A service class for checking permissions To obtain an instance, use MediaWikiServices::getInstance()->getPermissionManager(). More...

Collaboration diagram for MediaWiki\Permissions\PermissionManager:

[legend]

Public Member Functions
	__construct (ServiceOptions $options, SpecialPageFactory $specialPageFactory, RevisionLookup $revisionLookup, NamespaceInfo $nsInfo)

	addTemporaryUserRights (UserIdentity $user, $rights)
	Add temporary user rights, only valid for the current scope.

	getAllPermissions ()
	Get a list of all available permissions.

	getGroupPermissions ( $groups)
	Get the permissions associated with a given list of groups.

	getGroupsWithPermission ( $role)
	Get all the groups who have a given permission.

	getNamespaceRestrictionLevels ( $index, UserIdentity $user=null)
	Determine which restriction levels it makes sense to use in a namespace, optionally filtered by a user's rights.

	getPermissionErrors ( $action, User $user, LinkTarget $page, $rigor=self::RIGOR_SECURE, $ignoreErrors=[])
	Can $user perform $action on a page?

	getUserPermissions (UserIdentity $user)
	Get the permissions this user has.

	groupHasPermission ( $group, $role)
	Check, if the given group has the given permission.

	invalidateUsersRightsCache ( $user=null)
	Clears users permissions cache, if specific user is provided it tries to clear permissions cache only for provided user.

	isBlockedFrom (User $user, LinkTarget $page, $fromReplica=false)
	Check if user is blocked from editing a particular article.

	isEveryoneAllowed ( $right)
	Check if all users may be assumed to have the given permission.

	overrideUserRightsForTesting ( $user, $rights=[])
	Overrides user permissions cache.

	quickUserCan ( $action, User $user, LinkTarget $page)
	A convenience method for calling PermissionManager::userCan with PermissionManager::RIGOR_QUICK.

	userCan ( $action, User $user, LinkTarget $page, $rigor=self::RIGOR_SECURE)
	Can $user perform $action on a page?

	userHasAllRights (UserIdentity $user)
	Check if user is allowed to make all actions.

	userHasAnyRight (UserIdentity $user)
	Check if user is allowed to make any action.

	userHasRight (UserIdentity $user, $action='')
	Testing a permission.

Private Member Functions
	checkActionPermissions ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check action permissions not already checked in checkQuickPermissions.

	checkCascadingSourcesRestrictions ( $action, UserIdentity $user, $errors, $rigor, $short, LinkTarget $page)
	Check restrictions on cascading pages.

	checkPageRestrictions ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check against page_restrictions table requirements on this page.

	checkPermissionHooks ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check various permission hooks.

	checkQuickPermissions ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Permissions checks that fail most often, and which are easiest to test.

	checkReadPermissions ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check that the user is allowed to read this page.

	checkSiteConfigPermissions ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check sitewide CSS/JSON/JS permissions.

	checkSpecialsAndNSPermissions ( $action, UserIdentity $user, $errors, $rigor, $short, LinkTarget $page)
	Check permissions on special pages & namespaces.

	checkUserBlock ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check that the user isn't blocked from editing.

	checkUserConfigPermissions ( $action, UserIdentity $user, $errors, $rigor, $short, LinkTarget $page)
	Check CSS/JSON/JS sub-page permissions.

	getPermissionErrorsInternal ( $action, User $user, LinkTarget $page, $rigor=self::RIGOR_SECURE, $short=false)
	Can $user perform $action on a page? This is an internal function, with multiple levels of checks depending on performance needs; see $rigor below.

	getRightsCacheKey (UserIdentity $user)
	Gets a unique key for user rights cache.

	isNamespaceProtected ( $index, UserIdentity $user)
	Determines if $user is unable to edit pages in namespace because it has been protected.

	isSameSpecialPage ( $name, LinkTarget $page)
	Returns true if this title resolves to the named special page.

	missingPermissionError ( $action, $short)
	Get a description array when the user doesn't have the right to perform $action (i.e.

	resultToError ( $errors, $result)
	Add the resulting error code to the errors array.

Private Attributes
string[] null	$allRights
	Cached results of getAllRights()

bool[]	$cachedRights = []
	Cached rights for isEveryoneAllowed, [ right => allowed ].

	$coreRights
	Array of Strings Core rights.

NamespaceInfo	$nsInfo

ServiceOptions	$options

RevisionLookup	$revisionLookup

SpecialPageFactory	$specialPageFactory

string[][][]	$temporaryUserRights = []
	Temporary user rights, valid for the current request only.

string[][]	$usersRights = null
	Cached user rights.

Detailed Description

A service class for checking permissions To obtain an instance, use MediaWikiServices::getInstance()->getPermissionManager().

Since: 1.33

Definition at line 47 of file PermissionManager.php.

Constructor & Destructor Documentation

◆ __construct()

MediaWiki\Permissions\PermissionManager::__construct	(	ServiceOptions	$options,
		SpecialPageFactory	$specialPageFactory,
		RevisionLookup	$revisionLookup,
		NamespaceInfo	$nsInfo )

Parameters

ServiceOptions	$options
SpecialPageFactory	$specialPageFactory
RevisionLookup	$revisionLookup
NamespaceInfo	$nsInfo

Definition at line 196 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\$nsInfo, MediaWiki\Permissions\PermissionManager\$options, MediaWiki\Permissions\PermissionManager\$revisionLookup, MediaWiki\Permissions\PermissionManager\$specialPageFactory, and MediaWiki\Config\ServiceOptions\assertRequiredOptions().

Member Function Documentation

◆ addTemporaryUserRights()

MediaWiki\Permissions\PermissionManager::addTemporaryUserRights	(	UserIdentity	$user,
			$rights )

Add temporary user rights, only valid for the current scope.

This is meant for making it possible to programatically trigger certain actions that the user wouldn't be able to trigger themselves; e.g. allow users without the bot right to make bot-flagged actions through certain special pages. Returns a "scope guard" variable; whenever that variable goes out of scope or is consumed via ScopedCallback::consume(), the temporary rights are revoked.

Since: 1.34

Parameters

UserIdentity	$user
string \| string[]	$rights

Returns: ScopedCallback

Definition at line 1593 of file PermissionManager.php.

References MediaWiki\User\UserIdentity\getId().

◆ checkActionPermissions()

MediaWiki\Permissions\PermissionManager::checkActionPermissions	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page )

private

Check action permissions not already checked in checkQuickPermissions.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 923 of file PermissionManager.php.

References $title, $wgDeleteRevisionsLimit, $wgLang, MediaWiki\Permissions\PermissionManager\checkCascadingSourcesRestrictions(), MediaWiki\Permissions\PermissionManager\checkPageRestrictions(), MediaWiki\Permissions\PermissionManager\getPermissionErrorsInternal(), MediaWiki\Permissions\PermissionManager\userCan(), MediaWiki\Permissions\PermissionManager\userHasRight(), and User\whoIs().

◆ checkCascadingSourcesRestrictions()

MediaWiki\Permissions\PermissionManager::checkCascadingSourcesRestrictions	(		$action,
		UserIdentity	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page )

private

Check restrictions on cascading pages.

Parameters

string	$action	The action to check
UserIdentity	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 861 of file PermissionManager.php.

References $title, and MediaWiki\Permissions\PermissionManager\userHasAllRights().

Referenced by MediaWiki\Permissions\PermissionManager\checkActionPermissions().

◆ checkPageRestrictions()

MediaWiki\Permissions\PermissionManager::checkPageRestrictions	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page )

private

Check against page_restrictions table requirements on this page.

The user must possess all required rights for this action.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 812 of file PermissionManager.php.

References $title, and MediaWiki\Permissions\PermissionManager\userHasRight().

Referenced by MediaWiki\Permissions\PermissionManager\checkActionPermissions().

◆ checkPermissionHooks()

MediaWiki\Permissions\PermissionManager::checkPermissionHooks	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page )

private

Check various permission hooks.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 421 of file PermissionManager.php.

References $title, and MediaWiki\Permissions\PermissionManager\resultToError().

◆ checkQuickPermissions()

MediaWiki\Permissions\PermissionManager::checkQuickPermissions	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page )

private

Permissions checks that fail most often, and which are easiest to test.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 715 of file PermissionManager.php.

References $title, MediaWiki\Permissions\PermissionManager\groupHasPermission(), User\isAnon(), MediaWiki\Permissions\PermissionManager\missingPermissionError(), NS_CATEGORY, NS_FILE, NS_USER, and MediaWiki\Permissions\PermissionManager\userHasRight().

◆ checkReadPermissions()

MediaWiki\Permissions\PermissionManager::checkReadPermissions	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page )

private

Check that the user is allowed to read this page.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 496 of file PermissionManager.php.

References $title, MediaWiki\Permissions\PermissionManager\isEveryoneAllowed(), MediaWiki\Permissions\PermissionManager\isSameSpecialPage(), MediaWiki\Permissions\PermissionManager\missingPermissionError(), NS_MAIN, and MediaWiki\Permissions\PermissionManager\userHasRight().

◆ checkSiteConfigPermissions()

MediaWiki\Permissions\PermissionManager::checkSiteConfigPermissions	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page )

private

Check sitewide CSS/JSON/JS permissions.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 1060 of file PermissionManager.php.

References $title, MediaWiki\Permissions\PermissionManager\userHasRight(), and wfMessage().

◆ checkSpecialsAndNSPermissions()

MediaWiki\Permissions\PermissionManager::checkSpecialsAndNSPermissions	(		$action,
		UserIdentity	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page )

private

Check permissions on special pages & namespaces.

Parameters

string	$action	The action to check
UserIdentity	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 1016 of file PermissionManager.php.

References $title, MediaWiki\Permissions\PermissionManager\isNamespaceProtected(), NS_MAIN, NS_MEDIAWIKI, NS_SPECIAL, and wfMessage().

◆ checkUserBlock()

MediaWiki\Permissions\PermissionManager::checkUserBlock	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page )

private

Check that the user isn't blocked from editing.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 630 of file PermissionManager.php.

References Action\exists(), Action\factory(), User\getBlock(), MediaWiki\Permissions\PermissionManager\isBlockedFrom(), and User\isEmailConfirmed().

◆ checkUserConfigPermissions()

MediaWiki\Permissions\PermissionManager::checkUserConfigPermissions	(		$action,
		UserIdentity	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page )

private

Check CSS/JSON/JS sub-page permissions.

Parameters

string	$action	The action to check
UserIdentity	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 1120 of file PermissionManager.php.

References $content, $title, MediaWiki\User\UserIdentity\getName(), and NS_USER.

◆ getAllPermissions()

MediaWiki\Permissions\PermissionManager::getAllPermissions ( )

Get a list of all available permissions.

Since: 1.34

Returns: string[] Array of permission names

Definition at line 1471 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\$allRights, and MediaWiki\Permissions\PermissionManager\$coreRights.

◆ getGroupPermissions()

MediaWiki\Permissions\PermissionManager::getGroupPermissions ( $groups )

Get the permissions associated with a given list of groups.

Since: 1.34

Parameters

array $groups Array of Strings List of internal group names

Returns: array Array of Strings List of permission key names for given groups combined

Definition at line 1368 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\getUserPermissions().

◆ getGroupsWithPermission()

MediaWiki\Permissions\PermissionManager::getGroupsWithPermission ( $role )

Get all the groups who have a given permission.

Since: 1.34

Parameters

string $role Role to check

Returns: array Array of Strings List of internal group names with the given permission

Definition at line 1396 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\groupHasPermission().

Referenced by MediaWiki\Permissions\PermissionManager\getNamespaceRestrictionLevels().

◆ getNamespaceRestrictionLevels()

MediaWiki\Permissions\PermissionManager::getNamespaceRestrictionLevels	(		$index,
		UserIdentity	$user = null )

Determine which restriction levels it makes sense to use in a namespace, optionally filtered by a user's rights.

Parameters

int	$index	Index to check
UserIdentity \| null	$user	User to check

Returns: array

Definition at line 1508 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\getGroupsWithPermission(), and MediaWiki\Permissions\PermissionManager\userHasRight().

◆ getPermissionErrors()

MediaWiki\Permissions\PermissionManager::getPermissionErrors	(		$action,
		User	$user,
		LinkTarget	$page,
			$rigor = self::RIGOR_SECURE,
			$ignoreErrors = [] )

Can $user perform $action on a page?

Todo: FIXME: This does not check throttles (User::pingLimiter()).

Parameters

string	$action	Action that permission needs to be checked for
User	$user	User to check
LinkTarget	$page
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
array	$ignoreErrors	Array of Strings Set this to a list of message keys whose corresponding errors may be ignored.

Returns: array Array of arrays of the arguments to wfMessage to explain permissions problems.

Definition at line 268 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\getPermissionErrorsInternal().

◆ getPermissionErrorsInternal()

MediaWiki\Permissions\PermissionManager::getPermissionErrorsInternal	(		$action,
		User	$user,
		LinkTarget	$page,
			$rigor = self::RIGOR_SECURE,
			$short = false )

private

Can $user perform $action on a page? This is an internal function, with multiple levels of checks depending on performance needs; see $rigor below.

It does not check wfReadOnly().

Parameters

string	$action	Action that permission needs to be checked for
User	$user	User to check
LinkTarget	$page
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed
bool	$short	Set this to true to stop after the first permission error.

Returns: array Array of arrays of the arguments to wfMessage to explain permissions problems.

Exceptions

Exception

Definition at line 348 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\checkActionPermissions(), MediaWiki\Permissions\PermissionManager\getPermissionErrors(), and MediaWiki\Permissions\PermissionManager\userCan().

◆ getRightsCacheKey()

MediaWiki\Permissions\PermissionManager::getRightsCacheKey ( UserIdentity $user )

private

Gets a unique key for user rights cache.

Parameters

UserIdentity $user

Returns: string

Definition at line 1335 of file PermissionManager.php.

References MediaWiki\User\UserIdentity\isRegistered().

Referenced by MediaWiki\Permissions\PermissionManager\getUserPermissions(), MediaWiki\Permissions\PermissionManager\invalidateUsersRightsCache(), and MediaWiki\Permissions\PermissionManager\overrideUserRightsForTesting().

◆ getUserPermissions()

MediaWiki\Permissions\PermissionManager::getUserPermissions ( UserIdentity $user )

Get the permissions this user has.

Since: 1.34

Parameters

UserIdentity $user

Returns: string[] permission names

Definition at line 1264 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\getGroupPermissions(), MediaWiki\User\UserIdentity\getId(), MediaWiki\Permissions\PermissionManager\getRightsCacheKey(), MediaWiki\Permissions\PermissionManager\getUserPermissions(), and User\newFromIdentity().

Referenced by MediaWiki\Permissions\PermissionManager\getUserPermissions(), and MediaWiki\Permissions\PermissionManager\userHasRight().

◆ groupHasPermission()

MediaWiki\Permissions\PermissionManager::groupHasPermission	(		$group,
			$role )

Check, if the given group has the given permission.

If you're wanting to check whether all users have a permission, use PermissionManager::isEveryoneAllowed() instead. That properly checks if it's revoked from anyone.

Since: 1.34

Parameters

string	$group	Group to check
string	$role	Role to check

Returns: bool

Definition at line 1353 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\checkQuickPermissions(), and MediaWiki\Permissions\PermissionManager\getGroupsWithPermission().

◆ invalidateUsersRightsCache()

MediaWiki\Permissions\PermissionManager::invalidateUsersRightsCache ( $user = null )

Clears users permissions cache, if specific user is provided it tries to clear permissions cache only for provided user.

Since: 1.34

Parameters

User | null $user

Definition at line 1319 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\getRightsCacheKey().

◆ isBlockedFrom()

MediaWiki\Permissions\PermissionManager::isBlockedFrom	(	User	$user,
		LinkTarget	$page,
			$fromReplica = false )

Check if user is blocked from editing a particular article.

If the user does not have a block, this will return false.

Parameters

User	$user
LinkTarget	$page	Title to check
bool	$fromReplica	Whether to check the replica DB instead of the master

Returns: bool

Definition at line 302 of file PermissionManager.php.

References $title, User\getBlock(), User\getTalkPage(), User\isAllowUsertalk(), and User\isHidden().

Referenced by MediaWiki\Permissions\PermissionManager\checkUserBlock().

◆ isEveryoneAllowed()

MediaWiki\Permissions\PermissionManager::isEveryoneAllowed ( $right )

Check if all users may be assumed to have the given permission.

We generally assume so if the right is granted to '*' and isn't revoked on any group. It doesn't attempt to take grants or other extension limitations on rights into account in the general case, though, as that would require it to always return false and defeat the purpose. Specifically, session-based rights restrictions (such as OAuth or bot passwords) are applied based on the current session.

Parameters

string $right Right to check

Returns: bool

Since: 1.34

Definition at line 1421 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\checkReadPermissions().

◆ isNamespaceProtected()

MediaWiki\Permissions\PermissionManager::isNamespaceProtected	(		$index,
		UserIdentity	$user )

private

Determines if $user is unable to edit pages in namespace because it has been protected.

Parameters

	$index
UserIdentity	$user

Returns: bool

Definition at line 1492 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\userHasAllRights().

Referenced by MediaWiki\Permissions\PermissionManager\checkSpecialsAndNSPermissions().

◆ isSameSpecialPage()

MediaWiki\Permissions\PermissionManager::isSameSpecialPage	(		$name,
		LinkTarget	$page )

private

Returns true if this title resolves to the named special page.

Parameters

string	$name	The special page name
LinkTarget	$page

Returns: bool

Definition at line 603 of file PermissionManager.php.

References MediaWiki\Linker\LinkTarget\getDBkey(), MediaWiki\Linker\LinkTarget\getNamespace(), and NS_SPECIAL.

Referenced by MediaWiki\Permissions\PermissionManager\checkReadPermissions().

◆ missingPermissionError()

MediaWiki\Permissions\PermissionManager::missingPermissionError	(		$action,
			$short )

private

Get a description array when the user doesn't have the right to perform $action (i.e.

when User::isAllowed() returns false)

Parameters

string	$action	The action to check
bool	$short	Short circuit on first error

Returns: array Array containing an error message key and any parameters

Definition at line 584 of file PermissionManager.php.

References User\newFatalPermissionDeniedStatus().

Referenced by MediaWiki\Permissions\PermissionManager\checkQuickPermissions(), and MediaWiki\Permissions\PermissionManager\checkReadPermissions().

◆ overrideUserRightsForTesting()

MediaWiki\Permissions\PermissionManager::overrideUserRightsForTesting	(		$user,
			$rights = [] )

Overrides user permissions cache.

Since: 1.34

Parameters

User	$user
string[] \| string	$rights

Exceptions

Exception

Definition at line 1612 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\getRightsCacheKey().

◆ quickUserCan()

MediaWiki\Permissions\PermissionManager::quickUserCan	(		$action,
		User	$user,
		LinkTarget	$page )

A convenience method for calling PermissionManager::userCan with PermissionManager::RIGOR_QUICK.

Suitable for use for nonessential UI controls in common cases, but not for functional access control. May provide false positives, but should never provide a false negative.

See also: PermissionManager::userCan()

Parameters

string	$action
User	$user
LinkTarget	$page

Returns: bool

Definition at line 247 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\userCan().

◆ resultToError()

MediaWiki\Permissions\PermissionManager::resultToError	(		$errors,
			$result )

private

Add the resulting error code to the errors array.

Parameters

array	$errors	List of current errors
array \| string \| MessageSpecifier \| false	$result	Result of errors

Returns: array List of errors

Definition at line 460 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\checkPermissionHooks().

◆ userCan()

MediaWiki\Permissions\PermissionManager::userCan	(		$action,
		User	$user,
		LinkTarget	$page,
			$rigor = self::RIGOR_SECURE )

Can $user perform $action on a page?

The method is intended to replace Title::userCan() The $user parameter need to be superseded by UserIdentity value in future The $title parameter need to be superseded by PageIdentity value in future

See also: Title::userCan()

Parameters

string	$action
User	$user
LinkTarget	$page
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the master as needed

Returns: bool

Definition at line 228 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\getPermissionErrorsInternal().

Referenced by MediaWiki\Permissions\PermissionManager\checkActionPermissions(), and MediaWiki\Permissions\PermissionManager\quickUserCan().

◆ userHasAllRights()

MediaWiki\Permissions\PermissionManager::userHasAllRights ( UserIdentity $user )

Check if user is allowed to make all actions.

Parameters

UserIdentity	$user	// TODO: HHVM bug T228695#5450847
	string	...$actions PhanCommentParamWithoutRealParam

Returns: bool True if user is allowed to perform all of the given actions

Since: 1.34

Definition at line 1245 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\userHasRight().

Referenced by MediaWiki\Permissions\PermissionManager\checkCascadingSourcesRestrictions(), and MediaWiki\Permissions\PermissionManager\isNamespaceProtected().

◆ userHasAnyRight()

MediaWiki\Permissions\PermissionManager::userHasAnyRight ( UserIdentity $user )

Check if user is allowed to make any action.

Parameters

UserIdentity	$user	// TODO: HHVM bug T228695#5450847
	string	...$actions PhanCommentParamWithoutRealParam

Returns: bool True if user is allowed to perform any of the given actions

Since: 1.34

Definition at line 1226 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\userHasRight().

◆ userHasRight()

MediaWiki\Permissions\PermissionManager::userHasRight	(	UserIdentity	$user,
			$action = '' )

Testing a permission.

Since: 1.34

Parameters

UserIdentity	$user
string	$action

Returns: bool

Definition at line 1208 of file PermissionManager.php.

References MediaWiki\Permissions\PermissionManager\getUserPermissions().

Member Data Documentation

◆ $allRights

string [] null MediaWiki\Permissions\PermissionManager::$allRights

private

Cached results of getAllRights()

Definition at line 87 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\getAllPermissions().

◆ $cachedRights

bool [] MediaWiki\Permissions\PermissionManager::$cachedRights = []

private

Cached rights for isEveryoneAllowed, [ right => allowed ].

Definition at line 99 of file PermissionManager.php.

◆ $coreRights

MediaWiki\Permissions\PermissionManager::$coreRights

private

Initial value:

= [
        'apihighlimits',
        'applychangetags',
        'autoconfirmed',
        'autocreateaccount',
        'autopatrol',
        'bigdelete',
        'block',
        'blockemail',
        'bot',
        'browsearchive',
        'changetags',
        'createaccount',
        'createpage',
        'createtalk',
        'delete',
        'deletechangetags',
        'deletedhistory',
        'deletedtext',
        'deletelogentry',
        'deleterevision',
        'edit',
        'editcontentmodel',
        'editinterface',
        'editprotected',
        'editmyoptions',
        'editmyprivateinfo',
        'editmyusercss',
        'editmyuserjson',
        'editmyuserjs',
        'editmyuserjsredirect',
        'editmywatchlist',
        'editsemiprotected',
        'editsitecss',
        'editsitejson',
        'editsitejs',
        'editusercss',
        'edituserjson',
        'edituserjs',
        'hideuser',
        'import',
        'importupload',
        'ipblock-exempt',
        'managechangetags',
        'markbotedits',
        'mergehistory',
        'minoredit',
        'move',
        'movefile',
        'move-categorypages',
        'move-rootuserpages',
        'move-subpages',
        'nominornewtalk',
        'noratelimit',
        'override-export-depth',
        'pagelang',
        'patrol',
        'patrolmarks',
        'protect',
        'purge',
        'read',
        'reupload',
        'reupload-own',
        'reupload-shared',
        'rollback',
        'sendemail',
        'siteadmin',
        'suppressionlog',
        'suppressredirect',
        'suppressrevision',
        'unblockself',
        'undelete',
        'unwatchedpages',
        'upload',
        'upload_by_url',
        'userrights',
        'userrights-interwiki',
        'viewmyprivateinfo',
        'viewmywatchlist',
        'viewsuppressed',
        'writeapi',
    ]

