Editing Manual/User rights

<languages/>
<translate><!--T:1--> '''User rights''' are permissions (such as the ability to edit pages or to block users) that can be assigned to different '''user groups'''.</translate>
<translate><!--T:227--> MediaWiki ships with a default set of user rights and user groups, but these can be customized.</translate>
<translate><!--T:228--> This page explains the default rights and groups, and how to customize them.</translate>

<translate>
<!--T:229-->
For information about how to add and remove individual wiki users from groups, see <tvar name=1></tvar> and <tvar name=2></tvar>.

== Changing group permissions == <!--T:7-->
</translate>
<translate><!--T:8--> A default MediaWiki installation assigns certain rights to default groups (see table at [[<tvar name=1>#List of permissions</tvar>|#List of permissions]]).</translate>
<translate><!--T:9--> You can change the default rights by editing the <tvar name=1></tvar> array in <tvar name=2></tvar> with the following syntax:</translate>

<syntaxhighlight lang="php" copy>
$wgGroupPermissions['group']['right'] = true /* <translate nowrap><!--T:10--> or <tvar name=1>false</tvar></translate> */;
</syntaxhighlight>
</tvar> will be set in <tvar name=2><code>includes/DefaultSettings.php</code></tvar>, but it is ''not'' present in <tvar name=3><code>LocalSettings.php</code></tvar>.</translate> <translate><!--T:12--> You will then need to add it in that file.</translate>
}}

<translate><!--T:13--> If a member has multiple groups, they get all the permissions from each of the groups they are in.</translate>
<translate><!--T:14--> All users, including anonymous users, are in the <tvar name=1><code>*</code></tvar> group; all registered users are in the <tvar name=2><code>user</code></tvar> group.</translate>
<translate><!--T:15--> In addition to the default groups, you can arbitrarily create new groups using the same array.</translate>

<translate>
=== Examples === <!--T:16-->

<!--T:17-->
This example will disable viewing of all pages not listed in <tvar name=1></tvar>, then re-enable for registered users only:
</translate>

<syntaxhighlight lang="php" copy>
$wgGroupPermissions['*']['read'] = false;
# <translate nowrap><!--T:18--> The following line is not actually necessary, since it's in the defaults. Setting '*' to false doesn't disable rights for groups that have the right separately set to true!</translate>
$wgGroupPermissions['user']['read'] = true;
</syntaxhighlight>

<translate>
<!--T:21-->
This example will disable editing of all pages, then re-enable for users with [[<tvar name=1>Special:MyLanguage/Manual:$wgEmailAuthentication</tvar>|confirmed email addresses]] only:
</translate>
<!-- This is pretty complicated, not so well explained and beyond scope; should we keep it? Chealer 20250722 -->
<syntaxhighlight lang="php" copy>
# <translate nowrap><!--T:22--> Disable for everyone.</translate>
$wgGroupPermissions['*']['edit'] = false;
# <translate nowrap><!--T:23--> Disable for users, too: by default 'user' is allowed to edit, even if '*' is not.</translate>
$wgGroupPermissions['user']['edit'] = false;

# <translate nowrap><!--T:24--> Make it so users with confirmed email addresses are in the group.</translate>
$wgAutopromote['emailconfirmed'] = APCOND_EMAILCONFIRMED;
# <translate nowrap><!--T:25--> Hide group from user list.</translate>
$wgImplicitGroups[] = 'emailconfirmed';
# <translate nowrap><!--T:26--> Finally, set it to true for the desired group.</translate>
$wgGroupPermissions['emailconfirmed']['edit'] = true;
</syntaxhighlight>

<translate>
== Creating a new group and assigning permissions to it == <!--T:27-->
</translate>
<translate><!--T:275--> A custom group can be created by simply assigning rights to it via [  ]</code></tvar>|''group-name''}} where ''group-name'' is the actual name of the group.</translate>
<translate><!--T:167--> From MW 1.12, you can create your own groups into which users are automatically promoted (as with <tvar name=1><code>autoconfirmed</code></tvar>) using <tvar name=AutoPromote></tvar>.</translate>

<translate>
<!--T:29-->
In addition to assigning permissions, you should create these three wiki pages with suitable content (see also the examples below):
</translate>

*  <translate><!--T:30--> (content: <code>Name of the group</code>)</translate>
*  <translate><!--T:31--> (content: <code>Name of a member of the group</code>)</translate>
*  <translate><!--T:32--> (content: <code>Name of the group page</code>)</translate>

