Problems with MediaWiki 1.16.5
I've installed a new MediaWiki sing 1.16.5, where anonymous users do not have the right to edit pages. When I enabled the Lockdown extension, without any further Lockdown config, the edit tab is removed for all logged in users.
Tracing the code the lockdownUserCan() is only called for the read action for logged in users and no further and then lockdownSearchableNamespaces() is called twice when loading a page. Disabling the lockdownSearchableNamespaces() hook makes the problem go away so I investigated further down this way. It turns out that changing
$ugroups = $wgUser->getEffectiveGroups();
inside lockdownSearchableNamespaces to
$ugroups = $wgUser->getEffectiveGroups(true);
fixes this (this disables the cache for getEffectiveGroups()).
With this change my MediaWiki installation works and now lockdownUserCan() is called in addition for edit and move actions when loading a page (after the two calls to lockdownSearchableNamespaces()).
I'm very new to MediaWiki, let alone the MediaWiki APIs, so I'm not sure if this is the correct fix or not or what is actually going on.
For reference the relevant permission related parts of LocalSettings.php are:
$wgGroupPermissions['*']['createaccount'] = false; $wgGroupPermissions['*']['edit'] = false; $wgGroupPermissions['*']['createpage'] = false; # 'createpage' requires the 'edit' right $wgGroupPermissions['*']['createtalk'] = false; # 'createtalk' requires the 'edit' right $wgGroupPermissions['*']['writeapi'] = false; # despite documented defaults administrators do not have 'suppressredirect' by default $wgGroupPermissions['sysop']['suppressredirect'] = true; require_once( "$IP/extensions/Lockdown/Lockdown.php" );
This has already been fixed if you download the latest snapshot (the "trunk" version) of Lockdown.
Nice! Great to see it fixed in a proper way ;-) Any chance the fix is propagated to the MW-1.16 snapshot?
Hi. Be careful here: if you install the "trunk" version of Lockdown you will need the "trunk" version of MediaWiki too!
I just tried it an got this error:
"Call to undefined method MediaWiki::getAction()"
Better to only correct these getEffectiveGroups() and wait next release of Lockdown, I think.
Since no one replied to my posting about 1.17 issues above, I decided to just try upgrading from 16.0 to 16.5 for the security fixes...this is the result.
Warning: Cannot modify header information - headers already sent by (output started at ..../w/extensions/Lockdown/Lockdown.php:1) in ..../w/includes/WebResponse.php on line 16o
Is this extension being overseen any more? Thanks Hutchy68 13:52, 31 January 2012 (UTC)
