prevents accidental modification of important templates.
Cascading Protection Protection extends to all included templates. Protects all transcluded pages as well.

Page protection is configured through Special:ProtectPage. Understanding the implications of each protection level is crucial for maintaining site stability and preventing vandalism. Help:Protecting pages provides a more detailed explanation of page protection.

Namespace-Specific Permissions

ACLs are not limited to individual pages; they can also be applied to entire namespaces. This allows for granular control over content creation and editing within specific areas of the wiki. For example, the Project: namespace might have stricter editing rules than the Help: namespace.

The following table shows common namespace permissions.

Namespace Default Permissions (for Autoconfirmed Users) Common Restrictions
Main Edit, Create May be subject to full or sysop protection.
Talk Edit, Create Usually open for discussion.
User Edit (own user page only), Create (user talk page) Restricted editing of other user pages.
User talk Edit (own talk page only) Prevents harassment and unwanted modifications.
Project Edit, Create (with restrictions) May require sysop approval for major changes.
Help Edit, Create (with restrictions) Similar to Project namespace.

Namespace permissions are often adjusted through MediaWiki: namespace. Careful consideration should be given to the permissions assigned to each namespace to balance accessibility and security.

Advanced Configuration

Beyond the standard user groups and page protection levels, advanced configuration options exist for fine-tuning ACLs. These include:

⚠️ *Note: All benchmark scores are approximate and may vary based on configuration. Server availability subject to stock.* ⚠️

View full article | Back to Server rental store