A disclaimer was added to the Plexcel plugin page that reads (in part):
"MediaWiki was not written to provide per-page access restrictions, and almost all hacks or patches promising to add them will likely have flaws somewhere"
I would like to add a similar disclaimer to our documention but I would like to better understand the particular failure scenarios. Can someone provide an example?
Currently we just do a caseless wildcard comparison on the title (e.g. 'Employee_Performance_*'). I suppose there are alternative ways to retreive page data that do not use the title of the page?
Thanks, Mike
Mike Wrote: ------------- I would like to add a similar disclaimer to our documention but I would like to better understand the particular failure scenarios. Can someone provide an example? -------------
http://www.mediawiki.org/wiki/Security_issues_with_authorization_extensi ons I found this while searching recently. It explains all the loopholes there may be for page viewing through restrictions.
Hope it helps, -Courtney
Christensen, Courtney wrote:
Mike Wrote:
I would like to add a similar disclaimer to our documention but I would like to better understand the particular failure scenarios. Can someone provide an example?
http://www.mediawiki.org/wiki/Security_issues_with_authorization_extensi ons I found this while searching recently. It explains all the loopholes there may be for page viewing through restrictions.
Hope it helps, -Courtney
MediaWiki-l mailing list MediaWiki-l@lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/mediawiki-l
I believe I have addressed a great number of those loopholes in [[Extension:BizzWiki]]. jld.
On 9/20/07, Christensen, Courtney ChristensenC@battelle.org wrote:
Mike Wrote:
I would like to add a similar disclaimer to our documention but I would like to better understand the particular failure scenarios. Can someone provide an example?
http://www.mediawiki.org/wiki/Security_issues_with_authorization_extensions I found this while searching recently. It explains all the loopholes there may be for page viewing through restrictions.
Actually the more I think about this, I'm going to just dump paged based ACLs. It would be more appropriate to delegate access control to another module.
But ideally there should be a way to hook the access control primitives. In particular, our code has a very fast "plexcel_is_member_of" function that can determine if the currently logged in user is in the named Windows group. It would be delightful if an access control layer (either the existing one or one that is to be created in the future) could allow an extension to provide the implementation of this 'IsMemberOf' routine. Is there such a hook now? Obviously there are different groups with associated privileges now (e.g. Sysops, Bureaucrats, etc) so somewhere someone is doing something like IsMemberOf('Sysops').
For now, I guess I'll simply change the resource being protected from pages to the entire wiki. So it will be all-or-nothing. That will be secure but will allow us to use our fast Windows group checking.
Mike
mediawiki-l@lists.wikimedia.org