That doesnt look like it would actually work -- anybody could still get at those pages' source through: * edit * special:export * action=raw * api * search result extracts

-- brion On Jul 21, 2011 9:32 AM, "Sumana Harihareswara" sumanah@wikimedia.org wrote:

On 07/21/2011 10:39 AM, Mark A. Hershberger wrote:

...

During my poll of developers about their Bugzilla settings, I was told that the current maintainers of the following two extensions do not have time to take care of them any longer and they need someone to step up and maintain them:

EasyTimeline APC

For what it is worth, EasyTimeline is deployed on WMF wikis (See http://hexm.de/58 for an example from mlwiki).

Thanks,

Mark.

One additional extension that needs someone to update for MW 1.17, put it on mediawiki.org, and do a little maintenance:

http://www.epistemographer.com/2005/05/04/page-by-page-authentication-in-med...

Judging by the comments, people do want this functionality, so it would be used, even if not on WMF wikis.

Thanks, Sumana

-- Sumana Harihareswara Volunteer Development Coordinator Wikimedia Foundation

---

Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l

On 07/21/2011 12:52 PM, Chad wrote:

On Thu, Jul 21, 2011 at 9:48 AM, Brion Vibberbrion@wikimedia.org wrote:

...

That doesnt look like it would actually work -- anybody could still get at those pages' source through:

• edit
• special:export
• action=raw
• api
• search result extracts

Right, which is why I suggested to support such a thing we'll need more changes to core :)

-Chad

In response to this review, I've suggested to the author of the page-by-page authentication extension update the page on his site to mark it deprecated, or remove it, and warn people not to use it. Thanks all.

On Thu, Jul 21, 2011 at 2:14 PM, Casey Brown lists@caseybrown.org wrote:

On Thu, Jul 21, 2011 at 1:04 PM, Sumana Harihareswara sumanah@wikimedia.org wrote:

...

In response to this review, I've suggested to the author of the page-by-page authentication extension update the page on his site to mark it deprecated, or remove it, and warn people not to use it. Thanks all.

Just a note that I think our stance on per-page access restrictions has always been: "Do this at your own risk. This is not supported and will probably never be. We suggest you use another piece of software if you really need this." MediaWiki really isn't designed to be a content management system with very granular access settings, which is why we don't officially support it.

You might want to point out these pages to him too:

• <

http://www.mediawiki.org/wiki/Manual:Preventing_access#Restrict_viewing_of_c...

...

• <

http://www.mediawiki.org/wiki/Security_issues_with_authorization_extensions

...

-- Casey Brown Cbrown1023

Very much agreed! The original author here isn't really the audience for that message; the people who keep searching for this functionality and coming to his HOWTO page are. So I'll ask him to add those as well.

Sumana Harihareswara Volunteer Development Coordinator Wikimedia Foundation

Well for starters the read rights for addon namespaces would be a nice first step.

On 21. 07. 2011 20:35, Andrew Garrett wrote:

On Thu, Jul 21, 2011 at 11:14 AM, Casey Brownlists@caseybrown.org wrote:

...

Just a note that I think our stance on per-page access restrictions has always been: "Do this at your own risk. This is not supported and will probably never be. We suggest you use another piece of software if you really need this." MediaWiki really isn't designed to be a content management system with very granular access settings, which is why we don't officially support it.

I don't want to derail this thread, but I will say this:

Even though this is what people say in #mediawiki, I know many respected developers who don't share this approach, especially the "will probably never be supported" part. The security issues are well-known and in some extensions worked around — regardless, having an understanding of what parts of code read page text contributes to our overall code quality and security, and is definitely a worthwhile enterprise.