Extension:SimpleSecurity2.1.php

<?

1. Simple security extension
2. - Version 2.0
3. - See [[MediaWiki Security]] article for installation and usage details
4. - Licenced under LGPL (http://www.gnu.org/copyleft/lesser.html)
5. - Needs apache's mod-rewrite for security on images, see code comments below

1. These globals can be set in LocalSettings to adjust the Simple Security attributes

if (!isset($wgSecurityName)) $wgSecurityName = "Security"; if (!isset($wgSecurityInheritName)) $wgSecurityInheritName = "*$wgSecurityName"; if (!isset($wgSecurityInheritable)) $wgSecurityInheritable = true;

1. Handle moves (since they don't use $action)

$securityAction = $action == 'submit' ? 'edit' : strtolower($action);

1. if (isset($_REQUEST['wpPreview'])) $securityAction = 'view';

if ($title == 'Special:Movepage' && $action == 'submit') { $securityAction = 'move'; $t = $wgRequest->getText('wpOldTitle',$wgRequest->getVal('target')); } else $t = $title;

1. If title exists, activate the security

if ($t) {

# Globals holding security info $securityCache = array(); $securityItems = array();

# Handle security on files (needs apache mod-rewrite) # - mod-rewrite redirects /wiki/images/... requests to article title Download/image-path... # - Use the following rewrite condition and rule (adjust to your wiki path if necessary) # RewriteCond %{REQUEST_URI} ^/wiki/images/.+ # RewriteRule ^/wiki/images/(.+) /wiki/index.php/Download/$1 [L] if (ereg('^Download/(.+)/([^/]+)$',$t,$m)) { $path = $m[1]; $file = $image = $m[2]; if (ereg('^thumb/.+/([^/]+)$',$path,$m)) $image = $m[1]; $t = "Image:$image"; } else $file = ;

# Hook1: Asseses security after raw content fetched from database and clears if not readable # - also fills the global $securityCache cache with info to append to the rendered article $wgHooks['ArticleAfterFetchContent'][] = 'securityAfterFetch'; $securityAfterFetchActive = true; function securityAfterFetch(&$this,&$text) { global $wgUser,$wgTitle,$securityItems,$securityCache,$securityAfterFetchActive, $wgSecurityName,$wgSecurityInheritName,$wgSecurityInheritable; if (!$securityAfterFetchActive) return true;

# Get the security info straight from cache if already exists $key = $this->mTitle->getPrefixedText(); if (isset($securityCache[$key])) $items = $securityCache[$key]; else {

# Set up a new local parser object to process security items independently of main rendering process # - both Security and *Security items are processed and remembered $parser = new Parser; $options = ParserOptions::newFromUser($wgUser); $parser->setFunctionHook($wgSecurityName,'securityProcessItem'); $parser->setFunctionHook($wgSecurityInheritName,'securityProcessItem'); $securityItems = array(); $output = $parser->parse($text,$wgTitle,$options,false,false); $items = $securityItems;

# Before inheriting security from categories # - stop checking *Security because they shouldn't inherit # - disable this AfterDatabaseFetch hook while reading category contents unset($parser->mFunctionHooks[$wgSecurityInheritName]); $securityAfterFetchActive = false;

# Get the security items from the cats by running the parser over the content of each if ($wgSecurityInheritable) foreach ($output->getCategoryLinks() as $cat) { $article = new Article($title = Title::newFromText($cat = "Category:$cat")); $securityItems = array(); $parser->parse($article->fetchContent(0,false,false),$title,$options,false,false); foreach ($securityItems as $i) $items[] = array($i[0],$i[1],"this rule is inherited from $cat"); }

# Re-enable AfterFetch hook and cache the security info $securityAfterFetchActive = true; $securityCache[$key] = $items; }

# Don't allow any content to be returned if not viewable

if (!securityValidate($wgUser,$items,'view')) $text = "

Sorry, action not permitted!

