MediaWiki Extension - GroupPermissionsManager

Mediawiki Extension: Group Permissions Manager

Sometimes you as a Mediawiki administrator might feel the need to add or remove a group, or edit a groups rights. Unfortunately, there is no such function in the MediaWiki software itself, you'd have to edit the LocalSettings.php file somehow. Bogus! But fortunately, there now exists an extension that adds this functionality. Most excellent!

Note: if you want to install the older version 2.00 of this plugin (which is much simpler, both in installation and in functionality), then go to the Group Permissions Manager 2.00 page. The instructions on this page are for the 3.2.6 version (build r45886).

Adding the extension

First, download the latest snapshot of the GroupPermissionsManager extension from here: Mediawiki Extension:Group Permissions Manager. It's a single archive with a name that looks like GroupPermissionsManager-trunk-r45886.tar.gz. You can extract it straight into the Debian mediawiki extensions directory /usr/share/mediawiki-extensions, that already exists if you've installed the mediawiki-extensions package; out comes a little directory structure like this:

GroupPermissionsManager
|-- plugins
|   |-- disabled
|   `-- messages
`-- scripts

You'll have to make sure all files and directories are owned by root, and that the PHP files cannot be edited by anyone else than root. If you extracted the files as root, this will already be the case. If not, then as root run:

cd  /usr/share/mediawiki-extensions/GroupPermissionsManager
chown -R root:root *
chmod -R 644 *.php

Next, we have to make a small alteration to /usr/share/mediawiki/includes/GlobalFunctions.php because there's a bug or shortcoming in MediaWiki 1.12, and that's the version that Lenny uses. The alteration is described in a patch prescription on the MediaWiki site, but in essence we add a line after line number 422: the line beginning with "wfRunHooks": <source lang="php"> function wfMsgGetKey( $key, $useDB, $forContent = false, $transform = true ) {

       global $wgParser, $wgContLang, $wgMessageCache, $wgLang;

      wfRunHooks( 'NormalizeMessageKey', array( &$key, &$useDB, &$langCode, &$transform ) );

</source> Next, we create a directory where Group Permissions Manager will keep the configuration files. In the Debian style, we need something under /etc. We would ordinarily suggest something under /etc/mediawiki-extensions, but the configuration that the extension manipulates is used by MediaWiki itself. Thus we suggest creating /etc/mediawiki/config. After that, grant the permission to write in this directory to the web server daemon, for Apache2 www-data.
Finally, create a symlink to this config directory in the place where GroupPermissionsManager actually expects it, namely in the directory where the PHP-script itself resides (here: /usr/share/mediawiki-extensions/). All of this can be achieved by following these steps:

cd /etc/mediawiki
mkdir config
chown www-data:www-data config
cd /usr/share/mediawiki-extensions
ln -s /etc/mediawiki/config

Now we can mark the extension GroupPermissionsManager.php available to MediaWiki:

cd /etc/mediawiki-extensions/extensions-available
ln -s /usr/share/mediawiki-extensions/GroupPermissionsManager/GroupPermissionsManager.php

Then, enable the extension

mwenext GroupPermissionsManager.php

This by default adds some extra capabilities to the Mediawiki administrator group "bureaucrat", of which WikiAdmin is a member - and presumably you too. The capabilities are to use a Special page to create, manage, and remove Wiki groups and their permissions.

Using the extension

To manage group permissions, you need the following:

• your MediaWiki user account needs to be in a MediaWiki group that has been granted the right to use Group Permissions Manager, e.g. bureaucrat as depicted above;
• you must be logged in with that MediaWiki account;
• you need to know the name of the group whose permissions you want to manage (or create or delete).

In the left navigation area, click on Special pages; scroll down to the section Restricted special pages, you should see an entry Manage Group Permissions. Click it to enter the Manage Group Permissions special page. Here, you'll find just an empty box and a "Go" button. Fill in the name of the group you want to create/manage/delete, and click "Go".

You'll find yourself in a long page with group permissions, each of which can be "true", "false" or "inherit". Setting a permission to "true" or "false" enables or disables the permission for this group, while leaving it on "inherit" means the group gets the default permission that MediaWiki assigns every group - just think of the default rights of the default group "users"

Furthermore:

• If the group pre-exists, you'll find above the list a comment box and a "Delete group" button, where you can remove the group, while leaving the comment in the GroupPermissionsLog.log log file.
• Furthermore, if the group pre-exists, the permissions list ends with a comment box and a "Change group permissions" button. Clicking that button will change the group permissions to the set designated in the permissions list. The changes, along with all other group permissions, can be found in the /etc/mediawiki/config directory in file GroupPermissons.php. Clicking the button will also have resulted in a backup of the GroupPermissons.php file in that same directory, but named GroupPermissons.<timestamp>.php, e.g. GroupPermissions.21012009171713.php.
• If the group name is "new", no "Delete group" button is shown, but the permissions list ends with a comment box and an "Add group" button, which will create the group with the designated name, while leaving the comment in the GroupPermissionsLog.log log file. Again, the comment is logged, and a backup of the GroupPermissons.php file is made.