Make it a lot harder to unprotect the MediaWiki namespace. In response to cs.wikinews...

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index a214f15..717c3d6 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -40,6 +40,9 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
   is true per default, but can be set to false to allow any title.
 * $wgSpamRegex may now be an array of multiple regular expressions.
 * $wgAjaxSearch has been removed; use $wgEnableMWSuggest instead.
+* Editing the MediaWiki namespace is now unconditionally restricted to people 
+  with the editinterface right, configuring this in $wgNamespaceProtection 
+  is not required.
 
 === New features in 1.14 ===
 

diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 139db60..e774f83 100644 (file)
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -1244,9 +1244,10 @@ $wgRestrictionLevels = array( '', 'autoconfirmed', 'sysop' );
  * Set the minimum permissions required to edit pages in each
  * namespace.  If you list more than one permission, a user must
  * have all of them to edit pages in that namespace.
+ *
+ * Note: NS_MEDIAWIKI is implicitly restricted to editinterface.
  */
 $wgNamespaceProtection = array();
-$wgNamespaceProtection[ NS_MEDIAWIKI ] = array( 'editinterface' );
 
 /**
  * Pages in namespaces in this array can not be used as templates.

diff --git a/includes/Setup.php b/includes/Setup.php
index 158b1c0..ecc6def 100644 (file)
--- a/includes/Setup.php
+++ b/includes/Setup.php
@@ -58,6 +58,15 @@ if ( empty( $wgFileStore['deleted']['directory'] ) ) {
        $wgFileStore['deleted']['directory'] = "{$wgUploadDirectory}/deleted";
 }
 
+/**
+ * Unconditional protection for NS_MEDIAWIKI since otherwise it's too easy for a 
+ * sysadmin to set $wgNamespaceProtection incorrectly and leave the wiki insecure. 
+ *
+ * Note that this is the definition of editinterface and it can be granted to 
+ * all users if desired.
+ */
+$wgNamespaceProtection[NS_MEDIAWIKI] = 'editinterface';
+
 /**
  * Initialise $wgLocalFileRepo from backwards-compatible settings
  */