A service class for checking permissions To obtain an instance, use MediaWikiServices::getInstance()->getPermissionManager(). More...

Collaboration diagram for MediaWiki\Permissions\PermissionManager:

[legend]

Public Member Functions
	__construct (ServiceOptions $options, SpecialPageFactory $specialPageFactory, NamespaceInfo $nsInfo, GroupPermissionsLookup $groupPermissionsLookup, UserGroupManager $userGroupManager, BlockErrorFormatter $blockErrorFormatter, HookContainer $hookContainer, UserCache $userCache, RedirectLookup $redirectLookup, RestrictionStore $restrictionStore, TitleFormatter $titleFormatter, TempUserConfig $tempUserConfig, UserFactory $userFactory, ActionFactory $actionFactory)

	addTemporaryUserRights (UserIdentity $user, $rights)
	Add temporary user rights, only valid for the current function scope. More...

	getAllPermissions ()
	Get a list of all available permissions. More...

	getGroupPermissions ( $groups)
	Get the permissions associated with a given list of groups. More...

	getGroupsWithPermission ( $role)
	Get all the groups who have a given permission. More...

	getNamespaceRestrictionLevels ( $index, UserIdentity $user=null)
	Determine which restriction levels it makes sense to use in a namespace, optionally filtered by a user's rights. More...

	getPermissionErrors ( $action, User $user, LinkTarget $page, $rigor=self::RIGOR_SECURE, $ignoreErrors=[])
	Can $user perform $action on a page? More...

	getUserPermissions (UserIdentity $user)
	Get the permissions this user has. More...

	groupHasPermission ( $group, $role)
	Check, if the given group has the given permission. More...

	invalidateUsersRightsCache ( $user=null)
	Clear the in-process permission cache for one or all users. More...

	isBlockedFrom (User $user, $page, $fromReplica=false)
	Check if user is blocked from editing a particular article. More...

	isEveryoneAllowed ( $right)
	Check if all users may be assumed to have the given permission. More...

	overrideUserRightsForTesting ( $user, $rights=[])
	Override the user permissions cache. More...

	quickUserCan ( $action, User $user, LinkTarget $page)
	A convenience method for calling PermissionManager::userCan with PermissionManager::RIGOR_QUICK. More...

	userCan ( $action, User $user, LinkTarget $page, $rigor=self::RIGOR_SECURE)
	Can $user perform $action on a page? More...

	userHasAllRights (UserIdentity $user,... $actions)
	Whether the user is allowed to perform all of the given actions. More...

	userHasAnyRight (UserIdentity $user,... $actions)
	Whether the user is generally allowed to perform at least one of the actions. More...

	userHasRight (UserIdentity $user, $action='')
	Whether the user is generally allowed to perform the given action. More...

Public Attributes
const	CONSTRUCTOR_OPTIONS

Private Member Functions
	checkActionPermissions ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check action permissions not already checked in checkQuickPermissions. More...

	checkCascadingSourcesRestrictions ( $action, UserIdentity $user, $errors, $rigor, $short, LinkTarget $page)
	Check restrictions on cascading pages. More...

	checkPageRestrictions ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check for any page_restrictions table requirements on this page. More...

	checkPermissionHooks ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check various permission hooks. More...

	checkQuickPermissions ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Run easy-to-test (or "quick") permissions checks for a given action. More...

	checkReadPermissions ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check that the user is allowed to read this page. More...

	checkSiteConfigPermissions ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check sitewide CSS/JSON/JS permissions. More...

	checkSpecialsAndNSPermissions ( $action, UserIdentity $user, $errors, $rigor, $short, LinkTarget $page)
	Check permissions on special pages & namespaces. More...

	checkUserBlock ( $action, User $user, $errors, $rigor, $short, LinkTarget $page)
	Check that the user isn't blocked from editing. More...

	checkUserConfigPermissions ( $action, UserIdentity $user, $errors, $rigor, $short, LinkTarget $page)
	Check CSS/JSON/JS sub-page permissions. More...

	getPermissionErrorsInternal ( $action, User $user, LinkTarget $page, $rigor=self::RIGOR_SECURE, $short=false)
	Can $user perform $action on a page? This is an internal function, with multiple levels of checks depending on performance needs; see $rigor below. More...

