Manual:Preventing access/zh

有关自定义用户权限的帮助，请参阅. 此页面包含用于限制访问的示例.

大多数示例需要更改MediaWiki配置文件. Snippets of code with no accompanying instructions must be added to  to take effect. 要向文件添加一行或多行，请按照下列步骤操作：

＃如果文件末尾有 ，请将其移除. 这是不必要的，而且在某些情况下可能会导致问题. ＃使用文本编辑器将这行添加到文件的末尾. 如果在添加的内容上方或下方有一些空白行，则无关紧要. 不要使用Windows记事本，它可能会添加“字节顺序标记”（BOM）并阻止正确读取文件. Typical symptoms of BOMs include white pages and errors about headers already being sent. To remove a BOM, you'll have to edit the file in a hex editor. Windows WordPad seems to work fine, as does Notepad++. Removal of BOMs can also be accomplished using the Vim text editor by opening the file in Vim, typing :set nobomb, and resaving the file. 如果您使用的是Mac，TextEdit也可以完成这项工作.

For more detailed information on editing, read.

简单的私人维基
For the common use case of "a private wiki, for oneself and approved others", you need to:


 * ==限制查看==
 * 限制编辑
 * 限制账户创建

根据您安装的扩展程序，您可能希望将更多页面列入白名单. 例如，如果您使用扩展，则可能需要将Special:RequestAccount列入白名单. 如果您的维基的内容语言不是英语，则可能必须使用相关特殊页面的翻译名称.

限制账户创建
要限制帐户创建，您需要在MediaWiki安装的根路径中编辑LocalSettings.php.


 * 1) Go to, when logged in as a sysop.
 * 2) Click on "Create an account" link to get to the account creation form.
 * 3) Enter a username and an email address, and click the "by email" button. Note you need or else the sysop must pick a password and send it to the user.
 * 4) The account will be created with a random password which is then emailed to the given address (as with the "forgot password" feature). The user will be requested to change password at first login; when he does this, his e-mail address will also be marked as confirmed.
 * When you click the "create account" button instead, you have to manually send the user his password. If you've set (default configuration up to version 1.15) and you've left the password field blank, the user will be emailed an e-mail address confirmation request but will be unable to access  to perform the confirmation. Instead, the user will get an error (unless you've added it to ); the user will be able to login with a blank password and then confirm email, but their password will not have been reset (it will have to be reset manually).

It may be appropriate to edit the text displayed when a non-user attempts to log in. This can be done at MediaWiki:Nosuchuser, when logged in as a sysop. Use plain text without any special formatting, as the formatting is ignored and the text is literally rendered. (Might have changed, see bug 12952).

You may also modify the contents of the e-mail sent to new users by editing the page MediaWiki:Createaccount-text.

To prevent even sysops from creating accounts:

To add a message on top of the login form, modify MediaWiki:Loginprompt. Alternatively, use this code in your LocalSettings.php:

Restrict editing of all pages
Users will still be able to read pages with these modifications, and they can view the source by using Special:Export/Article name or other methods. See also bug 1859.

See and. If you use, any wiki admin can also put various restrictions in place.

Some examples of how to protect all pages from editing (not reading) by certain classes of users:

Restrict anonymous editing
Requires that a user be registered before they can edit.

Restrict editing by all non-sysop users
Requires that a user be a member of the administrators (sysop) usergroup.

Restrict editing of an entire namespace
Starting from MediaWiki version 1.10, it is possible to protect entire namespaces using the variable. Examples:

Note that in the last case it's assumed that a custom namespace exists and that  is a defined constant equal to the namespace number. See Manual:Using custom namespaces and Manual:Namespace_constants for a list of MediaWiki's core namespaces.

Restrict editing of certain specific pages
Use the feature. By default, any sysop can protect pages so only other sysops can edit them. In 1.9 and higher, by default they can also protect pages so only "autoconfirmed" users (with accounts older than a configured period) can edit them. This does not require editing configuration files.

If you want to restrict editing to groups with specific permissions, edit. To prevent actions other than edit and move, use.

限制所有页面的编辑
要对所有页面的编辑施加全面限制，但允许一些（例如沙箱，加入请求页面等）可编辑，您可以使用扩展. This may not fit too often, but you could also use the Restrict editing of certain specific pages method mentioned above, with all name spaces protected, and only a special one editable by everyone which has all the pages you want editable.

限制某些IP地址范围的编辑
学校和其他机构可能希望阻止指定的IP地址范围以外的编辑. 为此，请参阅. The only way to do this at present without modifying the code is to go to Special:Blockip and systematically  every one of the address ranges that you don't want to be able to edit. 这适用于所有未来版本的MediaWiki. 它不会在每个名字空间的基础上工作.

限制特定用户的编辑
使用用户功能剥夺用户的所有编辑权限. MediaWiki并不能直接向单独用户授予权利；相反，权限始终给予用户组. 除了更改用户组之外，核心软件无法更改特定用户的权限以限制或允许编辑特定页面.

限制在某些名字空间中创建页面
There are separate rights for creating talk pages (createtalk) and creating non-talk pages (createpage). If you need per-namespace control finer than that, it is not possible in core MediaWiki, and requires an extension such as.

限制对上传文件的访问权限

 * &rarr;, , 

如果您已启用上传文件的功能，则这些文件将由底层Web服务器直接提供. 因此，.

服务器配置中上传文件的访问限制示例
如果将敏感文件上传到可通过互联网访问的维基，您可能希望添加对访问这些文件的限制. On Apache, if your local network were 10.1.2.*, you could restrict serving files to local addresses with:

 Order deny,allow Allow from 10.1.2.3 Deny from all 

限制所有页面的查看
将这一行添加到你的LocalSettings.php中：

The  setting allows users to view the main page. If page names have more than one word, use a space " " between them, not an underscore "_".

In addition to the main page of such a private site, you could give access to the Recentchanges page (if you think that its content isn't private) for feed readers by adding "Special:Recentchanges" to.

If you need to protect even the sidebar, main page, or login screen for any reason, it's recommended that you use higher-level authentication such as .htpasswd or equivalent.

限制特定页面的查看
To prevent anyone but sysops from viewing a page, it can simply be. To prevent even sysops from viewing it, it can be removed more permanently with extension. To completely destroy the text of the page, it can be manually removed from the database. In any case, the page cannot be edited while in this state, and for most purposes no longer exists.

To have a page act normally for some users but be invisible to others, as is possible for instance in most forum software, is a very different matter. MediaWiki专为两种基本访问模式而设计：

＃每个人都可以查看wiki上的每个页面（可能除了一些特殊页面）. 这是维基百科及其姊妹项目使用的模式. ＃匿名用户只能查看主页和登录页面，不能编辑任何页面. 这在技术实现方面基本上与上述相同（只是对每个页面视图进行额外检查），这就是它存在的原因. 这是某些私人维基使用的操作模式，例如各种维基媒体委员会使用的维基.

'''如果您打算拥有不同的视图权限，则MediaWiki不适合您的使用. ''' (参见bug 1924. ) Data is not necessarily clearly delineated by namespace, page name, or other criteria, and there are a lot of leaks you'll have to plug if you want to make it so (see  for a sample). 其他wiki软件可能更符合您的目的. 以上是对您的忠告. 如果必须使用MediaWiki，则有三种基本可能性：

＃将您的wiki设置为私有和白名单特定页面，这些页面将在LocalSetting.php文件中以 公开. 请参阅上面的章节. ＃安装第三方文件或扩展程序. You will have to reapply it every time you upgrade the software, and it may not be updated immediately when new security fixes or upgrades of MediaWiki are released. Third-party hacks are, of course, not supported by MediaWiki developers, and if you're having problems you shouldn't ask on MediaWiki-l, #mediawiki, or other official support channels. A number of hacks are listed in. 如果您打算使用其中一个，请参阅.
 * 1) Set up separate wikis with a, configure one as viewable and one as unviewable (see above), and  between them.

限制导出
参见： 

无法导出自rev:19935起无法读取的页面内容.

从所有页面移除登录链接
可以从所有页面的右上角删除登录/创建帐户链接， 因为用户仍然可以登录Special:SpecialPages>Special:UserLogin. In LocalSettings.php use (tested with MediaWiki 1.16)

移除账户
If you want to completely remove access to a user, e.g. on a simple private wiki, it's not possible to simply delete the account ; you can it, but the user will still  to read pages. However, using extension you can merge the account in another one and delete the former; the original account will then "disappear". If you want to preserve history readability (i.e., to have edits from the user to be still shown under his name), you can create a new account e.g. with username "OriginalUserName (deactivated)" and then merge "OriginalUserName" into the former, or even use extension to rename "OriginalUserName" into "AnotherUserName", then create an account under "OriginalUserName" and merge "AnotherUserName" into it: in this manner, "OriginalUserName" will be completely "usurped" (if you've set a non-null password).

Since MediaWiki 1.16.0, it is possible to set to true to prevent access and reading to blocked users.

其他限制
You may want to have pages editable only by their creator, or ban viewing of history, or any of a number of other things. MediaWiki的未经修改版本中这些功能不可用. If you need more fine-grained permissions, see the #See also section for links to other wiki packages that are designed for this, as well as hacks that attempt to contort MediaWiki into something it's not designed to be but may work anyway.

参见
有一些您可能感兴趣的相关手册/帮助页面：



其他维基软件可能比MediaWiki更好地支持细粒度的访问控制：


 * MoinMoin
 * - 基于MediaWiki（有限文档，小项目）
 * TWiki
 * TikiWiki - 具有完全可配置的功能和权限级别的访问控制.

如果您想要更好的访问控制但想要使用MediaWiki，这是一个扩展列表，并且允许在软件中实现不可能的限制. 其中的修改可能已经过时（请查看他们的版本）. 如果经过第三方修改的文件出现问题，请不要在官方MediaWiki支持渠道中询问.


 * (不在维护)
 * - 限制匿名用户编辑大多数页面
 * (不在维护)
 * (不在维护)
 * - 限制匿名用户编辑大多数页面
 * (不在维护)
 * - 限制匿名用户编辑大多数页面
 * (不在维护)
 * (不在维护)
 * (不在维护)


 * 已存档的扩展