Last modified: 2008-12-14 20:49:31 UTC
I have provided code for this enhancement. It allows the wiki to grant
privileges based on the IP address of the user. You use it by putting this sort
of thing into your LocalSettings.php:
$wgIpAddressRanges = array(
"192.168.*.*" => "mycompany"
$wgGroupPermissions["mycompany","createaccount"] = true;
Here is the code that implements this feature:
The patch is against 1.7.1. The total amount of code in this patch is only
about two dozen lines. I should warn you that I'm not a particularly
experienced mediawiki coder, so somebody who knows what they're doing should
definitely read over the code. Fortunately, that should only take a minute,
since it's so short.
The particular situation that led me to implement this feature is as follows. I
work at a university, and we want a wiki where only university students can
create accounts, but where anyone can read the wiki. Since we have thousands of
students, and thousands more every semester, it is impractical to assign
privileges by handing out accounts. Doing it by IP address range makes more sense.
If you have time, let me know if you integrate this patch. firstname.lastname@example.org
Please post your patch as *attachment* to this bug in unified format (patch -u).
Created attachment 2437 [details]
Adds the ability to grant privileges based on IP address.
Hang on, I'm not used to doing this. Give me a second, I'll get this right
$_SERVER['REMOTE_ADDR'] isn't safe when proxies are part of the setup;
use wfGetIP() which follows the permitted proxy headers.
(In reply to comment #1)
> Please post your patch as *attachment* to this bug in unified format (patch -u).
"diff -u" of course - sorry
Created attachment 2438 [details]
Adds the ability to grant privileges based on IP address
This one's a unified diff (diff -u). Sorry, still getting used to the system.
Created attachment 2439 [details]
Variant using wgGetIp instead of $_SERVER['REMOTE_ADDR']
Brion recommended this modification. I tested it and it worked fine in the
normal case (I don't have a proxy setup, so I wasn't able to test that case).
However, this raises a question in my mind. In the event that somebody is
talking to the wiki via a proxy, we need to use the IP address of the proxy,
not the IP address that the proxy reports. Using the latter would make a huge
security hole, since anyone could code up a proxy that reports any IP that they
wish. Which does wfGetIp report? Which does $_SERVER['REMOTE_ADDR'] report?
These things are beyond my knowledge and experience.
"...use wfGetIP() which follows the **permitted** proxy headers."
See ProxyTools.php for details.
Well, deciphering the code in ProxyTools.php is more that I can currently
manage. I'll leave it to coders older and wiser than myself to decide what's
the right method.
Created attachment 2440 [details]
Variant using wfGetIP instead of $_SERVER['REMOTE_ADDR']
This time, without the typo. I'm not sure how the typo got through last time,
I thought I tested it.
Created attachment 5581 [details]
Redo this using the Autopromote stuff. Allows the user to get rights if they're either A) A specific IP address (using APCOND_ISIP) or B) In a range (using APCOND_IPINRANGE)
Done in r44592