View source for Manual:User rights

<languages/>
<translate><!--T:1--> '''User rights''' are permissions (like the ability to edit pages or to block users) that can be assigned to different '''user groups'''.</translate>
<translate><!--T:227--> MediaWiki ships with a default set of user rights and user groups, but these can be customized.</translate>
<translate><!--T:228--> This page explains the default rights and groups and how to customize them.</translate>

<translate>
<!--T:229-->
For information about how to add and remove individual wiki users from groups, see <tvar name=1>{{ll|Help:User rights and groups}}</tvar> and <tvar name=2>{{ll|Manual:Setting user groups in MediaWiki}}</tvar>.

== Changing group permissions == <!--T:7-->
</translate>
<translate><!--T:8--> A default MediaWiki installation assigns certain rights to default groups (see below).</translate>
<translate><!--T:9--> You can change the default rights by editing the <tvar name=1>{{ll|Manual:$wgGroupPermissions|$wgGroupPermissions}}</tvar> array in <tvar name=2>{{ll|Manual:LocalSettings.php|LocalSettings.php}}</tvar> with the syntax.</translate>

<syntaxhighlight lang="php">
$wgGroupPermissions['group']['right'] = true /* <translate nowrap><!--T:10--> or false</translate> */;
</syntaxhighlight>
{{Note|1=<translate><!--T:11--> In a default installation <tvar name=1>{{phpi|$wgGroupPermissions}}</tvar> will be set in <tvar name=2><code>includes/DefaultSettings.php</code></tvar>, but it is ''not'' present in <tvar name=3><code>LocalSettings.php</code></tvar>.</translate> <translate><!--T:12--> You will then need to add it in that file.</translate>}}

<translate><!--T:13--> If a member has multiple groups, they get all the permissions from each of the groups they are in.</translate>
<translate><!--T:14--> All users, including anonymous users, are in the <tvar name=1><code>'*'</code></tvar> group; all registered users are in the <tvar name=2><code>'user'</code></tvar> group.</translate>
<translate><!--T:15--> In addition to the default groups, you can arbitrarily create new groups using the same array.</translate>

<translate>
=== Examples === <!--T:16-->

<!--T:17-->
This example will disable viewing of all pages not listed in <tvar name=1>{{ll|Manual:$wgWhitelistRead|$wgWhitelistRead}}</tvar>, then re-enable for registered users only:
</translate>

<syntaxhighlight lang="php">
$wgGroupPermissions['*']['read'] = false;
# <translate nowrap><!--T:18--> The following line is not actually necessary, since it's in the defaults. Setting '*' to false doesn't disable rights for groups that have the right separately set to true!</translate>
$wgGroupPermissions['user']['read'] = true;
</syntaxhighlight>

<translate>
<!--T:21-->
This example will disable editing of all pages, then re-enable for users with [[<tvar name=1>Special:MyLanguage/Manual:$wgEmailAuthentication</tvar>|confirmed email addresses]] only:
</translate>

<syntaxhighlight lang="php">
# <translate nowrap><!--T:22--> Disable for everyone.</translate>
$wgGroupPermissions['*']['edit'] = false;
# <translate nowrap><!--T:23--> Disable for users, too: by default 'user' is allowed to edit, even if '*' is not.</translate>
$wgGroupPermissions['user']['edit'] = false;
# <translate nowrap><!--T:24--> Make it so users with confirmed email addresses are in the group.</translate>
$wgAutopromote['emailconfirmed'] = APCOND_EMAILCONFIRMED;
# <translate nowrap><!--T:25--> Hide group from user list.</translate>
$wgImplicitGroups[] = 'emailconfirmed';
# <translate nowrap><!--T:26--> Finally, set it to true for the desired group.</translate>
$wgGroupPermissions['emailconfirmed']['edit'] = true;
</syntaxhighlight>

<translate>
== Creating a new group and assigning permissions to it == <!--T:27-->

<!--T:28-->
You can create new user groups by defining permissions for the according group name in {{<tvar name=1>tmpl|0=<code class="mw-highlight">{{#tag:span|$wgGroupPermissions|class=nv}}[ {{#tag:span|'<nowiki/>$1'|class=s1}} ]</code></tvar>|''group-name''}} where ''group-name'' is the actual name of the group.

<!--T:29-->
Additionally to assigning permissions, you should create these three wiki pages with fitting content:
</translate>

* {{blue|MediaWiki:Group-&lt;group-name>}} <translate><!--T:30--> (content: <code>Name of the group</code>)</translate>
* {{blue|MediaWiki:Group-&lt;group-name>-member}} <translate><!--T:31--> (content: <code>Name of a member of the group</code>)</translate>
* {{blue|MediaWiki:Grouppage-&lt;group-name>}} <translate><!--T:32--> (content: <code>Name of the group page</code>)</translate>

<translate><!--T:33--> By default, bureaucrats can add users to, or remove them from, any group.</translate>
<translate><!--T:34--> However, if you are using <tvar name=1>{{ll|Manual:$wgAddGroups}}</tvar> and <tvar name=2>{{ll|Manual:$wgRemoveGroups}}</tvar>, you may need to customize those instead.</translate>

<translate>
=== Examples === <!--T:35-->

<!--T:36-->
This example will create an arbitrary "projectmember" group that can block users and delete pages, and whose edits are hidden by default in the recent changes log:
</translate>

<syntaxhighlight lang="php">
$wgGroupPermissions['projectmember']['bot'] = true;
$wgGroupPermissions['projectmember']['block'] = true;
$wgGroupPermissions['projectmember']['delete'] = true;
</syntaxhighlight>

{{note|1=<translate><!--T:37--> The group name cannot contain spaces, so use <tvar name=1><code>'random-group'</code></tvar> or <tvar name=2><code>'random_group'</code></tvar> instead of <tvar name=3><code>'random group'</code></tvar>.</translate> <translate><!--T:230--> Moreover it is recommended to only use lowercase letters to create a group.</translate> }}

<translate>
<!--T:38-->
In this example, you would probably also want to create these pages:
</translate>

* {{blue|MediaWiki:Group-projectmember}} <translate><!--T:39--> (content: <code>Project members</code>)</translate>
* {{blue|MediaWiki:Group-projectmember-member}} <translate><!--T:40--> (content: <code>Project member</code>)</translate>
* {{blue|MediaWiki:Grouppage-projectmember}} <translate><!--T:41--> (content: <code>Project:Project Members</code>)</translate>

<translate>
<!--T:42-->
This will ensure that the group will be referred to as "Project members" throughout the interface, and a member will be referred to as a "Project member", and overviews will link the group name to {{blue|Project:Project members}}.

<!--T:43-->
This example disables write access (page editing and creation) by default, creates a group named "writer", and grants it write access.  Users can be manually added to this group via <tvar name=UserRights>[[Special:UserRights]]</tvar>:
</translate>

<syntaxhighlight lang="php">
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['createpage'] = false;
$wgGroupPermissions['user']['edit'] = false;
$wgGroupPermissions['user']['createpage'] = false;
$wgGroupPermissions['writer']['edit'] = true;
$wgGroupPermissions['writer']['createpage'] = true;
</syntaxhighlight>

<translate>
<!--T:44-->
In this example, you would probably also want to create these pages:
</translate>

* {{blue|MediaWiki:Group-writer}} <translate><!--T:45--> (content: <code>Writers</code>)</translate>
* {{blue|MediaWiki:Group-writer-member}} <translate><!--T:46--> (content: <code>Writer</code>)</translate>
* {{blue|MediaWiki:Grouppage-writer}} <translate><!--T:47--> (content: <code>Project:Write</code>)</translate>

<translate>
== Removing predefined groups == <!--T:48-->
</translate>
<translate><!--T:49--> MediaWiki out of the box comes with a number of predefined groups.</translate>
<translate><!--T:50--> Most of these groups can be removed by unsetting the according array keys, among them {{<tvar name=1>tmpl|0=<span class="mw-highlight">{{#tag:span|$wgGroupPermissions|class=nv}}[ {{#tag:span|'{{^(}}$1{{)^}}'|class=s1}} ]</span></tvar>|group-name}}.</translate>
<translate><!--T:51--> For details, see below.</translate>

<translate>
=== Example === <!--T:52-->
</translate>
<translate><!--T:53--> This example will eliminate the bureaucrat group entirely.</translate>
<translate><!--T:54--> It is necessary to ensure that all six of these variables are unset for any group that one wishes to remove from being listed at <tvar name=List>[[Special:ListGroupRights]]</tvar>; however, merely unsetting $wgGroupPermissions will suffice to remove it from <tvar name=UserRights>[[Special:UserRights]]</tvar>.</translate>
<translate><!--T:55--> This code should be placed after any <tvar name=1><code>require_once</code></tvar> lines that add extensions, such as <tvar name=2>{{ll|Extension:AntiSpoof}}</tvar> containing code that gives bureaucrats group permissions by default.</translate>

<syntaxhighlight lang="php">
unset( $wgGroupPermissions['bureaucrat'] );
unset( $wgRevokePermissions['bureaucrat'] );
unset( $wgAddGroups['bureaucrat'] );
unset( $wgRemoveGroups['bureaucrat'] );
unset( $wgGroupsAddToSelf['bureaucrat'] );
unset( $wgGroupsRemoveFromSelf['bureaucrat'] );
</syntaxhighlight>

<translate>
<!--T:216-->
In some extensions (Flow, Semantic MediaWiki, etc.), rights are added during extension registration or in a registration function. In this case, it could be necessary to use a registration function in <tvar name=1><code>LocalSettings.php</code></tvar> to remove some predefined user groups:
</translate>

<syntaxhighlight lang="php">
$wgExtensionFunctions[] = function() use ( &$wgGroupPermissions ) {
    unset( $wgGroupPermissions['oversight'] );
    unset( $wgGroupPermissions['flow-bot'] );
};
</syntaxhighlight>

<translate>

=== Note on the group called "user" === <!--T:202-->
</translate>
<translate><!--T:203--> With the above mechanism, you can remove the groups sysop, bureaucrat and bot, which - if used - can be assigned through the usual [[<tvar name=1>Special:MyLanguage/Help:User rights and groups</tvar>|user permission system]].</translate>
<translate><!--T:204--> However, it is currently impossible to remove the <code>user</code> group.</translate>
<translate><!--T:205--> This group is ''not'' assigned through the usual permission system.</translate>
<translate><!--T:206--> Instead, every registered user automatically is a member of that group.</translate>
<translate><!--T:207--> This is hardcoded in MediaWiki and currently cannot be changed easily.</translate>