<translate><!--T:33--> By default, bureaucrats can add users to, or remove them from, any group.</translate>
<translate><!--T:34--> However, if you are using <tvar name=1></tvar> and <tvar name=2></tvar>, you may need to customize those instead.</translate>

<translate>
=== Examples === <!--T:35-->

<!--T:36-->
This example will create an arbitrary <tvar name=1><code>projectmember</code></tvar> group that can block users and delete pages, and whose edits are hidden by default in the recent changes log:
</translate>

<syntaxhighlight lang="php" copy>
$wgGroupPermissions['projectmember']['bot'] = true;
$wgGroupPermissions['projectmember']['block'] = true;
$wgGroupPermissions['projectmember']['delete'] = true;
</syntaxhighlight>

</code></tvar> or <tvar name=2><code></code></tvar> instead of <tvar name=3><code></code></tvar>.</translate> <translate><!--T:230--> Moreover it is recommended to only use lowercase letters to create a group.</translate>}}

<translate>
<!--T:38-->
In this example, you would probably also want to create these pages:
</translate>

*  <translate><!--T:39--> (content: <code>Project members</code>)</translate>
*  <translate><!--T:40--> (content: <code>Project member</code>)</translate>
*  <translate><!--T:41--> (content: <code>Project:Project Members</code>)</translate>

<translate>
<!--T:42-->
This will ensure that the group will be referred to as "Project members" throughout the interface, a member will be referred to as a "Project member", and overviews will link the group name to .
</translate>

<translate><!--T:43--> This example disables write access (page editing and creation) by default, creates a group named <tvar name=1><code>writer</code></tvar>, and grants it write access.</translate>
<translate><!--T:274--> Users can be manually added to this group via <tvar name=UserRights>[[Special:UserRights]]</tvar>:</translate>

<syntaxhighlight lang="php" copy>
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['createpage'] = false;
$wgGroupPermissions['user']['edit'] = false;
$wgGroupPermissions['user']['createpage'] = false;
$wgGroupPermissions['writer']['edit'] = true;
$wgGroupPermissions['writer']['createpage'] = true;
</syntaxhighlight>

<translate>
<!--T:44-->
In this example, you would probably also want to create these pages:
</translate>

*  <translate><!--T:45--> (content: <code>Writers</code>)</translate>
*  <translate><!--T:46--> (content: <code>Writer</code>)</translate>
*  <translate><!--T:47--> (content: <code>Project:Write</code>)</translate>

<translate>
== List of permissions == <!--T:56-->
</translate>
<translate><!--T:57--> The following user rights are available in the latest version of MediaWiki.</translate>
<translate><!--T:58--> If you are using an older version, look at <tvar name=1>[[Special:Version]]</tvar> on your wiki and see if your version is covered in the "Versions" column.</translate>

{| class="wikitable sortable"
|-
! | <translate><!--T:59--> Right</translate>
! | <translate><!--T:60--> Description</translate>
! | <translate><!--T:208--> User groups that have this right by default</translate>
! | <translate><!--T:61--> Versions</translate>
|-style="text-align:center"
| colspan="4"|''''''
|- 
|style="vertical-align:top"|read
| – <translate><!--T:63--> when set to <tvar name=1></tvar>, override for specific pages with <tvar name=WhitelistRead></tvar></translate>
----

