Extension:Semantic ACL

The Semantic ACL (Access Control List) extension allows read and edit restrictions to be set on pages and files using semantic properties. Restrictions can be for anonymous/registered users, user groups or individual users.

Features
On top of denying viewing or editing of pages to certain users, Semantic ACL:


 * Works through transclusions
 * If a page is transcluding a page or a subset of the page that has a protection in place, users not allowed to view that content will see a placeholder message instead.


 * Works with files
 * If a file is protected, users not allowed to see the file will be denied access to the file page and will see placeholder content where the file is used in other pages. If a file is uncategorized or part of category that an anonymous user is not allowed to see, placeholder content will be displayed instead. Please not that this does not prevent retrieving files using raw URLs.


 * Works with search results and semantic queries
 * Search results including a page that a user is not allowed to see won't display the content of the page, only its title. Semantic page queries (except count) exclude pages a user can't view.


 * Works with Structured Discussions and talk pages
 * A talk page or a structured discussion will get the same protection as its associated content page.


 * Works within the wiki
 * No need to edit LocalSettings.php to modify restrictions, everything is done from inside your wiki.


 * Works with many use cases
 * Restrictions can be enabled for anonymous/registered users, user groups or individual users.

Usage
To set restrictions, mark up a page with the appropriate properties.

To set read restrictions, use this property:. If set to  set allowed users or groups:

To set edit restrictions (which apply to all other actions), use this property:. If set to  set allowed users or groups:

The "main" property ( or  ) can take one or more of these values. With the exception of "public", a user must satisfy all conditions set.
 * — overrides all other values and never denies access.
 * — denies access to users who are not logged in.
 * — denies access to all users who are not whitelisted, either explicitly or by being in a whitelisted group.

The read and edit restrictions have separate whitelists. You can add one or more users or groups to the whitelist using the appropriate properties. Note that the  prefix is mandatory for the single-user whitelist (eg:  ).

Example
These properties, included on a page, would allow only users in the "moderator" group to read the page, and only the user "Chief Moderator" to edit it. Visible to::whitelist Visible to group::moderator

Editable by::whitelist Editable by user::User:Chief Moderator

User rights
Users who have the  user group are never prohibited access by this extension. This is a failsafe to avoid pages becoming permanently uneditable by having an empty whitelist.
 * sacl-exempt

By default, administrators (users in the  group) are given this right.

Also, IPs listed in  are also granted full access.

When  is set, users that have the   right can browse media that has not been categorized as public.
 * view-non-categorized-media