手册:$wgRestrictedGroups

This page is a translated version of the page Manual:$wgRestrictedGroups and the translation is 29% complete.

用户权限、访问控制和监视: $wgRestrictedGroups
将用户分配到特定组的条件
引进版本：	1.46.0（Gerrit change 1200077; git #bd2f4bd0）
移除版本：	仍在使用
允许的值：	(数组)
默认值：	`[]`
其他设置：按首字母排序 \| 按功能排序

详情

此数组包含用户被添加至特定用户组的必要条件。语法为：

$wgRestrictedGroups[$groupName] = [
    'memberConditions' => $condsArrayForMember,
    'updaterConditions' => $condsArrayForPerformer,
    'canBeIgnored' => $canBeIgnored,
    'demote' => $demote,
    'scope' => $scope,
];

其中：

$groupName – 欲指定限制的组的名字，例如：'sysop'。
$condsArrayForMember – 用户被添加到指定的组前必须满足的条件。指定条件的语法和$wgAutopromote 相同。
$condsArrayForPerformer – 执行用户将其他用户添加到特定组时必须满足的条件指定条件的语法和$wgAutopromote 相同。
如果$canBeIgnored是true，拥有(ignore-restricted-groups)权限的用户能够绕过为此组定下的限制（包括执行用户的限制和目标用户的限制）。
If $demote is true, members of this group who don't meet the criteria will be demoted when DemoteIneligibleUsers.php is run. Automatic demotion is only supported for groups with 'canBeIgnored' equal to false.
$scope – list of scopes where the restriction applies. See below for explanation. If not set, the restriction applies to all possible scopes.

不一定要指定数组中的全部三个项目。 If 'memberConditions' or 'updaterConditions' are not present, they are assumed to be equal to [], which is interpreted as a condition that is always true. If 'canBeIgnored' is not specified, the requirements are assumed to be unignorable (i.e., (ignore-restricted-groups) has no effect on adding to this group). Groups without 'demote' specified are not demotable automatically.

If the conditions are not met, next to the group checkbox on Special:UserRights, the performer will see a message coming from MediaWiki:Userrights-restricted-group-<group-name> (which falls back to MediaWiki:Userrights-restricted-group-warning, if unspecified).

Continuous enforcement

All restricted groups have their conditions checked at the time of granting. The group can be given to a user only if the conditions are met or if the performer is allowed to bypass the condition check.

If the group has 'canBeIgnored' set to false, the conditions for group member will also be evaluated on every request. User, who no longer meets the conditions, will have the relevant groups disabled. Disabled groups do not give its member any rights, but the user is still reported as member of them in various places of the user interface.

Only groups that are enforceable continuously are supported for automatic demotion.

Scopes

In order to make restricted groups configuration usable for extensions which define their own set of group-like constructs (such as CentralAuth（中央认证） ), a concept of scopes has been introduced. A single scope is meant to apply to a single extension or a single kind of a group-like feature that's implemented by an extension.

If there happen to exist two group-like features coming from different extensions (or core and extension), specifying a scope in $wgRestrictedGroups can target the configuration at the selected scopes only. This behavior is used on Wikimedia to differentiate between local and global groups, which can have the same internal name, but don't have the same restriction configuration.

MediaWiki core defines a single scope for user groups ('local'). All groups supported by core belong to this scope, regardless of where they are defined (be it core's defaults, custom groups in settings or custom groups in extensions).

The only other known scope is defined by CentralAuth ('centralauth').

Examples

Basic conditions

The following replicates the conditions used on the Wikimedia cluster for the Temporary account IP viewers group – normally, the account must be older than 6 months and have 300 edits, but stewards can overrule these requirements:

$wgRestrictedGroups['temporary-account-viewer'] = [
    'memberConditions' => [
        '&',
        [ APCOND_EDITCOUNT, 300 ],
        [ APCOND_AGE, 86400 * 30 * 6 ],
    ],
    'canBeIgnored' => true,
];

Requiring 2FA for a user group

If you want to enforce requiring needing 2FA for a user group, like Extension:OATHAuth used to do with $wgOATHRequiredForGroups, the code change you would make would be to change:

$wgOATHRequiredForGroups[] = 'sysop';

becomes:

$wgRestrictedGroups['sysop'] = [
    'memberConditions' => [ 'oath.has_2fa' ],
];

Restrict only a local group

If you want a condition to apply only to a local 监管员 group, you can use configuration like the following:

$wgRestrictedGroups['steward'] = [
    'memberConditions' => [ /* ... */ ],
    'scope' => [ 'local' ],
];

With this configuration, any other type of group called 'steward' will be unaffected by the specified conditions.

详情