Manual:Preventing access/cs

Pro nápovědu ohledně uživatelských práv se podívejte na stránku. Tato stránka obsahuje příklady užitečné při zabraňování přístupu.

Informace o tom, jak upravit, najdete na stránce.



Jednoduchá soukromá wiki
Pro běžný případ použití "soukromé wiki, pro sebe a schválené ostatní" potřebujete:


 * Omezení sledování
 * Omezení úprav
 * Omezení vytváření účtu

V závislosti na tom, jaká rozšíření jste nainstalovali, možná budete chtít přidat na seznam povolených více stránek. Pokud například používáte rozšíření, pravděpodobně budete chtít Special:RequestAccount přidat na bílou listinu. Pokud jazyk obsahu vaší wiki není angličtina, možná budete muset použít přeložený název příslušných speciálních stránek.



Omezení vytváření účtu
Chcete-li omezit vytváření účtu, musíte upravit LocalSettings.php v kořenové cestě vaší instalace MediaWiki.


 * 1) Při přihlášení jako sysop přejděte na.
 * 2) Kliknutím na odkaz "Vytvořit účet" se dostanete na formulář pro vytvoření účtu.
 * 3) Zadejte uživatelské jméno a e-mailovou adresu a klikněte na tlačítko "e-mailem". Všimněte si, že potřebujete, jinak si sysop musí vybrat heslo a poslat ho uživateli.
 * 4) Účet bude vytvořen s náhodným heslem, které je následně zasláno e-mailem na zadanou adresu (stejně jako u funkce "zapomenuté heslo"). Uživatel bude požádán o změnu hesla při prvním přihlášení; když to udělá, e-mailová adresa bude také označena jako potvrzená.
 * Když místo toho kliknete na tlačítko "vytvořit účet", musí uživatel ručně odeslat heslo. Pokud jste nastavili (výchozí konfigurace až do verze 1.15) a pole pro heslo jste nechali prázdné, bude uživateli zaslán e-mail s žádostí o potvrzení e-mailové adresy, ale nebude mít přístup k, aby mohl potvrzení provést. Místo toho se uživateli zobrazí chyba (pokud jste ji nepřidali do ); uživatel se bude moci přihlásit s prázdným heslem a poté potvrdit e-mail, ale jeho heslo nebude resetováno (bude muset být resetováno ručně).

Může být vhodné upravit text zobrazený při pokusu o přihlášení jiného uživatele. To lze provést na MediaWiki:Nosuchuser, když jste přihlášeni jako sysop. Používejte prostý text bez jakéhokoli speciálního formátování, protože formátování je ignorováno a text je vykreslen doslova. (Mohlo se změnit, viz bug 12952).

Můžete také upravit obsah e-mailu zaslaného novým uživatelům úpravou stránky MediaWiki:Createaccount-text.

Chcete-li zabránit i sysopům ve vytváření účtů:

Chcete-li přidat zprávu nad přihlašovací formulář, změňte MediaWiki:Loginprompt.



Restrict editing of all pages
Users will still be able to read pages with these modifications, and they can view the source by using Special:Export/Article name or other methods. See also bug 1859.

See and. If you use, any wiki admin can also put various restrictions in place.

Some examples of how to protect all pages from editing (not reading) by certain classes of users:

Restrict anonymous editing
Requires that a user be registered before they can edit.

Restrict editing by all non-sysop users
Requires that a user be a member of the administrators (sysop) usergroup.

Restrict editing of an entire namespace
Starting from MediaWiki version 1.10, it is possible to protect entire namespaces using the variable. Examples:

Note that in the last case it's assumed that a custom namespace exists and that  is a defined constant equal to the namespace number. See and  for a list of MediaWiki's core namespaces.

Restrict editing of certain specific pages
Use the feature. By default, any sysop can protect pages so only other sysops can edit them. In 1.9 and higher, by default they can also protect pages so only "autoconfirmed" users (with accounts older than a configured period) can edit them. This does not require editing configuration files.

If you want to restrict editing to groups with specific permissions, edit. To prevent actions other than edit and move, use.

Restrict editing of all but a few pages
To impose a blanket restriction on editing for all pages, but allow a few (such as sandboxes, join request pages, etc.) to be more generously editable, you can use the extension. This may not fit too often, but you could also use the Restrict editing of certain specific pages method mentioned above, with all name spaces protected, and only a special one editable by everyone which has all the pages you want editable.

Restrict editing for certain IP address ranges
Schools and other institutions may want to block all edits not from a few specified IP address ranges. To do so, see. The only way to do this at present without modifying the code is to go to Special:Blockip and systematically  every one of the address ranges that you don't want to be able to edit. This will work for all future versions of MediaWiki. It will not work on a per-namespace basis.