<translate>
== List of permissions == <!--T:56-->
</translate>
<translate><!--T:57--> The following user rights are available in the latest version of MediaWiki.</translate>
<translate><!--T:58--> If you are using an older version, look at <tvar name=1>[[Special:Version]]</tvar> on your wiki and see if your version is covered in the "Versions" column.</translate>

{| class="wikitable sortable"
|-
!{{hl2}} | <translate><!--T:59--> Right</translate>
!{{hl2}} | <translate><!--T:60--> Description</translate>
!{{hl2}} | <translate><!--T:208--> User groups that have this right by default</translate>
!{{hl2}} | <translate><!--T:61--> Versions</translate>
|-
|{{hl3}} colspan="4" |'''{{visible anchor|1=<translate><!--T:192--> Reading</translate>}}'''
|-
|valign="top"|read
|{{int|right-read}} - <translate><!--T:63--> when set to false, override for specific pages with <tvar name=WhitelistRead>{{ll|Manual:$wgWhitelistRead|$wgWhitelistRead}}</tvar></translate>
----
{{Uploaded-files-access-restriction-info}}
| *, user
| [[rev:9367|1.5+]]
|-
|{{hl3}} colspan="4"|'''{{visible anchor|1=<translate><!--T:193--> Editing</translate>}}'''
|-{{anchor|applychangetags}}
|applychangetags
|{{int|right-applychangetags}} - <translate><!--T:263--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|user
|1.25+
|-{{anchor|autocreateaccount}}
|autocreateaccount
|{{int|right-autocreateaccount}} - <translate><!--T:210--> a more limited version of ''createaccount''</translate>
|—
|1.27+
|-{{anchor|createaccount}}
|createaccount
|{{int|right-createaccount}} - register / registration
|*, sysop
|[[rev:9367|1.5+]]
|-{{anchor|createpage}}
|createpage
|{{int|right-createpage}} - <translate><!--T:66--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|*, user
|[[rev:11973|1.6+]]
|-{{anchor|createtalk}}
|createtalk
|{{int|right-createtalk}} - <translate><!--T:67--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|*, user
|[[rev:11973|1.6+]]
|-{{anchor|delete-redirect}}
|delete-redirect
|{{int|right-delete-redirect}} <translate><!--T:258--> (note that this is not needed if the group already has the <tvar name=1><code>delete</code></tvar> right)</translate>
|—
|[[gerrit:559622|1.36+]]
|-{{anchor|edit}}
|edit
|{{int|right-edit}}
|*, user
|[[rev:9632|1.5+]]
|-{{anchor|editsemiprotected}}
|editsemiprotected
|{{int|right-editsemiprotected}} - <translate><!--T:79--> without cascading protection</translate> - requires the ''edit'' right
|autoconfirmed, bot, sysop
|1.22+
|-{{anchor|editprotected}}
|editprotected
|{{int|right-editprotected}} - <translate><!--T:78--> without cascading protection</translate> - requires the ''edit'' right
|sysop
|[[rev:32164|1.13+]]
|-{{anchor|minoredit}}
|minoredit
|{{int|right-minoredit}} - <translate><!--T:264--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|user
|[[rev:12359|1.6+]]
|-{{anchor|move}}
|move
|{{int|right-move}} - <translate><!--T:68--> requires the <tvar name=1><code>edit</code></tvar> right</translate>
|user, sysop
|[[rev:9367|1.5+]]
|-{{anchor|move-categorypages}}
|move-categorypages
|{{int|right-move-categorypages}} - <translate><!--T:209--> requires the <tvar name=1><code>move</code></tvar> right</translate>
|user, sysop
|[[gerrit:111096|1.25+]]
|-{{anchor|move-rootuserpages}}
|move-rootuserpages
|{{int|right-move-rootuserpages}} - <translate><!--T:71--> requires the <tvar name=1><code>move</code></tvar> right</translate>
|user, sysop
|[[rev:41961|1.14+]]
|-{{anchor|move-subpages}}
|move-subpages
|{{int|right-move-subpages}} - <translate><!--T:70--> requires the <tvar name=1><code>move</code></tvar> right</translate>
|user, sysop
|[[rev:35213|1.13+]]
|-{{anchor|movefile}}
|movefile
|{{int|right-movefile}} - <translate><!--T:69--> requires the <tvar name=1><code>move</code></tvar> right and <tvar name=AllowImageMoving>{{ll|Manual:$wgAllowImageMoving|$wgAllowImageMoving}}</tvar> to be true</translate>
|user, sysop
|[[rev:45276|1.14+]]
|-{{anchor|reupload}}
|reupload
|{{int|right-reupload}} - <translate><!--T:74--> requires the <tvar name=1><code>upload</code></tvar> right</translate>
|user, sysop
|[[rev:10906|1.6+]]
|-{{anchor|reupload-own}}
|reupload-own
|{{int|right-reupload-own}} - <translate><!--T:75--> requires the <tvar name=1><code>upload</code></tvar> right (note that this is not needed if the group already has the <tvar name=reupload>''reupload''</tvar> right)</translate>
|—
|[[rev:21943|1.11+]]
|-{{anchor|reupload-shared}}
|reupload-shared
|{{int|right-reupload-shared}} - <translate><!--T:76--> (if one is set up) with local files</translate> <translate><!--T:211--> (requires the <tvar name=1><code>upload</code></tvar> right)</translate>
|user, sysop
|[[rev:10906|1.6+]]
|-{{anchor|sendemail}}
|sendemail
|{{int|right-sendemail}}
|user
|[[rev:56962|1.16+]]
|-{{anchor|upload}}
|upload
