Protected Namespaces or Wikis

This is a documentation on how to close individual namespaces or entire wikis from public access (read & write)

LocalSettings.php

protected namespace

In the MediaWikiCommonSettings.php a namespace "Internal" and its corresponding talk page "Internal_talk" is created for all wikis. To properly secure these namespaces, the LocalSettings.php of the individual wikis needs to be adjusted. Using the extension Lockdown (already enabled via MediaWikiCommonSettings.php), the easiest way to do this is to restrict the usage of these namespaces to a new user group, specific to the individual wiki. In the example below, you can see the restriction for the ABCD-Wiki:

$wgNamespacePermissionLockdown[NS_INTERNAL]['read'] = array('abcdUser');
$wgNamespacePermissionLockdown[NS_INTERNAL_TALK]['read'] = array('abcdUser');
$wgGroupPermissions['abcdUser'] = $wgGroupPermissions['user']; #a trick to make the user group show up in the "User rights management" interface

When using this code for other wikis, the user group name should be adjusted accordingly.

protected wiki

//TODO

User Approval

In order for the users of a wiki with a protected namespace to be able to access this namespace they have to be added to the corresponding user group. To streamline this process, there is a script which helps the users of the bureaucrat user group (those that can adjust the user groups of other users) to add user to the special user group of the wiki.

The script does 3 things:

1. it adds a link "edit rights" to options of a user when viewing the list of users or the list of active users
2. it adds a link "Rights" in the page menu of a user page (or user discussion page)
3. when on the rights page of a user, it automatically preselects the user group of the wiki and adds a comment for the rights log. The bureaucrat only has to click save. To not accidentally assign rights to users that they should not have, the new user group is highlighted in bright green if it has been selected by the script.

In order to user the script, save the following code as MediaWiki:EasyAccountApproval.js and adjust adjust all //TODOs to fit the wiki you are working with.

//script easy account approval so that user can access the internal namespace

if(wgPageName=="Special:ListUsers" || wgPageName=="Special:ActiveUsers"){
	//show "edit rights" link in the user list and active user list
	var linkMenues = document.getElementById("mw-content-text").getElementsByClassName("mw-usertoollinks")
	for(i=0;i<linkMenues.length;i++){
		var linkMenu = linkMenues[i];
		var editRightsLink = linkMenu.lastElementChild.cloneNode(true);
		editRightsLink.href = editRightsLink.href.replace("Special:Block","Special:UserRights");
		editRightsLink.title = editRightsLink.title.replace("Special:Block","Special:UserRights");
		editRightsLink.innerHTML = "edit rights";
		linkMenu.insertBefore(document.createTextNode(" | "), linkMenu.lastChild);
		linkMenu.insertBefore(editRightsLink, linkMenu.lastChild);
	}
}else if(wgPageName.indexOf("Special:UserRights/")===0){
	//auto select the special user group when being on the user rights page
	//TODO: rename id according to user group name and rename variable (optional but advised, including its 3 other occurrences below)
	var abcdUserCheckbox = document.getElementById("wpGroup-abcdUser");
	if(!abcdUserCheckbox.checked){
		abcdUserCheckbox.checked = true;
		var inputReason = document.getElementById("wpReason");
		//TODO adjust reason
		inputReason.value = "is part of the ABCD Team";
 
		var label = abcdUserCheckbox.nextElementSibling;
		label.innerHTML = label.innerHTML + " <i>(auto selected by script)</i>"; 
		label.setAttribute("style","background:#8f8;")
	}
}else if(wgNamespaceNumber==2||wgNamespaceNumber==3){
	//add a rights link in the page menu of a user page (or user discussion page)
	var deleteLink = document.getElementById("ca-delete")
	var username = wgTitle;
	if(username.indexOf("/")!=-1){
		username = username.substring(0,username.indexOf("/"));
	}
	//TODO: modify link
	addPortletLink("p-cactions","//abcd.biowikifarm.net/wiki/Special:UserRights/"+username,"Rights", "ca-user-rights","User Rights","g",deleteLink);
}

To activate the script for bureaucrat users, add the following lines to MediaWiki:Common.js

//add special script for account approval for bureaucrat users
var isBureaucrat = false;
for(var i=0;i<wgUserGroups.length;i++){
	if(wgUserGroups[i]=="bureaucrat"){
		isBureaucrat = true;
	}
}
if(isBureaucrat ){
	importScript('MediaWiki:EasyAccountApproval.js');
}

To allow easy access to the internal namespace for users who are approved for it, you can add the following lines to MediaWiki:Common.js as well and adjust all //TODOs

//add link to internal namespace for all approved user
//TODO adjust variable name (optional but advised, including its 2 other occurrences below)
var isABCDUser = false;
for(var i=0;i<wgUserGroups.length;i++){
	//TODO adjust user group name
	if(wgUserGroups[i]=="abcdUser"){
		isABCDUser = true;
	}
}
if(isABCDUser){
	var recentChanges = document.getElementById("n-recentchanges");
	//TODO: adjust link
	addPortletLink("p-navigation","//abcd.biowikifarm.net/wiki/Internal:Main_Page","Internal", "t-Internal","Internal","i",recentChanges);
}