Hello MediaWiki Gurus:

I have set-up the user restriction and page white list features described in "Preventing Access" (http://meta.wikimedia.org/wiki/Access_Restrictions).

There are 2 enhancements I would like to make to these security features, I have been looking around in the code and am not seeing a clear path to pursue, could someone provide a hint or two?

The two enhancements I am trying to do are: (1) To restrict searches to logged in users, or change search to use alternative search engine for non-logged in users. (2) To amend to pages specified in $wgWhitelistRead with pages in a specific/special category (e.g. Category:WhiteList)

Why do I think I should try to do these two things? - I know that there are a lot of new security features coming in 1.5 and I want to good future compatibility - I need to make sure I don't leak non-public or not-yet approved information (about 80% of the site content requires restriction) - Public information could be leaked though the search function (existence of topics/documents/etc) - I need pages to default (fail-safe) to restricted, but I need users to be able to flag a page as public or released (I can use policy controls and category monitoring to detect user errors etc.) - It is unclear to me if Jérôme Combaz's patch matches the 1.5 security philosophy, and doesn't default to restricted

Is there a better way (that I appear unaware of) to try to meet my needs?

Thanks to anyone who has any insights or can push me toward good ideas. If I am able to get something working I will post results back to Wiki Media.

Thanks and best regards, Erik