|{{int|right-upload}} - <translate><!--T:73--> requires the <tvar name=1><code>edit</code></tvar> right and <tvar name=EnableUploads>{{ll|Manual:$wgEnableUploads|$wgEnableUploads}}</tvar> to be true</translate>
|user, sysop
|[[rev:9499|1.5+]]
|-{{anchor|upload_by_url}}
|upload_by_url
|{{int|right-upload_by_url}} - <translate><!--T:77--> requires the <tvar name=1><code>upload</code></tvar> right</translate> <translate><!--T:218--> (Prior to 1.20 it was given to sysops)</translate>
|—
|[[rev:16162|1.8+]]
|-
|{{hl3}} colspan="4"|'''{{visible anchor|1=<translate><!--T:194--> Management</translate>}}'''
|-{{anchor|bigdelete}}
|bigdelete
|{{int|right-bigdelete}} (<translate><!--T:226--> as determined by <tvar name=1>{{ll|Manual:$wgDeleteRevisionsLimit|$wgDeleteRevisionsLimit}}</tvar></translate>) - <translate><!--T:235--> requires the ''<tvar name=1>delete</tvar>'' right</translate>
|sysop
|[[rev:29872|1.12+]]
|-{{anchor|block}}
|block
|{{int|right-block}} - <translate><!--T:92--> Block options include preventing editing and registering new accounts, and autoblocking other users on the same IP address</translate>
|sysop
|[[rev:9367|1.5+]]
|-{{anchor|blockemail}}
|blockemail
|{{int|right-blockemail}} - <translate><!--T:93--> allows preventing use of the <tvar name=1>[[Special:Emailuser]]</tvar> interface when blocking - requires the ''block'' right</translate>
|sysop
|[[rev:22827|1.11+]]
|-{{anchor|browsearchive}}
|browsearchive
|{{int|right-browsearchive}} - <translate><!--T:89--> through <tvar name=1>[[Special:Undelete]]</tvar></translate> - <translate><!--T:236--> requires the ''<tvar name=1>deletedhistory</tvar>'' right</translate>
|sysop
|[[rev:32456|1.13+]]
|-{{anchor|changetags}}
|changetags
|{{int|right-changetags}} - <translate><!--T:104--> currently unused by extensions</translate>
|user
|1.25+
|-{{anchor|delete}}
|delete
|{{int|right-delete}} '''1.5–1.11:''' <translate><!--T:82--> allows the deletion or undeletion of pages.</translate><br />'''1.12+:''' <translate><!--T:83--> allows the deletion of pages.</translate> <translate><!--T:84--> For undeletions, there is now the <tvar name=1>'undelete'</tvar> right, see below</translate>
|sysop
|[[rev:9367|1.5+]]
|-{{anchor|deletedhistory}}
|deletedhistory
|{{int|right-deletedhistory}}
|sysop
|[[rev:12241|1.6+]]
|-{{anchor|deletedtext}}
|deletedtext
|{{int|right-deletedtext}}
|sysop
|
|-{{anchor|deletelogentry}}
|deletelogentry
|{{int|right-deletelogentry}} - <translate><!--T:121--> allows deleting/undeleting information (action text, summary, user who made the action) of specific log entries - requires the ''deleterevision'' right</translate>
|suppress
|[[gerrit:12889|1.20+]]
|-{{anchor|deleterevision}}
|deleterevision
|{{int|right-deleterevision}} - <translate><!--T:122--> allows deleting/undeleting information (revision text, edit summary, user who made the edit) of specific revisions</translate> <translate><!--T:123--> '''Split into deleterevision and deletelogentry in 1.20'''</translate>
|suppress
|[[rev:13224|1.6+]]
|-{{anchor|editcontentmodel}}
|editcontentmodel
|{{int|right-editcontentmodel}} - <translate><!--T:237--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|user
|[[gerrit:176201|1.23.7+]]
|-{{anchor|editinterface}}
|editinterface
|{{int|right-editinterface}} - <translate><!--T:106--> contains [[<tvar name=man>Special:MyLanguage/Manual:Interface</tvar>|interface messages]].</translate> <translate><!--T:221--> For editing sitewide CSS/JSON/JS, there are now segregate rights, see below.</translate> - <translate><!--T:238--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|sysop, interface-admin
|[[rev:9367|1.5+]]
|-{{anchor|editmyoptions}}
|editmyoptions
|{{int|right-editmyoptions}}
|*
|[[gerrit:67876|1.22+]]
|-{{anchor|editmyprivateinfo}}
|editmyprivateinfo
|{{int|right-editmyprivateinfo}} - <translate><!--T:262--> also hides the "Change Password", but not other ways to change the password</translate> - <translate><!--T:265--> requires the <tvar name=1><code>viewmyprivateinfo</code></tvar> right</translate>
|*
|[[gerrit:67876|1.22+]]
|-{{anchor|editmyusercss}}
|editmyusercss
|{{int|right-editmyusercss}} - <translate><!--T:222--> prior to 1.31 it was assigned to everyone (i.e. "*") (note that this is not needed if the group already has the <tvar name=editusercss>''editusercss''</tvar> right)</translate> - <translate><!--T:239--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|user
|[[gerrit:67874|1.22+]]
|-{{anchor|editmyuserjs}}
|editmyuserjs
|{{int|right-editmyuserjs}} - <translate><!--T:223--> prior to 1.31 it was assigned to everyone (i.e. "*") (note that this is not needed if the group already has the <tvar name=edituserjs>''edituserjs''</tvar> right)</translate> - <translate><!--T:240--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|user
|[[gerrit:67874|1.22+]]
|-{{anchor|editmyuserjsredirect}}
|editmyuserjsredirect
