Page MenuHomePhabricator
Files F2870

userrights1.patch
Public
Actions

Authored By
• bzimport
Nov 21 2014, 9:15 PM
Size
7 KB
Referenced Files
None
Subscribers
None

userrights1.patch
View Options

Index: includes/DefaultSettings.php
===================================================================
--- includes/DefaultSettings.php (revision 23171)
+++ includes/DefaultSettings.php (working copy)
@@ -1080,6 +1080,21 @@
*/
# $wgGroupPermissions['developer']['siteadmin'] = true;
+// Limits user groups assignable and removable by every group
+$wgAssignableGroups['bureaucrat']['*'] = true;
+$wgRemovableGroups['bureaucrat']['*'] = true;
+
+// Settings suitable for wikimedia wikis
+//$wgAssignableGroups['steward' ]['*' ] = true;
+//$wgAssignableGroups['bureaucrat']['*' ] = false;
+//$wgAssignableGroups['bureaucrat']['sysop' ] = true;
+//$wgAssignableGroups['bureaucrat']['bureaucrat'] = true;
+//$wgAssignableGroups['bureaucrat']['bot' ] = true;
+//$wgRemovableGroups['steward' ]['*' ] = true;
+//$wgRemovableGroups['bureaucrat']['*' ] = false;
+//$wgRemovableGroups['bureaucrat']['bot' ] = true;
+
+
/**
* Set of available actions that can be restricted via action=protect
* You probably shouldn't change this.
Index: includes/HTMLForm.php
===================================================================
--- includes/HTMLForm.php (revision 23171)
+++ includes/HTMLForm.php (working copy)
@@ -121,6 +121,8 @@
* @todo Document $selectmsg
*/
function HTMLSelectGroups($selectname, $selectmsg, $selected=array(), $multiple=false, $size=6, $reverse=false) {
+ global $wgUser, $wgAssignableGroups, $wgRemovableGroups;
+
$groups = User::getAllGroups();
$out = htmlspecialchars( wfMsg( $selectmsg ) );
$out .= "<br />";
@@ -148,6 +150,15 @@
$attribs['selected'] = 'selected';
}
}
+
+ if( $selectname === 'member' ) {
+ $lookup = $wgRemovableGroups;
+ } else {
+ $lookup = $wgAssignableGroups;
+ }
+ if( !$wgUser->canChangeGroup( $lookup, $group ) ) {
+ $attribs['disabled'] = 'disabled';
+ }
$out .= wfElement( 'option', $attribs, User::getGroupName( $group ) ) . "\n";
}
Index: includes/SpecialUserrights.php
===================================================================
--- includes/SpecialUserrights.php (revision 23171)
+++ includes/SpecialUserrights.php (working copy)
@@ -75,7 +75,7 @@
*
*/
function saveUserGroups( $username, $removegroup, $addgroup, $reason = '' ) {
- global $wgOut;
+ global $wgOut, $wgAssignableGroups, $wgRemovableGroups;
$u = User::newFromName($username);
if(is_null($u)) {
@@ -90,21 +90,40 @@
$oldGroups = $u->getGroups();
$newGroups = $oldGroups;
- // remove then add groups
+
+ // check if user can add or remove particular groups
if(isset($removegroup)) {
$newGroups = array_diff($newGroups, $removegroup);
foreach( $removegroup as $group ) {
- $u->removeGroup( $group );
+ if( !$u->canChangeGroup( $wgRemovableGroups, $group ) ) {
+ $wgOut->addWikiText( wfMsg( 'userrights-nopermission', User::getGroupName( $group ) ) );
+ return;
+ }
}
}
if(isset($addgroup)) {
$newGroups = array_merge($newGroups, $addgroup);
foreach( $addgroup as $group ) {
- $u->addGroup( $group );
+ if( !$u->canChangeGroup( $wgAssignableGroups, $group ) ) {
+ $wgOut->addWikiText( wfMsg( 'userrights-nopermission', User::getGroupName( $group ) ) );
+ return;
+ }
}
}
$newGroups = array_unique( $newGroups );
+ // remove then add groups
+ if(isset($removegroup)) {
+ foreach( $removegroup as $group ) {
+ $u->removeGroup( $group );
+ }
+ }
+ if(isset($addgroup)) {
+ foreach( $addgroup as $group ) {
+ $u->addGroup( $group );
+ }
+ }
+
wfDebug( 'oldGroups: ' . print_r( $oldGroups, true ) );