Your user rights do not permit the view action to be performed on this article.

"; return true; }

# Hook2: Block content if action not allowed, and append any security info before parsing $wgHooks['ParserBeforeStrip'][] = 'securityBeforeParsing'; function securityBeforeParsing(&$parser,&$text,&$strip_state) { global $wgParser,$wgUser,$securityAllow,$securityCache,$securityAction,$wgSecurityName,$wgSecurityInheritName;

# Only process this hook if it's the main article if ($parser != $wgParser) return true; $key = $parser->mTitle->getPrefixedText();

# Replace the content with the "Action not permitted" template if action not allowed

if (!$securityAllow) $text = "

Sorry, action not permitted!

Your user rights do not permit the $securityAction action to be performed on this article.

";

# Append the security info to the article content if (count($securityCache[$key]) && $securityAction == 'view') { $text .= "\n

There are security restrictions on this article (for information about this extension, click here) \n"; foreach ($securityCache[$key] as $i) { $a = $i[0] == '*' ? 'Every action' : ucfirst($i[0]); $b = $i[1] == '*' ? 'anybody' : $i[1]; $c = $i[2] ? " ($i[2])" : ; $text .= "*$a requires the user to be $b$c\n"; } $text .= "\n

";

}

# Ensure the parser doesn't render the security items $parser->setFunctionHook($wgSecurityName,'securityProcessItem'); $parser->setFunctionHook($wgSecurityInheritName,'securityProcessItem'); return true; }

# Accumulates security information in the global $securityItems whenever a security item is parsed function securityProcessItem(&$this,$a,$b) { global $securityItems; $securityItems[] = array($a,$b); return ; }

# Return whether or not a user is allowed to perform an action according to an array of security items function securityValidate(&$user,&$items,$action) {

# Resolve permission for this action from the extracted security links $security = ; foreach ($items as $i) { if ($i[1] == ) $i[1] = 'sysop'; $actions = preg_split("/\\s*,\\s*/",strtolower($i[0])); if ((in_array($action,$actions)) || (in_array('*',$actions) && ($security == ))) $security = $i[1]; }

# Validate extracted security against this user/groups $groups = $user->getGroups(); foreach($groups as $k => $v) $groups[$k] = strtolower($v); $deny = false; if ($security && !in_array('sysop',$groups) && !in_array('director',$groups)) { $security = preg_split("/\\s*,\\s*/",$security); if (!in_array('*',$security)) { $groups[] = ucfirst($user->mName); if (count(array_intersect($groups,$security))==0) $deny = true; } }

return !$deny; }

# Read the article content to update security info cache $tmp = new Article(Title::newFromText($t)); $tmp->fetchContent(0,false,false); $items = $securityCache[$t];

# Validate current action and set to view if not allowed if (!$securityAllow = securityValidate($wgUser,$items,$securityAction)) $action = 'view';

# If its a file, send it back to the client and exit, or block by redirecting to the file's associated article if ($file) {

# Log the download event if any security on file if (count($items)) { $user = $wgUser->mName; $entry = $securityAllow ? "User:$user accessed \"$file\"" : "User:$user was denied access to \"$file\""; $ts = $wgLang->timeanddate(wfTimestampNow(),true); $la = new Article(Title::newFromText('Download log')); $log = "{{Log entry". "|ts=$ts". "|entry=$entry". "|ip=".$_SERVER['REMOTE_ADDR']. "|ua=".$_SERVER['HTTP_USER_AGENT']. "|cookie=".$_SERVER['HTTP_COOKIE']. "|qs=".$_SERVER['QUERY_STRING']. "}}\n"; $la->quickEdit($log.$la->fetchContent(0,false,false)); }

# Return the file to the client if security validates if ($securityAllow) { header("Content-Type: application/octet-stream"); header("Content-Disposition: attachment; filename=\"$file\""); @readfile("$wgUploadDirectory/$path/$file"); die; } else $title = $t; } }

?>