|{{int|right-editmyuserjsredirect}} <translate><!--T:259--> (note that this is not needed if the group already has the <tvar name=edituserjs>''edituserjs''</tvar> right)</translate> - <translate><!--T:260--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|—
|[[gerrit:502667|1.34+]]
|-{{anchor|editmyuserjson}}
|editmyuserjson
|{{int|right-editmyuserjson}} <translate><!--T:224--> (note that this is not needed if the group already has the <tvar name=edituserjson>''edituserjson''</tvar> right)</translate> - <translate><!--T:241--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|user
|[[gerrit:408940|1.31+]]
|-{{anchor|editmywatchlist}}
|editmywatchlist
|{{int|right-editmywatchlist}} - <translate><!--T:266--> requires the <tvar name=1><code>viewmywatchlist</code></tvar> right</translate>
|*
|[[gerrit:67875|1.22+]]
|-{{anchor|editsitecss}}
|editsitecss
|{{int|right-editsitecss}} - <translate><!--T:242--> requires the ''<tvar name=1>editinterface</tvar>'' right</translate>
|interface-admin
|[[gerrit:421121|1.32+]]
|-{{anchor|editsitejs}}
|editsitejs
|{{int|right-editsitejs}} - <translate><!--T:243--> requires the ''<tvar name=1>editinterface</tvar>'' right</translate>
|interface-admin
|[[gerrit:421121|1.32+]]
|-{{anchor|editsitejson}}
|editsitejson
|{{int|right-editsitejson}} - <translate><!--T:244--> requires the ''<tvar name=1>editinterface</tvar>'' right</translate>
|sysop, interface-admin
|[[gerrit:421121|1.32+]]
|-{{anchor|editusercss}}
|editusercss
|{{int|right-editusercss}} - <translate><!--T:245--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|interface-admin
|[[rev:54153|1.16+]]
|-{{anchor|edituserjs}}
|edituserjs
|{{int|right-edituserjs}} - <translate><!--T:246--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|interface-admin
|[[rev:54153|1.16+]]
|-{{anchor|edituserjson}}
|edituserjson
|{{int|right-edituserjson}} - <translate><!--T:247--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|sysop, interface-admin
|[[gerrit:408940|1.31+]]
|-{{anchor|hideuser}}
|hideuser
|{{int|right-hideuser}} - <translate><!--T:212--> Only users with 1000 edits or less can be suppressed by default</translate> - <translate><!--T:261--> requires the ''<tvar name=1>block</tvar>'' right</translate>
<translate><!--T:213--> Use <tvar name=HideUserContribLimit>{{wg|HideUserContribLimit}}</tvar> to disable.</translate>
|suppress
|[[rev:20446|1.10+]]
|-{{anchor|markbotedits}}
|markbotedits
|{{int|right-markbotedits}} - <translate><!--T:101--> see <tvar name=1>{{ll|Manual:Rollback}}</tvar></translate> - <translate><!--T:248--> requires the ''<tvar name=1>rollback</tvar>'' right</translate>
|sysop
|[[rev:27658|1.12+]]
|-{{anchor|mergehistory}}
|mergehistory
|{{int|right-mergehistory}} - <translate><!--T:249--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|sysop
|[[rev:27823|1.12+]]
|-{{anchor|pagelang}}
|pagelang
|{{int|right-pagelang}} - <translate><!--T:214--> <tvar name=PageLanguageUseDB>{{ll|Manual:$wgPageLanguageUseDB|$wgPageLanguageUseDB}}</tvar> must be ''true''</translate>
|—
|[[gerrit:135312|1.24+]]
|-{{anchor|patrol}}
|patrol
|{{int|right-patrol}} - <translate><!--T:102--> <tvar name=UseRCPatrol>{{ll|Manual:$wgUseRCPatrol|$wgUseRCPatrol}}</tvar> must be ''true''</translate>
|sysop
|[[rev:9367|1.5+]]
|-{{anchor|patrolmarks}}
|patrolmarks
|{{int|right-patrolmarks}}
|—
|[[rev:54153|1.16+]]
|-{{anchor|protect}}
|protect
|{{int|right-protect}} - <translate><!--T:250--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|sysop
|[[rev:9367|1.5+]]
|-{{anchor|rollback}}
|rollback
|[[Special:MyLanguage/Manual:Rollback|{{int|right-rollback}}]] - <translate><!--T:251--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|sysop
|[[rev:9367|1.5+]]
|-{{anchor|suppressionlog}}
|suppressionlog
|{{int|right-suppressionlog}}
|suppress
|[[rev:13224|1.6+]]
|-{{anchor|suppressrevision}}
|suppressrevision
|{{int|right-suppressrevision}} - <translate><!--T:119--> '''Prior to <tvar name=1>[[rev:35303|1.13]]</tvar> this right was named hiderevision'''</translate> - <translate><!--T:252--> requires the ''<tvar name=1>deleterevision</tvar>'' right</translate>
|suppress
|[[rev:13224|1.6+]]
|-{{anchor|unblockself}}
|unblockself
|{{int|right-unblockself}} - <translate><!--T:96--> Without it, an administrator that has the capability to block cannot unblock themselves if blocked by another administrator</translate>
|sysop
|[[rev:64228|1.17+]]
|-{{anchor|undelete}}
|undelete
|{{int|right-undelete}} - <translate><!--T:253--> requires the ''<tvar name=1>deletedhistory</tvar>'' right</translate>
|sysop
|[[rev:28151|1.12+]]
|-{{anchor|userrights}}
|userrights
|{{int|right-userrights}} - <translate><!--T:97--> allows the assignment or removal of all(*) groups to any user.</translate><br />
<small><translate><!--T:98--> (*)With <tvar name=AddGroups>{{ll|Manual:$wgAddGroups|$wgAddGroups}}</tvar> and <tvar name=RemoveGroups>{{ll|Manual:$wgRemoveGroups|$wgRemoveGroups}}</tvar> you can set the possibility to add/remove certain groups instead of all</translate></small>
|bureaucrat
|[[rev:9367|1.5+]]
|-{{anchor|userrights-interwiki}}
|userrights-interwiki
|{{int|right-userrights-interwiki}} - requires the ''userrights'' right
|—
|[[rev:28650|1.12+]]
|-{{anchor|viewmyprivateinfo}}
|viewmyprivateinfo
|{{int|right-viewmyprivateinfo}}
|*
|[[gerrit:67876|1.22+]]
|-{{anchor|viewmywatchlist}}
|viewmywatchlist
|{{int|right-viewmywatchlist}}
|*
|[[gerrit:67875|1.22+]]
|-{{anchor|viewsuppressed}}
|viewsuppressed
|{{int|right-viewsuppressed}} - <translate><!--T:120--> i.e. a more narrow alternative to "suppressrevision" (note that this is not needed if the group already has the <tvar name=suppressrevision>''suppressrevision''</tvar> right)</translate>
|suppress
|[[gerrit:139277|1.24+]]
|-
|{{hl3}} colspan="4"|'''{{visible anchor|1=<translate><!--T:195--> Administration</translate>}}'''
|-{{anchor|autopatrol}}
|autopatrol
|{{int|right-autopatrol}} - <translate><!--T:141--> <tvar name=UseRCPatrol>{{ll|Manual:$wgUseRCPatrol|$wgUseRCPatrol}}</tvar> must be ''true''</translate>
|bot, sysop
|[[rev:18496|1.9+]]
|-{{anchor|deletechangetags}}
|deletechangetags
|{{int|right-deletechangetags}} - <translate><!--T:132--> currently unused by extensions</translate>
|sysop
|[[gerrit:286282|1.28+]]
|-{{anchor|import}}
|import
|{{int|right-import}} - <translate><!--T:126--> "transwiki"</translate> - <translate><!--T:254--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|sysop
|[[rev:9498|1.5+]]
|-{{anchor|importupload}}
|importupload
|{{int|right-importupload}} - <translate><!--T:128--> This right was called 'importraw' in and before version 1.5</translate> - <translate><!--T:255--> requires the ''<tvar name=1>edit</tvar>'' right</translate>
|sysop
|[[rev:9499|1.5+]]
|-{{anchor|managechangetags}}
|managechangetags
|{{int|right-managechangetags}} - <translate><!--T:225--> currently unused by extensions</translate>
|sysop
|1.25+
|-{{anchor|siteadmin}}
|siteadmin
|{{int|right-siteadmin}} - <translate><!--T:124--> which blocks all interactions with the web site except viewing.</translate> (''<translate><!--T:219--> not available by default</translate>'')
|—
|[[rev:9367|1.5+]]
|-{{anchor|unwatchedpages}}
|unwatchedpages
|{{int|right-unwatchedpages}} - <translate><!--T:131--> lists pages that no user has watchlisted</translate>
|sysop
|[[rev:12196|1.6+]]
|-
|{{hl3}} colspan="4"|'''{{visible anchor|1=<translate><!--T:196--> Technical</translate>}}'''
|-{{anchor|apihighlimits}}
|apihighlimits
|{{int|right-apihighlimits}}
|bot, sysop
|[[rev:27949|1.12+]]
|-{{anchor|autoconfirmed}}
|autoconfirmed
|{{int|right-autoconfirmed}} - <translate><!--T:145--> used for the 'autoconfirmed' group, see the other table below for more information</translate> (note that this is not needed if the group already has the ''noratelimit'' right)
|autoconfirmed, bot, sysop
|[[rev:12207|1.6+]]
|-{{anchor|bot}}
|bot
|{{int|right-bot}} - <translate><!--T:134--> can optionally be viewed</translate>
|bot
|[[rev:9367|1.5+]]
|-{{anchor|ipblock-exempt}}
|ipblock-exempt
|{{int|right-ipblock-exempt}}
|sysop
|[[rev:18904|1.9+]]
|-{{anchor|nominornewtalk}}
|nominornewtalk 
|{{int|right-nominornewtalk}} - <translate><!--T:137--> requires the ''<tvar name=1>minoredit</tvar>'' right</translate>
|bot
|[[rev:17281|1.9+]]
|-{{anchor|noratelimit}}
|noratelimit
|{{int|right-noratelimit}} - <translate><!--T:138--> not affected by [[<tvar name=1>Special:MyLanguage/Manual:$wgRateLimits</tvar>|rate limits]] (''prior to the introduction of this right, the configuration variable <tvar name=RateLimitsExcludedGroups>{{ll|Manual:$wgRateLimitsExcludedGroups|$wgRateLimitsExcludedGroups}}</tvar> was used for this purpose'')</translate>
|sysop, bureaucrat
|[[rev:35908|1.13+]]
|-{{anchor|override-export-depth}}
|override-export-depth
|{{int|right-override-export-depth}}<br /><small><translate><!--T:234--> With this right, you can define the depth of linked pages at <tvar name=link1>[[Special:Export]]</tvar>. Otherwise, the value of <tvar name=link2>{{ll|Manual:$wgExportMaxLinkDepth|$wgExportMaxLinkDepth}}</tvar>, which is 0 by default, will be used.</translate></small>
|—
|?
|-{{anchor|suppressredirect}}
|suppressredirect
|{{int|right-suppressredirect}} - <translate><!--T:256--> requires the ''<tvar name=1>move</tvar>'' right</translate>
|bot, sysop
|[[rev:27774|1.12+]]
|}
{{Note|1=<translate><!--T:149--> Although these permissions all control separate things, sometimes to perform certain actions you need multiple permissions.</translate> <translate><!--T:150--> For example allowing people to edit but not read pages doesn't make sense, since in order to edit a page you must first be able to read it (Assuming no pages are allowlisted).</translate> <translate><!--T:151--> Allowing uploads but not editing does not make sense, since in order to upload an image you must implicitly create an image description page, etc.</translate>}}

<translate>

== List of groups == <!--T:152-->
</translate>
<translate><!--T:153--> The following groups are available in the latest version of MediaWiki.</translate>
<translate><!--T:154--> If you are using an older version then some of these may not be implemented.</translate>

{|class="wikitable"
|-
!{{hl2}} | <translate><!--T:155--> Group</translate>
!{{hl2}} | <translate><!--T:156--> Description</translate>
!{{hl2}} | <translate><!--T:215--> Default rights</translate>
!{{hl2}} | <translate><!--T:157--> Versions</translate>
|-
| *
| <translate><!--T:158--> All users (including anonymous).</translate>
|createaccount, createpage, createtalk, edit, editmyoptions, editmyprivateinfo, editmywatchlist, read, viewmyprivateinfo, viewmywatchlist, writeapi
|[[rev:9367|1.5+]]
|-
|temp
|Temporary user accounts (T330816)
|Similar to * group
|1.41+
|-
|user
| <translate><!--T:159--> Registered accounts.</translate> Does ''not'' include temporary accounts.
|applychangetags, changetags, createpage, createtalk, edit, editcontentmodel, editmyusercss, editmyuserjs, editmyuserjson, minoredit, move, move-categorypages, move-rootuserpages, move-subpages, movefile, purge, read, reupload, reupload-shared, sendemail, upload, writeapi
|
|-
|autoconfirmed
| <translate><!--T:160--> Registered accounts at least as old as <tvar name=AutoConfirmAge>{{ll|Manual:$wgAutoConfirmAge|$wgAutoConfirmAge}}</tvar> and having at least as many edits as <tvar name=AutoConfirmCount>{{ll|Manual:$wgAutoConfirmCount|$wgAutoConfirmCount}}</tvar>.</translate>
|autoconfirmed, editsemiprotected
|[[rev:12207|1.6+]]
|-
|bot
| <translate><!--T:163--> Accounts with the ''bot'' right (intended for automated scripts).</translate>
|autoconfirmed, autopatrol, apihighlimits, bot, editsemiprotected, nominornewtalk, suppressredirect, writeapi
|[[rev:9367|1.5+]]
|-
|sysop
| <translate><!--T:164--> Users who by default can delete and restore pages, block and unblock users, et cetera.</translate>
|apihighlimits, autoconfirmed, autopatrol, bigdelete, block, blockemail, browsearchive, createaccount, delete, deletedhistory, deletedtext, editinterface, editprotected, editsemiprotected, editsitejson, edituserjson, import, importupload, ipblock-exempt, managechangetags, markbotedits, mergehistory, move, move-categorypages, move-rootuserpages, move-subpages, movefile, noratelimit, patrol, protect, reupload, reupload-shared, rollback, suppressredirect, unblockself, undelete, unwatchedpages, upload
|[[rev:9367|1.5+]]
|-
|interface-admin
| <translate><!--T:220--> Users who can edit sitewide CSS/JS.</translate>
|editinterface, editsitecss, editsitejs, editsitejson, editusercss, edituserjs, edituserjson
|1.32+
|-
|bureaucrat
| <translate><!--T:165--> Users who can change the rights of other users by default and therefore have full access of the entire wiki.</translate>
|noratelimit, userrights
|[[rev:9367|1.5+]]
|-
|suppress
|
|deletelogentry, deleterevision, hideuser, suppressionlog, suppressrevision, viewsuppressed
|
|}