Restrict editing by a particular user
Use the user functionality to deprive a user of all edit access. MediaWiki does not include a possibility to give rights to separate users directly; instead rights are always given to a user group. There is no way in the core software to change permissions of particular users in order to restrict or allow editing particular pages, except by changing their usergroup.

Restrict creating pages in certain namespaces
There are separate rights for creating talk pages (createtalk) and creating non-talk pages (createpage). If you need per-namespace control finer than that, it is not possible in core MediaWiki, and requires an extension such as.

Restrict access to uploaded files

 * &rarr;, , 

If you have enabled the ability to upload files, these will be served directly by the underlying web server. As a result, .

Example for access restriction to uploaded files in the server configuration
If sensitive files are uploaded to an internet-accessible wiki, you may wish to add restrictions on where these can be accessed from. On Apache, if your local network were 10.1.2.*, you could restrict serving files to local addresses with:

 Order deny,allow Allow from 10.1.2.3 Deny from all 

Restrict viewing of all pages
Add this line to your LocalSettings.php file:

The  setting allows users to view the main page. If page names have more than one word, use a space " " between them, not an underscore "_".

In addition to the main page of such a private site, you could give access to the Recentchanges page (if you think that its content isn't private) for feed readers by adding "Special:Recentchanges" to.

If you need to protect even the sidebar, main page, or login screen for any reason, it's recommended that you use higher-level authentication such as .htpasswd or equivalent.

Restrict viewing of certain specific pages
To prevent anyone but sysops from viewing a page, it can simply be. To prevent even sysops from viewing it, it can be removed more permanently using. To completely destroy the text of the page, it can be manually removed from the database. In any case, the page cannot be edited while in this state, and for most purposes no longer exists.

To have a page act normally for some users but be invisible to others, as is possible for instance in most forum software, is a very different matter. MediaWiki is designed for two basic access modes:

This is the mode used by Wikipedia and its sister projects. This is basically the same as the above, in terms of technical implementation (just an extra check for every page view), which is why it exists. This is the mode of operation used by certain private wikis such as those used by various Wikimedia committees.
 * 1) Everyone can view every single page on the wiki (with the possible exception of a few special pages).
 * 1) Anonymous users can only view the Main Page and login page, and cannot edit any page.

''' If you intend to have different view permissions than that, MediaWiki is not designed for your usage. ''' ( See T3924. ) Data is not necessarily clearly delineated by namespace, page name, or other criteria, and there are a lot of leaks you'll have to plug if you want to make it so (see  for a sample). Other wiki software may be more suitable for your purpose. You have been warned. If you must use MediaWiki, there are three basic possibilities:

See the section above. You will have to reapply it every time you upgrade the software, and it may not be updated immediately when new security fixes or upgrades of MediaWiki are released. Third-party hacks are, of course, not supported by MediaWiki developers, and if you're having problems you shouldn't ask on MediaWiki-l, #mediawiki, or other official support channels. A number of hacks are listed in. Read about if you plan to use one of those.
 * 1) Set your wiki up private and whitelist specific pages that will be public with   in the LocalSetting.php file.
 * 1) Set up separate wikis with a, configure one as viewable and one as unviewable (see above), and  between them.
 * 1) Install a third-party hack or extension.

Restricting exporting
 See also: 

It is not possible to export the contents of a page that cannot be read since.

Removing the Login link from all pages
One can remove the login/create account link from the upper right corner of all pages, as users can still go to Special:SpecialPages > Special:UserLogin to login. In LocalSettings.php use (tested with MediaWiki 1.16)

Removing accounts
If you want to completely remove access to a user, e.g. on a simple private wiki, it's not possible to simply delete the account ; you can it, but the user will still  to read pages. However, using extension you can merge the account in another one and delete the former; the original account will then "disappear". If you want to preserve history readability (i.e., to have edits from the user to be still shown under their name), you can create a new account e.g. with username "OriginalUserName (deactivated)" and then merge "OriginalUserName" into the former, or even use extension to rename "OriginalUserName" into "AnotherUserName", then create an account under "OriginalUserName" and merge "AnotherUserName" into it: in this manner, "OriginalUserName" will be completely "usurped" (if you've set a non-null password).

Since MediaWiki 1.16.0, it is possible to set to true to prevent access and reading to blocked users.

Other restrictions
You may want to have pages editable only by their creator, or ban viewing of history, or any of a number of other things. None of these features are available in an unhacked version of MediaWiki. If you need more fine-grained permissions, see the #See also section for links to other wiki packages that are designed for this, as well as hacks that attempt to contort MediaWiki into something it's not designed to be but may work anyway.