Array of Strings Core rights.

Each of these should have a corresponding message of the form "right-$right".

Definition at line 107 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\getAllPermissions().

◆ $nsInfo

NamespaceInfo MediaWiki\Permissions\PermissionManager::$nsInfo

private

Definition at line 84 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $options

ServiceOptions MediaWiki\Permissions\PermissionManager::$options

private

Initial value:

=[,,,,,,,,]
    public const CONSTRUCTOR_OPTIONS  
        'WhitelistRead'
        'WhitelistReadRegexp'
        'EmailConfirmToEdit'
        'BlockDisablesLogin'
        'GroupPermissions'
        'RevokePermissions'
        'AvailableRights'
        'NamespaceProtection'
        'RestrictionLevels'

Definition at line 75 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $revisionLookup

RevisionLookup MediaWiki\Permissions\PermissionManager::$revisionLookup

private

Definition at line 81 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $specialPageFactory

SpecialPageFactory MediaWiki\Permissions\PermissionManager::$specialPageFactory

private

Definition at line 78 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $temporaryUserRights

string [][][] MediaWiki\Permissions\PermissionManager::$temporaryUserRights = []

private

Temporary user rights, valid for the current request only.

userid => override group => rights

Definition at line 96 of file PermissionManager.php.

◆ $usersRights

string [][] MediaWiki\Permissions\PermissionManager::$usersRights = null

private

Cached user rights.

Definition at line 90 of file PermissionManager.php.

The documentation for this class was generated from the following file:

includes/Permissions/PermissionManager.php

Public Member Functions

Private Member Functions

Private Attributes

Detailed Description

Constructor & Destructor Documentation

◆ __construct()

Member Function Documentation

◆ addTemporaryUserRights()

◆ checkActionPermissions()

◆ checkCascadingSourcesRestrictions()

◆ checkPageRestrictions()

◆ checkPermissionHooks()

◆ checkQuickPermissions()

◆ checkReadPermissions()

◆ checkSiteConfigPermissions()

◆ checkSpecialsAndNSPermissions()

◆ checkUserBlock()

◆ checkUserConfigPermissions()

◆ getAllPermissions()

◆ getGroupPermissions()

◆ getGroupsWithPermission()

◆ getNamespaceRestrictionLevels()

◆ getPermissionErrors()

◆ getPermissionErrorsInternal()

◆ getRightsCacheKey()

◆ getUserPermissions()

◆ groupHasPermission()

◆ invalidateUsersRightsCache()

◆ isBlockedFrom()

◆ isEveryoneAllowed()

◆ isNamespaceProtected()

◆ isSameSpecialPage()

◆ missingPermissionError()

◆ overrideUserRightsForTesting()

◆ quickUserCan()

◆ resultToError()

◆ userCan()

◆ userHasAllRights()

◆ userHasAnyRight()

◆ userHasRight()

Member Data Documentation

◆ $allRights

◆ $cachedRights

◆ $coreRights

◆ $nsInfo

◆ $options

◆ $revisionLookup

◆ $specialPageFactory

◆ $temporaryUserRights

◆ $usersRights