<translate><!--T:167--> From MW 1.12, you can create your own groups into which users are automatically promoted (as with autoconfirmed and emailconfirmed) using <tvar name=AutoPromote>{{ll|Manual:$wgAutopromote|$wgAutopromote}}</tvar>.</translate>
<translate><!--T:168--> You can even create any custom group by just assigning rights to them.</translate>

<translate>

== Default rights == <!--T:169-->

<!--T:170-->
The default rights are defined in <tvar name=1>{{ll|Manual:MainConfigSchema.php|MainConfigSchema.php}}</tvar>.

<!--T:171-->
* Default values in HEAD version:</translate> https://phabricator.wikimedia.org/diffusion/MW/browse/master/includes/MainConfigSchema.php
<translate>
<!--T:172-->
* The default values in the latest stable MediaWiki release, version <tvar name=1>{{MW stable branch number}}</tvar>, are available here:</translate> https://phabricator.wikimedia.org/diffusion/MW/browse/{{#invoke:Version|get|stable|git}}/includes/MainConfigSchema.php
<translate>
<!--T:173-->
* Additional rights: you should be able to list all the permissions available on your wiki by running <tvar name=1>{{phpi|PermissionManager::getAllRights()}}</tvar>.

=== Adding new rights === <!--T:175-->
</translate>
''<translate><!--T:176--> Information for coders only follows.</translate>''

<translate><!--T:177--> If you're adding a new right in core, for instance to [[<tvar name=2>Special:MyLanguage/Manual:Special pages</tvar>|control a new special page]], you are ''required'' to add it to the list of available rights in <tvar name=User>{{ll|Manual:PermissionManager.php|PermissionManager.php}}</tvar>, <tvar name=1>{{phpi|$coreRights}}</tvar> ([<tvar name=url>https://gerrit.wikimedia.org/r/c/mediawiki/core/+/559622/9/includes/Permissions/PermissionManager.php</tvar> example]).</translate>
<translate><!--T:178--> If you're {{<tvar name=man>ll|Manual:Developing extensions</tvar>|doing so in an extension}}, you instead need to use <tvar name=AvailableRights>{{ll|Manual:$wgAvailableRights|$wgAvailableRights}}</tvar>.</translate>

<translate>
<!--T:179-->
You probably also want to assign it to some user group by editing <tvar name=GroupPermissions>{{ll|Manual:$wgGroupPermissions|$wgGroupPermissions}}</tvar> described above.

<!--T:217-->
If you want this right to be accessible to external applications by <tvar name=OAuth>{{ll|Help:OAuth|OAuth}}</tvar> or by [[<tvar name=1>Special:MyLanguage/Manual:Bot passwords</tvar>|bot passwords]], then you will need to add it to a grant by editing <tvar name=GrantPermissions>{{ll|Manual:$wgGrantPermissions|$wgGrantPermissions}}</tvar>.
</translate>

<syntaxhighlight lang="php">
// <translate nowrap><!--T:231--> create projectmember-powers right</translate>
$wgAvailableRights[] = 'projectmember-powers';

// <translate nowrap><!--T:232--> add projectmember-powers to the projectmember-group</translate>
$wgGroupPermissions['projectmember']['projectmember-powers'] = true;

// <translate nowrap><!--T:233--> add projectmember-powers to the 'basic' grant so we can use our projectmember powers over an API request</translate>
$wgGrantPermissions['basic']['projectmember-powers'] = true;
</syntaxhighlight>

<translate><!--T:180--> You also need to add <code>right-[name]</code> and <code>action-[name]</code> interface messages to /languages/i18n/en.json (with documentation in qqq.json).</translate>
<translate><!--T:181--> The <tvar name=1>right-*</tvar> messages can be seen on <tvar name=2>[[Special:ListGroupRights]]</tvar> and the <tvar name=3>action-*</tvar> messages are used in a sentence like "You do not have permission to ...".</translate>

<translate>

== See also == <!--T:182-->
</translate>
* [[Special:ListGroupRights]] – <translate><!--T:197--> Links to this help page and might contain not yet documented rights</translate>
* {{ll|Help:User rights and groups}} – <translate><!--T:198--> Help page describing use of the <tvar name=1>Special:Userrights</tvar> interface (for bureaucrats)</translate>
* {{ll|Manual:Setting user groups in MediaWiki}} – <translate><!--T:199--> Information about managing and the assignment of user groups.</translate>
* {{ll|Manual:$wgNamespaceProtection}}
* {{ll|Manual:$wgAutopromote}}
* {{ll|Manual:$wgAddGroups}}, {{ll|Manual:$wgRemoveGroups}}
* {{ll|Manual:Preventing access}} – <translate><!--T:200--> Examples</translate>
* {{ll|Manual:Establishing a hierarchy of bureaucrats}}
* {{ll|Category:User rights extensions}} – <translate><!--T:201--> Many extensions relating to user rights</translate>

{{Log events}}

[[Category:Special Pages{{#translation:}}]]
[[Category:Permission{{#translation:}}]]