Topic on Project:Support desk

Can i restrict the user from all the Special Pages and Recent Changes page except admin???

Please reply if you know the answer...

You could check, if there is a user right to view "Special:"-pages. If so, revoke it.

Maybe you can revoke permission to see pages in the namespace with the special pages.

Maybe MediaWiki also offers a hook to modify user's permissions for the currently called page. In case the user requests a special page, set the "view" right to false.

If everything else does not help, you could still use CSS to hide all links, which point to Special:-pages. CSS selectors is the keyword here.

CSS is extremely weak for this. If the person knows the special page name he/she can enter the URL directly on their browser's location bar, or use the search.

There's no core MediaWiki functionality to do this. Maybe you can extend MediaWiki using a hook to check if the requested page is a special one and if the user is not in a specific grup prevent the action. Note that data in some special pages can be accessed through the api anyway.

Thanks for the reply,

Do you know how to get the user_id from the User Table for the specific user who is accessing the page..

So you are using a hook now? Which one? Check the page of this hook (here is a list: Category:MediaWiki hooks) and see, which parameters you get there. One of them should be the user object. (And inside the user object you somewhere have the user ID; just display the contents of the user object to get the exact name of the key.)

See documentation on the User class - https://svn.wikimedia.org/doc/classUser.html . You can get a user object from the local request context object. Several of the authorization hooks will provide you with a user object directly.

You might want to look at what other user access extensions do. For example Extension:Whitelist_Namespaces#Code. Keep in mind that MW is not really designed with viewing restrictions in mind. For example people can also transclude special pages, look up the info in the api, etc (All of which can be worked around, but be careful).

The hook you would most likely want is userCan but there are other authorization hooks like UserGetRights may be useful

Thanks