wfDebug( 'newGroups: ' . print_r( $newGroups, true ) );
Index: includes/User.php
===================================================================
--- includes/User.php (revision 23171)
+++ includes/User.php (working copy)
@@ -1745,6 +1745,21 @@
}
/**
+ * Check if user can add or remove a particular group
+ * @param array $permissions Either $wgAssignableGroups or $wgRemovableGroups
+ * @param string $group Group to be added or removed
+ * @return bool True if user is allowed to do so, false otherwise
+ */
+ function canChangeGroup( $permissions, $group )
+ {
+ foreach ( $this->mGroups as $right )
+ {
+ if ( $permissions[$right]['*'] || $permissions[$right][$group] ) return true;
+ }
+ return false;
+ }
+
+ /**
* Load a skin if it doesn't exist or return it
* @todo FIXME : need to check the old failback system [AV]
*/
Index: languages/messages/MessagesEn.php
===================================================================
--- languages/messages/MessagesEn.php (revision 23171)
+++ languages/messages/MessagesEn.php (working copy)
@@ -1277,6 +1277,7 @@
'userrights-groupshelp' => 'Select groups you want the user to be removed from or added to.
Unselected groups will not be changed. You can deselect a group with CTRL + Left Click',
'userrights-reason' => 'Reason for change:',
+'userrights-nopermission' => 'You don\'t have enough permissions to add or remove group "$1".',
# Groups
'group' => 'Group:',
Index: languages/messages/MessagesRu.php
===================================================================
--- languages/messages/MessagesRu.php (revision 23171)
+++ languages/messages/MessagesRu.php (working copy)
@@ -1,4 +1,4 @@
-<?php
+<?php
/** Russian (русский язык)
*
* Based on MessagesEn.php revision 22305 (2007-05-22)
@@ -952,6 +952,7 @@
'userrights-groupshelp' => 'Выберите группы, в которые вы хотите включить или из которых хотите исключить участника.
Невыбранные группы не изменятся. Снять выделение с группы можно используя CTRL + левую клавишу мыши.',
'userrights-reason' => 'Причина изменения:',
+'userrights-nopermission' => 'У вас недостаточно полномочий для присвоения или снятия группы «$1».',
# Groups
'group' => 'Группа:',
Index: extensions/Makesysop/SpecialMakesysop.php
===================================================================
--- SpecialMakesysop.php (revision 23011)
+++ SpecialMakesysop.php (working copy)
@@ -27,11 +27,21 @@
// * Bureaucrat can only do limited work (makesysop)
$wgGroupPermissions['steward' ]['makesysop' ] = true;
$wgGroupPermissions['steward' ]['userrights'] = true;
-$wgGroupPermissions['bureaucrat']['makesysop' ] = true;
-$wgGroupPermissions['bureaucrat']['userrights'] = false;
+$wgGroupPermissions['bureaucrat']['makesysop' ] = false;
+//$wgGroupPermissions['bureaucrat']['userrights'] = false;
$wgAvailableRights[] = 'makesysop';
+$wgAssignableGroups['steward' ]['*' ] = true;
+$wgAssignableGroups['bureaucrat']['*' ] = false;
+$wgAssignableGroups['bureaucrat']['sysop' ] = true;
+$wgAssignableGroups['bureaucrat']['bureaucrat'] = true;
+$wgAssignableGroups['bureaucrat']['bot' ] = true;
+
+$wgRemovableGroups['steward' ]['*' ] = true;
+$wgRemovableGroups['bureaucrat']['*' ] = false;
+$wgRemovableGroups['bureaucrat']['bot' ] = true;
+
/**
* Quick hack for clusters with multiple master servers; if an alternate
* is listed for the requested database, a connection to it will be opened

File Metadata

Mime Type
text/x-diff
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2442
Default Alt Text
userrights1.patch (7 KB)

Event Timeline

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits