Extension doesn't work with 1.16.0
The extension doesn't work! If i enable Lockdown, I'm able to edit group membership of every user, while not logged in! I can see every special page, also those, usually only visible to sysops! I'm not using any Lockdown-feature. I only enable it in Localsettings with the line require_once("$IP/extensions/Lockdown/Lockdown.php") and all permissions defined anywhere are deactivated. If Lockdown is enabled, lines like $wgGroupPermissions['*']['edit'] = false; are completely ignored, no matter if the line is placed before or after the Lockdown-line.
Is this normal behaviour? I'm using MediaWiki 1.16.0. The lines in my LocalSettings.php are:
# Lockdown require_once( "$IP/extensions/Lockdown/Lockdown.php" ); # Force login to edit $wgGroupPermissions['*']['edit'] = false;
You don't have to use the extension, it's to enough to simply enable it!
Any idea?
Update:
Now the extension works after doing this:
- Create a restricted namespace
- Create an article in that namespace with a user who has permission to do that
- Log-out (until now, nothing had changed; I'm still able to access sysop special pages and change user rights as an anonymous)
- Search for the article, created in step two
- Click on the result (there shouldn't be a result!)
- Now you get a restriction failure
- From now on, the extension works as expected
The buggy behaviour, described above appeared today's morning out of nowhere. I used the extension for several weeks and saw it today for the first time. Any idea about that?
Update:
Now I have figured out the problem: It's something with the cookies. You can reproduce it in the following way:
- Log in to your wiki as an admin
- Close your browser
- Open your browser
- Check your cookies: there are two left: wikinameUserID and wikinameUserName
- Navigate to your wiki
- Go to Special Pages
- Here you can see all pages, you could see as an admin, even though you're not logged in!
- Deactivate the Lockdown Extension at LocalSettings.php
- Reload Special Pages
- Now, everything's OK; you're treated as an anonymous, without any rights
- Reactivate the Lockdown Extension at LocalSettings.php
- Reload Special Pages
- Now you're treated as an admin
- Delete one of that cookies mentioned above, it doesn't matter which one
- Now you're treated as an anonymous
You see: The Lockdown-Extension is the problem.
There was a full thread on this showing how to reproduce exactly the same issue you're seeing but by deleting the PHP session on the server itself... apparently it wasn't migrated over when the discussion was switched from a one-page flat format.
I tried to work extensively to get it brought to someone's attention. Admins here seem more interested in telling users they're wrong and don't know how to use the extension rather than investigating the issue and trying to figure out where it's coming from for some people.
Here's the post from the previous discussion copied over -
Reproduce buggy behavior Log into the wiki and leave the browser open and wait for your session to expire. (I've read this may be influenced by session.gc_maxlifetime and session.cache_expire in php.ini, but this doesn't seem to be the case for me.) After it expires, you should be able to edit the pages without being logged in.
Update: Here's a much quicker way to make your php session end, and to be able to see the bug. Find where your php sessions are being stored (this is session.save_path in phpinfo(), default /var/lib/php5/ on Ubuntu). Grep the files for your logged in username. Delete the session file for your session. Apache/PHP will recreate it as soon as you navigate to another page on your wiki - however, you should now be logged out AND able to edit pages without logging in. I'm beginning to wonder if this is more of a Mediawiki bug than a bug with this extension