| *, user
| [[rev:9367|1.5+]]
|-style="text-align:center"
| colspan="4"|''''''
|-
|applychangetags
| – <translate><!--T:263--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|user
|1.25+
|-
|autocreateaccount
| - <translate><!--T:210--> a more limited version of <tvar name=1><code>createaccount</code></tvar></translate>
|—
|1.27+
|-
|createaccount
| – <translate><!--T:278--> register / registration</translate>
|*, sysop
|[[rev:9367|1.5+]]
|-
|createpage
| – <translate><!--T:66--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|*, user
|[[rev:11973|1.6+]]
|-
|createpreviouslyrenamedaccount
| – requires the <code>createaccount</code> right
|sysop
|[[gerrit:1271055|1.47+]]
|-
|createtalk
| – <translate><!--T:67--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|*, user
|[[rev:11973|1.6+]]
|-
|createwithcontentmodel
| – requires the <code>createpage</code> right
|user
|[[gerrit:1222750|1.46+]]
|-
|delete-redirect
| <translate><!--T:258--> (note that this is not needed if the group already has the <tvar name=1><code>delete</code></tvar> right)</translate>
|—
|[[gerrit:559622|1.36+]]
|-
|edit
| – <translate><!--T:279--> requires the <tvar name=1><code>read</code></tvar> right</translate>
|*, user
|[[rev:9632|1.5+]]
|-
|editsemiprotected
| – <translate><!--T:79--> without cascading protection</translate> – <translate><!--T:280--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|autoconfirmed, bot, sysop
|1.22+
|-
|editprotected
| – <translate><!--T:78--> without cascading protection</translate> – <translate><!--T:281--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|sysop
|[[rev:32164|1.13+]]
|-
|minoredit
| – <translate><!--T:264--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|user
|[[rev:12359|1.6+]]
|-
|move
| – <translate><!--T:68--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|user, sysop
|[[rev:9367|1.5+]]
|-
|move-categorypages
| – <translate><!--T:209--> requires the <tvar name=1><code>move</code></tvar> right</translate>
|user, sysop
|[[gerrit:111096|1.25+]]
|-
|move-rootuserpages
| – <translate><!--T:71--> requires the <tvar name=1><code>move</code></tvar> right</translate>
|user, sysop
|[[rev:41961|1.14+]]
|-
|move-subpages
| – <translate><!--T:70--> requires the <tvar name=1><code>move</code></tvar> right</translate>
|user, sysop
|[[rev:35213|1.13+]]
|-
|movefile
| – <translate><!--T:69--> requires the <tvar name=1><code>move</code></tvar> right as well</translate>
|user, sysop
|[[rev:45276|1.14+]]
|-
|reupload
| – <translate><!--T:74--> requires the <tvar name=1><code>upload</code></tvar> right</translate>
|user, sysop
|[[rev:10906|1.6+]]
|-
|reupload-own
| – <translate><!--T:75--> requires the <tvar name=1><code>upload</code></tvar> right (note that this is not needed if the group already has the <tvar name=reupload><code>reupload</code></tvar> right)</translate>
|—
|[[rev:21943|1.11+]]
|-
|reupload-shared
| – <translate><!--T:76--> (if one is set up) with local files</translate> <translate><!--T:211--> (requires the <tvar name=1><code>upload</code></tvar> right)</translate>
|user, sysop
|[[rev:10906|1.6+]]
|-
|sendemail
|
|user
|[[rev:56962|1.16+]]
|-
|upload
| – <translate><!--T:73--> requires the <tvar name=1><code>edit</code></tvar> right and <tvar name=2></tvar> to be <tvar name=3></tvar></translate>
|user, sysop
|[[rev:9499|1.5+]]
|-
|upload_by_url
| – <translate><!--T:77--> requires the <tvar name=1><code>upload</code></tvar> right</translate> <translate><!--T:218--> (Prior to 1.20 it was given to sysops)</translate>
|—
|[[rev:16162|1.8+]]
|-style="text-align:center"
| colspan="4"|''''''
|-
|autopatrol
| <translate><!--T:282--> Modifies certain actions performed by the permission holder, automatically marking them as </translate> – <translate><!--T:283--> Depends on <tvar name=1>|UseRCPatrol|UseNPPatrol|UseFilePatrol}}</tvar></translate>
|bot, sysop
|[[rev:18496|1.9+]]
|-
|bigdelete
| (<translate><!--T:226--> as determined by <tvar name=1></tvar></translate>) – <translate><!--T:235--> requires the <tvar name=1><code>delete</code></tvar> right</translate>
|sysop
|[[rev:29872|1.12+]]
|-
|block
| – <translate><!--T:92--> Block options include preventing editing and registering new accounts, and autoblocking other users on the same IP address</translate>
|sysop
|[[rev:9367|1.5+]]
|-
|blockemail
| – <translate><!--T:93--> allows preventing use of the <tvar name=1>[[Special:Emailuser]]</tvar> interface when blocking</translate> – <translate><!--T:284--> requires the <tvar name=1><code>block</code></tvar> right</translate>
|sysop
|[[rev:22827|1.11+]]
|-
|browsearchive
| – <translate><!--T:89--> through <tvar name=1>[[Special:Undelete]]</tvar></translate> – <translate><!--T:236--> requires the <tvar name=1><code>deletedhistory</code></tvar> right</translate>
|sysop
|[[rev:32456|1.13+]]
|-
|changetags
| – <translate><!--T:104--> currently unused by extensions</translate>
|user
|1.25+
|-
|delete
|<br /><translate><!--T:82--> allows the deletion or undeletion of pages</translate><br /><translate><!--T:83--> allows the deletion of pages</translate> <translate><!--T:84--> (for undeletions, there is now the <tvar name=1><code>undelete</code></tvar> right, see below)</translate>
|sysop
|[[rev:9367|1.5+]]
|-
|deletedhistory
|
|sysop
|[[rev:12241|1.6+]]
|-
|deletedtext
| – <translate><!--T:291--> requires the <tvar name=1><code>deletedhistory</code></tvar> right</translate>
|sysop
|1.16+
|-
|deletelogentry
| – <translate><!--T:121--> allows deleting/undeleting information (action text, summary, user who made the action) of specific log entries – requires the <tvar name=1><code>deleterevision</code></tvar> right</translate>
|suppress
|[[gerrit:12889|1.20+]]
|-
|deleterevision
| – <translate><!--T:122--> allows deleting/undeleting information (revision text, edit summary, user who made the edit) of specific revisions</translate> (<translate><!--T:123--> Split into <tvar name=1><code>deleterevision</code></tvar> and <tvar name=2><code>deletelogentry</code></tvar> in 1.20</translate>)
|suppress
|[[rev:13224|1.6+]]
|-
|editcontentmodel
| – <translate><!--T:237--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|user
|[[gerrit:176201|1.23.7+]]
|-
|editinterface
| – <translate><!--T:106--> contains [[<tvar name=man>Special:MyLanguage/Manual:Interface</tvar>|interface messages]].</translate> <translate><!--T:221--> For editing sitewide CSS/JSON/JS, there are now segregate rights, see below.</translate> – <translate><!--T:238--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|sysop, interface-admin
|[[rev:9367|1.5+]]
|-
|editmyoptions
|
|*
|[[gerrit:67876|1.22+]]
|-
|editmyprivateinfo
| – <translate><!--T:262--> also hides the "Change Password", but not other ways to change the password</translate> – <translate><!--T:265--> requires the <tvar name=1><code>viewmyprivateinfo</code></tvar> right</translate>
|*
|[[gerrit:67876|1.22+]]
|-
|editmyusercss
| – <translate><!--T:222--> prior to 1.31 it was assigned to everyone (i.e. <tvar name=1><code>*</code></tvar>) (note that this is not needed if the group already has the <tvar name=editusercss><code>editusercss</code></tvar> right)</translate> – <translate><!--T:239--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|user
|[[gerrit:67874|1.22+]]
|-
|editmyuserjs
| – <translate><!--T:223--> prior to 1.31 it was assigned to everyone (i.e. <tvar name=1><code>*</code></tvar>) (note that this is not needed if the group already has the <tvar name=edituserjs><code>edituserjs</code></tvar> right)</translate> – <translate><!--T:240--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|user
|[[gerrit:67874|1.22+]]
|-
|editmyuserjsredirect
| <translate><!--T:259--> (note that this is not needed if the group already has the <tvar name=edituserjs><code>edituserjs</code></tvar> right)</translate> – <translate><!--T:260--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|—
|[[gerrit:502667|1.34+]]
|-
|editmyuserjson
| <translate><!--T:224--> (note that this is not needed if the group already has the <tvar name=edituserjson><code>edituserjson</code></tvar> right)</translate> – <translate><!--T:241--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|user
|[[gerrit:408940|1.31+]]
|-
|editmywatchlist
| – <translate><!--T:266--> requires the <tvar name=1><code>viewmywatchlist</code></tvar> right</translate>
|user
|[[gerrit:67875|1.22+]]
|-
|editsitecss
| – <translate><!--T:242--> requires the <tvar name=1><code>editinterface</code></tvar> right</translate>
|interface-admin
|[[gerrit:421121|1.32+]]
|-
|editsitejs
| – <translate><!--T:243--> requires the <tvar name=1><code>editinterface</code></tvar> right</translate>
|interface-admin
|[[gerrit:421121|1.32+]]
|-
|editsitejson
| – <translate><!--T:244--> requires the <tvar name=1><code>editinterface</code></tvar> right</translate>
|sysop, interface-admin
|[[gerrit:421121|1.32+]]
|-
|editusercss
| – <translate><!--T:245--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|interface-admin
|[[rev:54153|1.16+]]
|-
|edituserjs
| – <translate><!--T:246--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|interface-admin
|[[rev:54153|1.16+]]
|-
|edituserjson
| – <translate><!--T:247--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|sysop, interface-admin
|[[gerrit:408940|1.31+]]
|-
|hideuser
| – <translate><!--T:212--> Only users with 1000 edits or less can be suppressed by default</translate> – <translate><!--T:261--> requires the <tvar name=1><code>block</code></tvar> right</translate>
<translate><!--T:213--> Use <tvar name=HideUserContribLimit></tvar> to disable.</translate>
|suppress
|[[rev:20446|1.10+]]
|-
|ignore-restricted-groups
| – <translate><!--T:277--> Only applies to groups the user would be otherwise able to change, based on <tvar name=1><code>userrights</code></tvar> right and the contents of <tvar name=2></tvar>.</translate>
|—
|[[gerrit:1200077|1.46+]]
|-
|markbotedits
| – <translate><!--T:101--> see <tvar name=1></tvar></translate> – <translate><!--T:248--> requires the <tvar name=1><code>rollback</code></tvar> right</translate>
|sysop
|[[rev:27658|1.12+]]
|-
|mergehistory
| – <translate><!--T:249--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|sysop
|[[rev:27823|1.12+]]
|-
|pagelang
| – <translate><!--T:214--> <tvar name=1></tvar> must be <tvar name=2></tvar></translate>
|—
|[[gerrit:135312|1.24+]]
|-
|patrol
| <translate><!--T:276--> Mark certain actions as </translate> – <translate><!--T:285--> depends on <tvar name=1>|UseRCPatrol|UseNPPatrol|UseFilePatrol}}</tvar></translate>
|sysop
|[[rev:9367|1.5+]]
|-
|patrolmarks
| (<translate><!--T:286--> note that this is not needed if the group already has the <tvar name=1><code>patrol</code></tvar> right</translate>)
|—
|[[rev:54153|1.16+]]
|-
|protect
| – <translate><!--T:250--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|sysop
|[[rev:9367|1.5+]]
|-
|rollback
|[[Special:MyLanguage/Manual:Rollback|MyLanguage/Manual:Rollback]] – <translate><!--T:251--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|sysop
|[[rev:9367|1.5+]]
|-
|suppressionlog
|
|suppress
|[[rev:13224|1.6+]]
|-
|suppressrevision
| – '''<translate><!--T:119--> Prior to <tvar name=1>[[rev:35303|1.13]]</tvar> this right was named <tvar name=2><code>hiderevision</code></tvar></translate>''' – <translate><!--T:252--> requires the <tvar name=1><code>deleterevision</code></tvar> right</translate>
|suppress
|[[rev:13224|1.6+]]
|-
|unblockself
| – <translate><!--T:96--> Without it, an administrator that has the capability to block cannot unblock themselves if blocked by another administrator</translate>
|sysop
|[[rev:64228|1.17+]]
|-
|undelete
| – <translate><!--T:253--> requires the <tvar name=1><code>deletedhistory</code></tvar> right</translate>
|sysop
|[[rev:28151|1.12+]]
|-
|userrights
| – <translate><!--T:97--> allows the assignment or removal of all(*) groups to any user.</translate><br />
<small><translate><!--T:98--> (*)With <tvar name=AddGroups></tvar> and <tvar name=RemoveGroups></tvar> you can set the possibility to add/remove certain groups instead of all</translate></small>
|bureaucrat
|[[rev:9367|1.5+]]
|-
|userrights-interwiki
| – <translate><!--T:287--> requires the <tvar name=1><code>userrights</code></tvar> right</translate>
|—
|[[rev:28650|1.12+]]
|-
|viewmyprivateinfo
|
|*
|[[gerrit:67876|1.22+]]
|-
|viewmywatchlist
|
|user
|[[gerrit:67875|1.22+]]
|-
|viewsuppressed
| – <translate><!--T:120--> i.e. a more narrow alternative to <tvar name=1><code>suppressrevision</code></tvar> (note that this is not needed if the group already has the <tvar name=2><code>suppressrevision</code></tvar> right)</translate>
|suppress
|[[gerrit:139277|1.24+]]
|-style="text-align:center"
| colspan="4"|''''''
|-
|deletechangetags
| – <translate><!--T:132--> currently unused by extensions</translate>
|sysop
|[[gerrit:286282|1.28+]]
|-
|import
| – <translate><!--T:126--> "transwiki"</translate> – <translate><!--T:254--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|sysop
|[[rev:9498|1.5+]]
|-
|importupload
| – <translate><!--T:128--> This right was called <tvar name=1><code>importraw</code></tvar> in and before version 1.5</translate> – <translate><!--T:255--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|sysop
|[[rev:9499|1.5+]]
|-
|managechangetags
| – <translate><!--T:225--> currently unused by extensions</translate>
|sysop
|1.25+
|-
|renameuser
| (<translate><!--T:288--> formerly was part of the Renameuser extension</translate>)
|bureaucrat
|1.40+
|-
|siteadmin
| – <translate><!--T:124--> which blocks all interactions with the web site except viewing.</translate> (''<translate><!--T:219--> not available by default</translate>'')
|—
|[[rev:9367|1.5+]]
|-
|unwatchedpages
| – <translate><!--T:131--> lists pages that no user has watchlisted</translate>
|sysop
|[[rev:12196|1.6+]]
|-style="text-align:center"
| colspan="4"|''''''
|-
|apihighlimits
|
|bot, sysop
|[[rev:27949|1.12+]]
|-
|autoconfirmed
| – <translate><!--T:145--> used for the <tvar name=1><code>autoconfirmed</code></tvar> group; see the other table below for more information</translate> <translate><!--T:289--> (note that this is not needed if the group already has the <tvar name=2><code>noratelimit</code></tvar> right)</translate>
|autoconfirmed, bot, sysop
|[[rev:12207|1.6+]]
|-
|bot
| – <translate><!--T:290--> edits and logged actions are hidden from recent changes, can optionally be viewed</translate>
|bot
|[[rev:9367|1.5+]]
|-
|ipblock-exempt
|
|sysop
|[[rev:18904|1.9+]]
|-
|nominornewtalk 
| – <translate><!--T:137--> requires the <tvar name=1><code>minoredit</code></tvar> right</translate>
|bot
|[[rev:17281|1.9+]]
|-
|noratelimit
| – <translate><!--T:138--> not affected by [[<tvar name=1>Special:MyLanguage/Manual:$wgRateLimits</tvar>|rate limits]] (''prior to the introduction of this right, the configuration variable <tvar name=RateLimitsExcludedGroups></tvar> was used for this purpose'')</translate>
|sysop, bureaucrat
|[[rev:35908|1.13+]]
|-
|override-export-depth
|<br /><small><translate><!--T:234--> With this right, you can define the depth of linked pages at <tvar name=link1>[[Special:Export]]</tvar>. Otherwise, the value of <tvar name=link2></tvar>, which is 0 by default, will be used.</translate></small>
|—
|1.15+
|-
|suppressredirect
| – <translate><!--T:256--> requires the <tvar name=1><code>move</code></tvar> right</translate>
|bot, sysop
|[[rev:27774|1.12+]]
|}
{{Note|1=<translate><!--T:149--> Although these permissions all control separate things, sometimes to perform certain actions you need multiple permissions.</translate> <translate><!--T:150--> For example allowing people to edit but not read pages doesn't make sense, since in order to edit a page you must first be able to read it (Assuming no pages are allowlisted).</translate> <translate><!--T:151--> Allowing uploads but not editing does not make sense, since in order to upload an image you must implicitly create an image description page, etc.</translate>}}

<translate>
== Predefined groups == <!--T:152-->
</translate>
<translate><!--T:153--> The following groups are available in the latest version of MediaWiki.</translate>
<translate><!--T:154--> If you are using an older version then some of these may not be implemented.</translate>

{|class="wikitable"
|-
! | <translate><!--T:155--> Group</translate>
! | <translate><!--T:156--> Description</translate>
! | <translate><!--T:215--> Default rights</translate>
! | <translate><!--T:157--> Versions</translate>
|-
| *
| <translate><!--T:158--> All users (including anonymous).</translate>
|createaccount, createpage, createtalk, edit, editmyoptions, editmyprivateinfo, read, viewmyprivateinfo
|[[rev:9367|1.5+]]
|-
|temp
| <translate><!--T:271--> Temporary user accounts (<tvar name=1>[[phab:T330816|T330816]]</tvar>)</translate>
| <translate><!--T:272--> Similar to <tvar name=1><code>*</code></tvar> group</translate>
|1.41+
|-
|user
| <translate><!--T:159--> Registered accounts.</translate> <translate><!--T:273--> Does ''not'' include temporary accounts.</translate>
|applychangetags, changetags, createpage, createtalk, createwithcontentmodel, edit, editcontentmodel, editmyusercss, editmyuserjs, editmyuserjson, editmywatchlist, minoredit, move, move-categorypages, move-rootuserpages, move-subpages, movefile, purge, read, reupload, reupload-shared, sendemail, upload, viewmywatchlist
|1.13+
|-
|autoconfirmed
| <translate><!--T:160--> Registered accounts at least as old as <tvar name=AutoConfirmAge></tvar> and having at least as many edits as <tvar name=AutoConfirmCount></tvar>.</translate>
|autoconfirmed, editsemiprotected
|[[rev:12207|1.6+]]
|-
|bot
| <translate><!--T:163--> Accounts with the ''bot'' right (intended for automated scripts).</translate>
|autoconfirmed, autopatrol, apihighlimits, bot, editsemiprotected, nominornewtalk, suppressredirect
|[[rev:9367|1.5+]]
|-
|sysop
| <translate><!--T:164--> Users who by default can delete and restore pages, block and unblock users, etc.</translate>
|apihighlimits, autoconfirmed, autopatrol, bigdelete, block, blockemail, browsearchive, createaccount, createpreviouslyrenamedaccount, delete, deletedhistory, deletedtext, editinterface, editprotected, editsemiprotected, editsitejson, edituserjson, import, importupload, ipblock-exempt, managechangetags, markbotedits, mergehistory, move, move-categorypages, move-rootuserpages, move-subpages, movefile, noratelimit, patrol, protect, reupload, reupload-shared, rollback, suppressredirect, unblockself, undelete, unwatchedpages, upload
|[[rev:9367|1.5+]]
|-
|interface-admin
| <translate><!--T:220--> Users who can edit sitewide CSS and JavaScript.</translate>
|editinterface, editsitecss, editsitejs, editsitejson, editusercss, edituserjs, edituserjson
|1.32+
|-
|bureaucrat
| <translate><!--T:165--> Users who can change the rights of other users by default and therefore have full access of the entire wiki.</translate>
|noratelimit, renameuser, userrights
|[[rev:9367|1.5+]]
|-
|suppress
|
|deletelogentry, deleterevision, hideuser, suppressionlog, suppressrevision, viewsuppressed
|1.13+
|}

<translate>
=== Removing predefined groups === <!--T:48-->
</translate>
<translate><!--T:49--> MediaWiki out of the box comes with a number of predefined groups.</translate>
<translate><!--T:50--> Most of these groups can be removed by unsetting the according array keys, among them [  ]</span></tvar>|''group-name''}}.</translate>
<translate><!--T:51--> For details, see below.</translate>

<translate>
==== Example ==== <!--T:52-->
</translate>
<translate><!--T:53--> This example will eliminate the <tvar name=1><code>bureaucrat</code></tvar> group entirely.</translate>
<translate><!--T:54--> It is necessary to ensure that all six of these variables are unset for any group that one wishes to remove from being listed at <tvar name=List>[[Special:ListGroupRights]]</tvar>; however, merely unsetting <tvar name=1><code>$wgGroupPermissions</code></tvar> will suffice to remove it from <tvar name=UserRights>[[Special:UserRights]]</tvar>.</translate>

<syntaxhighlight lang="php" copy>
unset( $wgGroupPermissions['bureaucrat'] );
unset( $wgRevokePermissions['bureaucrat'] );
unset( $wgAddGroups['bureaucrat'] );
unset( $wgRemoveGroups['bureaucrat'] );
unset( $wgGroupsAddToSelf['bureaucrat'] );
unset( $wgGroupsRemoveFromSelf['bureaucrat'] );
</syntaxhighlight>

<translate><!--T:267--> This code will not work if any extension that modifies the default rights for the <tvar name=2><code>bureaucrat</code></tvar> group, such as <tvar name=1></tvar>, is installed.</translate>



<translate><!--T:268--> More broadly, to disable a user group created by an extension, the above code needs to run after all extensions have been registered.</translate>
<translate><!--T:269--> This used to be possible by registering an extension function in <tvar name=1><code>LocalSettings.php</code></tvar>:</translate>

<syntaxhighlight lang="php" copy>
$wgExtensionFunctions[] = function() use ( &$wgGroupPermissions ) {
    unset( $wgGroupPermissions['oversight'] );
    unset( $wgGroupPermissions['flow-bot'] );
};
</syntaxhighlight>

<translate>
<!--T:270-->
However, this '''no longer works reliably''' due to <tvar name=1>[[phab:T275334|T275334]]</tvar>.</translate>

{{Note|type=warn|1=
'''<translate><!--T:202--> Note on the group called <tvar name=1><code>user</code></tvar></translate>'''

<translate><!--T:203--> With the above mechanism, you can remove the groups <tvar name=2></tvar>, which - if used - can be assigned through the usual [[<tvar name=1>Special:MyLanguage/Help:User rights and groups</tvar>|user permission system]].</translate>
<translate><!--T:204--> However, it is currently impossible to remove the <tvar name=1><code>user</code></tvar> group.</translate>
<translate><!--T:205--> This group is ''not'' assigned through the usual permission system.</translate>
<translate><!--T:206--> Instead, every registered user automatically is a member of that group.</translate>
<translate><!--T:207--> This is hardcoded in MediaWiki and currently cannot be changed easily.</translate>
}}

<translate>
== Default rights == <!--T:169-->

<!--T:170-->
The default rights are defined in <tvar name=1></tvar>.
</translate>

* {{git file|project=mediawiki/core|branch=HEAD|file=includes/MainConfigSchema.php|text=<translate><!--T:171--> Default values in the current alpha version (HEAD, version <tvar name=1></tvar>)</translate>}}
* |file=includes/MainConfigSchema.php|text=<translate><!--T:172--> Default values in the latest stable version (branch <tvar name=1></tvar>, version <tvar name=2></tvar>)</translate>}}
<translate>
<!--T:173-->
* Additional rights: you should be able to list all the permissions available on your wiki by running <tvar name=1></tvar>.

=== Adding new rights === <!--T:175-->
</translate>
''<translate><!--T:176--> Information for coders only follows.</translate>''

<translate><!--T:177--> If you're adding a new right in core, for instance to [[<tvar name=2>Special:MyLanguage/Manual:Special pages</tvar>|control a new special page]], you are ''required'' to add it to the list of available rights in <tvar name=User></tvar>, <tvar name=1></tvar> ([<tvar name=url>https://gerrit.wikimedia.org/r/c/mediawiki/core/+/559622/9/includes/Permissions/PermissionManager.php</tvar> example]).</translate>
<translate><!--T:178--> If you're , you instead need to use <tvar name=2></tvar>, or preferably define the right in <tvar name=3></tvar>.</translate>

<translate>
<!--T:179-->
You probably also want to assign it to some user group by editing <tvar name=GroupPermissions></tvar> described above.

<!--T:217-->
If you want this right to be accessible to external applications by <tvar name=OAuth></tvar> or by [[<tvar name=1>Special:MyLanguage/Manual:Bot passwords</tvar>|bot passwords]], then you will need to add it to a grant by editing <tvar name=GrantPermissions></tvar>.
</translate>

<syntaxhighlight lang="php" copy>
// <translate nowrap><!--T:231--> create projectmember-powers right</translate>
$wgAvailableRights[] = 'projectmember-powers';

// <translate nowrap><!--T:232--> add projectmember-powers to the projectmember-group</translate>
$wgGroupPermissions['projectmember']['projectmember-powers'] = true;

// <translate nowrap><!--T:233--> add projectmember-powers to the 'basic' grant so we can use our projectmember powers over an API request</translate>
$wgGrantPermissions['basic']['projectmember-powers'] = true;
</syntaxhighlight>

<translate><!--T:180--> You also need to add  and  interface messages to <tvar name=3>languages/i18n/en.json</tvar> (with documentation in <tvar name=4>qqq.json</tvar>).</translate>
<translate><!--T:181--> The <tvar name=1><code>right-*</code></tvar> messages can be seen on <tvar name=2>[[Special:ListGroupRights]]</tvar> and the <tvar name=3><code>action-*</code></tvar> messages are used in a sentence like "You do not have permission to ...".</translate>

<translate>

== See also == <!--T:182-->
</translate>
* [[Special:ListGroupRights]] – <translate><!--T:197--> Links to this help page and might contain not yet documented rights</translate>
*  – <translate><!--T:198--> Help page describing use of the <tvar name=1>Special:Userrights</tvar> interface (for bureaucrats)</translate>
*  – <translate><!--T:199--> Information about managing and the assignment of user groups.</translate>
* 
* 
* |AddGroups|RemoveGroups}}
*  – <translate><!--T:200--> Examples</translate>
* 
*  – <translate><!--T:201--> Many extensions relating to user rights</translate>



[[Category:Special Pages]]
[[Category:Permission]]

----
''Sample content adapted from [[mediawikiwiki:Manual:User_rights]] on mediawiki.org, licensed under [https://creativecommons.org/licenses/by-sa/4.0/ CC BY-SA 4.0].''