Thanks for the comment River,

I did use the suggested method by Greg and it works to lock down my default theme. Unfortunately as you have pointed out the other themes are still available to anonymous users through specifying it as a URL parameter. I am using the $wgSkipSkins setting , but that only limits the skins available on the Special:Preferences page. The useskin=standard in URL still works.

Any suggestions to disable the use of alternate (non-default or skipped) skins? I was looking on Meta and saw the following section: http://meta.wikimedia.org/wiki/Skins#Ensure_users_using_skipped_skins_use_th...

I would prefer not to modify code because it will break when I upgrade but so far I have not seen another option. I have applied the above linked hack to my mediawiki and it works great. I added the following to the function normalizeKey in includes/Skin.php (add at the location recommended by Meta): global $wgSkipSkins; if( in_array( $key, $wgSkipSkins ) ) { $key = $wgDefaultSkin; }

Maybe this should be added to a future release of mediawiki? I'm running 1.10.2 and this code is what I needed to completely enforce $wgSkipSkins .

Many thanks to Greg and River for the helpful info.

-Tom

Date: Sat, 15 Dec 2007 12:56:32 +0000 From: River Tarnell river@wikimedia.org Subject: Re: [Mediawiki-enterprise] deny anonymous access to sidebar To: mediawiki-enterprise@lists.wikimedia.org Message-ID: 4763CF00.2030505@wikimedia.org Content-Type: text/plain; charset="iso-8859-1"

Greg Sabino Mullane wrote:

...

A simple solution would be to simply take the sidebar out of the default skin (whatever $wgDefaultSkin is set to).

but remember that anonymous users can change the skin by adding e.g. ?useskin=standard to the URL.

   - river.