	getRightsCacheKey (UserIdentity $user)
	Get a unique key for user rights cache. More...

	isNamespaceProtected ( $index, UserIdentity $user)
	Determine if $user is unable to edit pages in namespace because it has been protected. More...

	isSameSpecialPage ( $name, LinkTarget $page)
	Whether a title resolves to the named special page. More...

	missingPermissionError (string $action, bool $short)
	Get a description array for when an action isn't allowed to be performed. More...

	resultToError ( $errors, $result)
	Add the resulting error code to the errors array. More...

	userCanEditRawHtmlPage (UserIdentity $user)
	Check if user is allowed to edit sitewide pages that contain raw HTML. More...

Private Attributes
ActionFactory	$actionFactory

string[] null	$allRights
	Cached results of getAllPermissions() More...

BlockErrorFormatter	$blockErrorFormatter

bool[]	$cachedRights = []
	Cached rights for isEveryoneAllowed, [ right => allowed ]. More...

	$coreRights
	Array of Strings Core rights. More...

GroupPermissionsLookup	$groupPermissionsLookup

HookRunner	$hookRunner

NamespaceInfo	$nsInfo

ServiceOptions	$options

RedirectLookup	$redirectLookup

RestrictionStore	$restrictionStore

SpecialPageFactory	$specialPageFactory

string[][][]	$temporaryUserRights = []
	Temporary user rights, valid for the current request only. More...

TempUserConfig	$tempUserConfig

TitleFormatter	$titleFormatter

UserCache	$userCache

UserFactory	$userFactory

UserGroupManager	$userGroupManager

string[][]	$usersRights = []
	Cached user rights. More...

Detailed Description

A service class for checking permissions To obtain an instance, use MediaWikiServices::getInstance()->getPermissionManager().

Since: 1.33

Definition at line 56 of file PermissionManager.php.

Constructor & Destructor Documentation

◆ __construct()

MediaWiki\Permissions\PermissionManager::__construct	(	ServiceOptions	$options,
		SpecialPageFactory	$specialPageFactory,
		NamespaceInfo	$nsInfo,
		GroupPermissionsLookup	$groupPermissionsLookup,
		UserGroupManager	$userGroupManager,
		BlockErrorFormatter	$blockErrorFormatter,
		HookContainer	$hookContainer,
		UserCache	$userCache,
		RedirectLookup	$redirectLookup,
		RestrictionStore	$restrictionStore,
		TitleFormatter	$titleFormatter,
		TempUserConfig	$tempUserConfig,
		UserFactory	$userFactory,
		ActionFactory	$actionFactory
	)

Parameters

ServiceOptions	$options
SpecialPageFactory	$specialPageFactory
NamespaceInfo	$nsInfo
GroupPermissionsLookup	$groupPermissionsLookup
UserGroupManager	$userGroupManager
BlockErrorFormatter	$blockErrorFormatter
HookContainer	$hookContainer
UserCache	$userCache
RedirectLookup	$redirectLookup
RestrictionStore	$restrictionStore
TitleFormatter	$titleFormatter
TempUserConfig	$tempUserConfig
UserFactory	$userFactory
ActionFactory	$actionFactory

Definition at line 247 of file PermissionManager.php.

Member Function Documentation

◆ addTemporaryUserRights()

MediaWiki\Permissions\PermissionManager::addTemporaryUserRights	(	UserIdentity	$user,
			$rights
	)

Add temporary user rights, only valid for the current function scope.

This is meant for making it possible to programatically trigger certain actions that the user wouldn't be able to trigger themselves; e.g. allow users without the bot right to make bot-flagged actions through certain special pages.

This returns a "scope guard" variable. Its only purpose is to be stored in a variable by the caller, which is automatically closed at the end of the function, at which point the rights are revoked again. Alternatively, you can close it earlier by consuming it via ScopedCallback::consume().

Since: 1.34

Parameters

UserIdentity	$user
string \| string[]	$rights

Returns: ScopedCallback

Definition at line 1763 of file PermissionManager.php.

References MediaWiki\User\UserIdentity\getId().

◆ checkActionPermissions()

MediaWiki\Permissions\PermissionManager::checkActionPermissions	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page
	)

private

Check action permissions not already checked in checkQuickPermissions.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 1099 of file PermissionManager.php.

◆ checkCascadingSourcesRestrictions()

MediaWiki\Permissions\PermissionManager::checkCascadingSourcesRestrictions	(		$action,
		UserIdentity	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page
	)

private

Check restrictions on cascading pages.

Parameters

string	$action	The action to check
UserIdentity	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 1045 of file PermissionManager.php.

References $title, and Title\getCascadeProtectionSources().

◆ checkPageRestrictions()

MediaWiki\Permissions\PermissionManager::checkPageRestrictions	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page
	)

private

Check for any page_restrictions table requirements on this page.

If the page has multiple restrictions, the user must have all of those rights to perform the action in question.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 997 of file PermissionManager.php.

References $title.

◆ checkPermissionHooks()

MediaWiki\Permissions\PermissionManager::checkPermissionHooks	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page
	)

private

Check various permission hooks.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 534 of file PermissionManager.php.

◆ checkQuickPermissions()

MediaWiki\Permissions\PermissionManager::checkQuickPermissions	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page
	)

private

Run easy-to-test (or "quick") permissions checks for a given action.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 886 of file PermissionManager.php.

◆ checkReadPermissions()

MediaWiki\Permissions\PermissionManager::checkReadPermissions	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page
	)

private

Check that the user is allowed to read this page.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 607 of file PermissionManager.php.

◆ checkSiteConfigPermissions()

MediaWiki\Permissions\PermissionManager::checkSiteConfigPermissions	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page
	)

private

Check sitewide CSS/JSON/JS permissions.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 1259 of file PermissionManager.php.

◆ checkSpecialsAndNSPermissions()

MediaWiki\Permissions\PermissionManager::checkSpecialsAndNSPermissions	(		$action,
		UserIdentity	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page
	)

private

Check permissions on special pages & namespaces.

Parameters

string	$action	The action to check
UserIdentity	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 1217 of file PermissionManager.php.

◆ checkUserBlock()

MediaWiki\Permissions\PermissionManager::checkUserBlock	(		$action,
		User	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page
	)

private

Check that the user isn't blocked from editing.

Parameters

string	$action	The action to check
User	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 742 of file PermissionManager.php.

◆ checkUserConfigPermissions()

MediaWiki\Permissions\PermissionManager::checkUserConfigPermissions	(		$action,
		UserIdentity	$user,
			$errors,
			$rigor,
			$short,
		LinkTarget	$page
	)

private

Check CSS/JSON/JS sub-page permissions.

Parameters

string	$action	The action to check
UserIdentity	$user	User to check
array	$errors	List of current errors
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Short circuit on first error
LinkTarget	$page

Returns: array List of errors

Definition at line 1313 of file PermissionManager.php.

References $title, MediaWiki\User\UserIdentity\getName(), and NS_USER.

◆ getAllPermissions()

MediaWiki\Permissions\PermissionManager::getAllPermissions ( )

Get a list of all available permissions.

Since: 1.34

Returns: string[] Array of permission names

Definition at line 1624 of file PermissionManager.php.

◆ getGroupPermissions()

MediaWiki\Permissions\PermissionManager::getGroupPermissions ( $groups )

Get the permissions associated with a given list of groups.

Since: 1.34

Deprecated:: since 1.36 Use GroupPermissionsLookup instead

Parameters

string[] $groups internal group names

Returns: string[] permission key names for given groups combined

Definition at line 1544 of file PermissionManager.php.

◆ getGroupsWithPermission()

MediaWiki\Permissions\PermissionManager::getGroupsWithPermission ( $role )

Get all the groups who have a given permission.

Since: 1.34

Deprecated:: since 1.36, use GroupPermissionsLookup instead.

Parameters

string $role Role to check

Returns: string[] internal group names with the given permission

Definition at line 1556 of file PermissionManager.php.

◆ getNamespaceRestrictionLevels()

MediaWiki\Permissions\PermissionManager::getNamespaceRestrictionLevels	(		$index,
		UserIdentity	$user = `null`
	)

Determine which restriction levels it makes sense to use in a namespace, optionally filtered by a user's rights.

Parameters

int	$index	Namespace ID (index) to check
UserIdentity \| null	$user	User to check

Returns: string[]

Definition at line 1662 of file PermissionManager.php.

◆ getPermissionErrors()

MediaWiki\Permissions\PermissionManager::getPermissionErrors	(		$action,
		User	$user,
		LinkTarget	$page,
			$rigor = `self::RIGOR_SECURE`,
			$ignoreErrors = `[]`
	)

Can $user perform $action on a page?

Todo:: FIXME: This does not check throttles (User::pingLimiter()).

Parameters

string	$action	Action that permission needs to be checked for
User	$user	User to check
LinkTarget	$page
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
string[]	$ignoreErrors	Set this to a list of message keys whose corresponding errors may be ignored.

Returns: array[] Array of arrays of the arguments to wfMessage to explain permissions problems.

Definition at line 337 of file PermissionManager.php.

◆ getPermissionErrorsInternal()

MediaWiki\Permissions\PermissionManager::getPermissionErrorsInternal	(		$action,
		User	$user,
		LinkTarget	$page,
			$rigor = `self::RIGOR_SECURE`,
			$short = `false`
	)

private

Can $user perform $action on a page? This is an internal function, with multiple levels of checks depending on performance needs; see $rigor below.

It does not check ReadOnlyMode::isReadOnly().

Parameters

string	$action	Action that permission needs to be checked for
User	$user	User to check
LinkTarget	$page
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed
bool	$short	Set this to true to stop after the first permission error.

Returns: array[] Array of arrays of the arguments to wfMessage to explain permissions problems.

Exceptions

Exception

Definition at line 420 of file PermissionManager.php.

◆ getRightsCacheKey()

MediaWiki\Permissions\PermissionManager::getRightsCacheKey ( UserIdentity $user )

private

Get a unique key for user rights cache.

Parameters

UserIdentity $user

Returns: string

Definition at line 1515 of file PermissionManager.php.

◆ getUserPermissions()

MediaWiki\Permissions\PermissionManager::getUserPermissions ( UserIdentity $user )

Get the permissions this user has.

Since: 1.34

Parameters

UserIdentity $user

Returns: string[] permission names

Definition at line 1443 of file PermissionManager.php.

References User\newFromIdentity().

◆ groupHasPermission()

MediaWiki\Permissions\PermissionManager::groupHasPermission	(	$group,
		$role
	)

Check, if the given group has the given permission.

If you're wanting to check whether all users have a permission, use PermissionManager::isEveryoneAllowed() instead. That properly checks if it's revoked from anyone.

Since: 1.34

Deprecated:: since 1.36 Use GroupPermissionsLookup instead

Parameters

string	$group	Group to check
string	$role	Role to check

Returns: bool

Definition at line 1532 of file PermissionManager.php.

◆ invalidateUsersRightsCache()

MediaWiki\Permissions\PermissionManager::invalidateUsersRightsCache ( $user = null )

Clear the in-process permission cache for one or all users.

Since: 1.34

Parameters

UserIdentity | null $user If a specific user is provided it will clear the permission cache only for that user.

Definition at line 1500 of file PermissionManager.php.

◆ isBlockedFrom()

MediaWiki\Permissions\PermissionManager::isBlockedFrom	(	User	$user,
			$page,
			$fromReplica = `false`
	)

Check if user is blocked from editing a particular article.

If the user does not have a block, this will return false.

Parameters

User	$user
PageIdentity \| LinkTarget	$page	Title to check
bool	$fromReplica	Whether to check the replica DB instead of the primary DB

Returns: bool

Definition at line 370 of file PermissionManager.php.

◆ isEveryoneAllowed()

MediaWiki\Permissions\PermissionManager::isEveryoneAllowed ( $right )

Check if all users may be assumed to have the given permission.

We generally assume so if the right is granted to '*' and isn't revoked on any group. It doesn't attempt to take grants or other extension limitations on rights into account in the general case, though, as that would require it to always return false and defeat the purpose. Specifically, session-based rights restrictions (such as OAuth or bot passwords) are applied based on the current session.

Since: 1.34

Parameters

string $right Right to check

Returns: bool

Definition at line 1574 of file PermissionManager.php.

◆ isNamespaceProtected()

MediaWiki\Permissions\PermissionManager::isNamespaceProtected	(		$index,
		UserIdentity	$user
	)

private

Determine if $user is unable to edit pages in namespace because it has been protected.

Parameters

int	$index
UserIdentity	$user

Returns: bool

Definition at line 1646 of file PermissionManager.php.

◆ isSameSpecialPage()

MediaWiki\Permissions\PermissionManager::isSameSpecialPage	(		$name,
		LinkTarget	$page
	)

private

Whether a title resolves to the named special page.

Parameters

string	$name	The special page name
LinkTarget	$page

Returns: bool

Definition at line 717 of file PermissionManager.php.

References MediaWiki\Linker\LinkTarget\getDBkey().

◆ missingPermissionError()

MediaWiki\Permissions\PermissionManager::missingPermissionError	(	string	$action,
		bool	$short
	)

private

Get a description array for when an action isn't allowed to be performed.

Parameters

string	$action	The action to check
bool	$short	Short circuit on first error

Returns: array Array containing an error message key and any parameters

Definition at line 699 of file PermissionManager.php.

◆ overrideUserRightsForTesting()

MediaWiki\Permissions\PermissionManager::overrideUserRightsForTesting	(	$user,
		$rights = `[]`
	)

Override the user permissions cache.

Definition at line 1780 of file PermissionManager.php.

◆ quickUserCan()

MediaWiki\Permissions\PermissionManager::quickUserCan	(		$action,
		User	$user,
		LinkTarget	$page
	)

A convenience method for calling PermissionManager::userCan with PermissionManager::RIGOR_QUICK.

Suitable for use for nonessential UI controls in common cases, but not for functional access control. May provide false positives, but should never provide a false negative.

See also: PermissionManager::userCan()

Parameters

string	$action
User	$user
LinkTarget	$page

Returns: bool

Definition at line 316 of file PermissionManager.php.

◆ resultToError()

MediaWiki\Permissions\PermissionManager::resultToError	(	$errors,
		$result
	)

private

Add the resulting error code to the errors array.

Parameters

array	$errors	List of current errors
array \| string \| MessageSpecifier \| false	$result	Result of errors

Returns: array List of errors

Definition at line 573 of file PermissionManager.php.

◆ userCan()

MediaWiki\Permissions\PermissionManager::userCan	(		$action,
		User	$user,
		LinkTarget	$page,
			$rigor = `self::RIGOR_SECURE`
	)

Can $user perform $action on a page?

The method replaced Title::userCan() The $user parameter need to be superseded by UserIdentity value in future The $title parameter need to be superseded by PageIdentity value in future

Parameters

string	$action
User	$user
LinkTarget	$page
string	$rigor	One of PermissionManager::RIGOR_ constants RIGOR_QUICK : does cheap permission checks from replica DBs (usable for GUI creation) RIGOR_FULL : does cheap and expensive checks possibly from a replica DB RIGOR_SECURE : does cheap and expensive checks, using the primary DB as needed

Returns: bool

Definition at line 297 of file PermissionManager.php.

◆ userCanEditRawHtmlPage()

MediaWiki\Permissions\PermissionManager::userCanEditRawHtmlPage ( UserIdentity $user )

private

Check if user is allowed to edit sitewide pages that contain raw HTML.

Pages listed in $wgRawHtmlMessages allow raw HTML which can be used to deploy CSS or JS code to all users so both rights are required to edit them.

Parameters

UserIdentity $user

Returns: bool True if user has both rights

Definition at line 1742 of file PermissionManager.php.

◆ userHasAllRights()

MediaWiki\Permissions\PermissionManager::userHasAllRights	(	UserIdentity	$user,
			$actions
	)

Whether the user is allowed to perform all of the given actions.

Since: 1.34

Parameters

UserIdentity	$user
	string	...$actions

Returns: bool True if user is allowed to perform all of the given actions

Definition at line 1427 of file PermissionManager.php.

◆ userHasAnyRight()

MediaWiki\Permissions\PermissionManager::userHasAnyRight	(	UserIdentity	$user,
			$actions
	)

Whether the user is generally allowed to perform at least one of the actions.

Since: 1.34

Parameters

UserIdentity	$user
	string	...$actions

Returns: bool True if user is allowed to perform any of the actions

Definition at line 1410 of file PermissionManager.php.

◆ userHasRight()

MediaWiki\Permissions\PermissionManager::userHasRight	(	UserIdentity	$user,
			$action = `''`
	)

Whether the user is generally allowed to perform the given action.

Since: 1.34

Parameters

UserIdentity	$user
string	$action

Returns: bool True if allowed

Definition at line 1392 of file PermissionManager.php.

Member Data Documentation

◆ $actionFactory

ActionFactory MediaWiki\Permissions\PermissionManager::$actionFactory

private

Definition at line 127 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $allRights

string [] null MediaWiki\Permissions\PermissionManager::$allRights

private

Cached results of getAllPermissions()

Definition at line 103 of file PermissionManager.php.

◆ $blockErrorFormatter

BlockErrorFormatter MediaWiki\Permissions\PermissionManager::$blockErrorFormatter

private

Definition at line 106 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $cachedRights

bool [] MediaWiki\Permissions\PermissionManager::$cachedRights = []

private

Cached rights for isEveryoneAllowed, [ right => allowed ].

Definition at line 139 of file PermissionManager.php.

◆ $coreRights

MediaWiki\Permissions\PermissionManager::$coreRights

private

Initial value:

= [
        'apihighlimits',
        'applychangetags',
        'autoconfirmed',
        'autocreateaccount',
        'autopatrol',
        'bigdelete',
        'block',
        'blockemail',
        'bot',
        'browsearchive',
        'changetags',
        'createaccount',
        'createpage',
        'createtalk',
        'delete',
        'delete-redirect',
        'deletechangetags',
        'deletedhistory',
        'deletedtext',
        'deletelogentry',
        'deleterevision',
        'edit',
        'editcontentmodel',
        'editinterface',
        'editprotected',
        'editmyoptions',
        'editmyprivateinfo',
        'editmyusercss',
        'editmyuserjson',
        'editmyuserjs',
        'editmyuserjsredirect',
        'editmywatchlist',
        'editsemiprotected',
        'editsitecss',
        'editsitejson',
        'editsitejs',
        'editusercss',
        'edituserjson',
        'edituserjs',
        'hideuser',
        'import',
        'importupload',
        'ipblock-exempt',
        'managechangetags',
        'markbotedits',
        'mergehistory',
        'minoredit',
        'move',
        'movefile',
        'move-categorypages',
        'move-rootuserpages',
        'move-subpages',
        'nominornewtalk',
        'noratelimit',
        'override-export-depth',
        'pagelang',
        'patrol',
        'patrolmarks',
        'protect',
        'purge',
        'read',
        'reupload',
        'reupload-own',
        'reupload-shared',
        'rollback',
        'sendemail',
        'siteadmin',
        'suppressionlog',
        'suppressredirect',
        'suppressrevision',
        'unblockself',
        'undelete',
        'unwatchedpages',
        'upload',
        'upload_by_url',
        'userrights',
        'userrights-interwiki',
        'viewmyprivateinfo',
        'viewmywatchlist',
        'viewsuppressed',
        'writeapi',
    ]

Array of Strings Core rights.

Each of these should have a corresponding message of the form "right-$right".

Definition at line 147 of file PermissionManager.php.

◆ $groupPermissionsLookup

GroupPermissionsLookup MediaWiki\Permissions\PermissionManager::$groupPermissionsLookup

private

Definition at line 97 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $hookRunner

HookRunner MediaWiki\Permissions\PermissionManager::$hookRunner

private

Definition at line 109 of file PermissionManager.php.

◆ $nsInfo

NamespaceInfo MediaWiki\Permissions\PermissionManager::$nsInfo

private

Definition at line 94 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $options

ServiceOptions MediaWiki\Permissions\PermissionManager::$options

private

Definition at line 85 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $redirectLookup

RedirectLookup MediaWiki\Permissions\PermissionManager::$redirectLookup

private

Definition at line 91 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $restrictionStore

RestrictionStore MediaWiki\Permissions\PermissionManager::$restrictionStore

private

Definition at line 115 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $specialPageFactory

SpecialPageFactory MediaWiki\Permissions\PermissionManager::$specialPageFactory

private

Definition at line 88 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $temporaryUserRights

string [][][] MediaWiki\Permissions\PermissionManager::$temporaryUserRights = []

private

Temporary user rights, valid for the current request only.

userid => override group => rights

Definition at line 136 of file PermissionManager.php.

◆ $tempUserConfig

TempUserConfig MediaWiki\Permissions\PermissionManager::$tempUserConfig

private

Definition at line 121 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $titleFormatter

TitleFormatter MediaWiki\Permissions\PermissionManager::$titleFormatter

private

Definition at line 118 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $userCache

UserCache MediaWiki\Permissions\PermissionManager::$userCache

private

Definition at line 112 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $userFactory

UserFactory MediaWiki\Permissions\PermissionManager::$userFactory

private

Definition at line 124 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $userGroupManager

UserGroupManager MediaWiki\Permissions\PermissionManager::$userGroupManager

private

Definition at line 100 of file PermissionManager.php.

Referenced by MediaWiki\Permissions\PermissionManager\__construct().

◆ $usersRights

string [][] MediaWiki\Permissions\PermissionManager::$usersRights = []

private

Cached user rights.

Definition at line 130 of file PermissionManager.php.

◆ CONSTRUCTOR_OPTIONS

const MediaWiki\Permissions\PermissionManager::CONSTRUCTOR_OPTIONS

Initial value:

= [
        MainConfigNames::WhitelistRead,
        MainConfigNames::WhitelistReadRegexp,
        MainConfigNames::EmailConfirmToEdit,
        MainConfigNames::BlockDisablesLogin,
        MainConfigNames::EnablePartialActionBlocks,
        MainConfigNames::GroupPermissions,
        MainConfigNames::RevokePermissions,
        MainConfigNames::AvailableRights,
        MainConfigNames::NamespaceProtection,
        MainConfigNames::RestrictionLevels,
        MainConfigNames::DeleteRevisionsLimit,
    ]

Access: internal: For use by ServiceWiring

Definition at line 70 of file PermissionManager.php.

The documentation for this class was generated from the following file:

includes/Permissions/PermissionManager.php

Public Member Functions

Public Attributes

Private Member Functions

Private Attributes

Detailed Description

Constructor & Destructor Documentation

◆ __construct()

Member Function Documentation

◆ addTemporaryUserRights()

◆ checkActionPermissions()

◆ checkCascadingSourcesRestrictions()

◆ checkPageRestrictions()

◆ checkPermissionHooks()

◆ checkQuickPermissions()

◆ checkReadPermissions()

◆ checkSiteConfigPermissions()

◆ checkSpecialsAndNSPermissions()

◆ checkUserBlock()

◆ checkUserConfigPermissions()

◆ getAllPermissions()

◆ getGroupPermissions()

◆ getGroupsWithPermission()

◆ getNamespaceRestrictionLevels()

◆ getPermissionErrors()

◆ getPermissionErrorsInternal()

◆ getRightsCacheKey()

◆ getUserPermissions()

◆ groupHasPermission()

◆ invalidateUsersRightsCache()

◆ isBlockedFrom()

◆ isEveryoneAllowed()

◆ isNamespaceProtected()

◆ isSameSpecialPage()

◆ missingPermissionError()

◆ overrideUserRightsForTesting()

◆ quickUserCan()

◆ resultToError()

◆ userCan()

◆ userCanEditRawHtmlPage()

◆ userHasAllRights()

◆ userHasAnyRight()

◆ userHasRight()

Member Data Documentation

◆ $actionFactory

◆ $allRights

◆ $blockErrorFormatter

◆ $cachedRights

◆ $coreRights

◆ $groupPermissionsLookup

◆ $hookRunner

◆ $nsInfo

◆ $options

◆ $redirectLookup

◆ $restrictionStore

◆ $specialPageFactory

◆ $temporaryUserRights

◆ $tempUserConfig

◆ $titleFormatter

◆ $userCache

◆ $userFactory

◆ $userGroupManager

◆ $usersRights

◆ CONSTRUCTOR_OPTIONS