From 46d97368eb6034f2eb95d5a8400bd4bf6faf4ed2 Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Sun, 14 Dec 2014 19:22:21 +0000
Subject: [PATCH] Add support for private mediawiki sites

---
 cookbooks/mediawiki/definitions/mediawiki_site.rb  |  3 ++-
 .../templates/default/LocalSettings.php.erb        | 14 ++++++++++++++
 cookbooks/mediawiki/templates/default/apache.erb   |  8 ++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/cookbooks/mediawiki/definitions/mediawiki_site.rb b/cookbooks/mediawiki/definitions/mediawiki_site.rb
index 81751fb37..d6a1ab773 100644
--- a/cookbooks/mediawiki/definitions/mediawiki_site.rb
+++ b/cookbooks/mediawiki/definitions/mediawiki_site.rb
@@ -55,7 +55,8 @@ define :mediawiki_site, :action => [ :create, :enable ] do
     :site_readonly    => params[:site_readonly] || FALSE,
     :site_admin_user  => "Admin",
     :site_admin_pw    => passwords["mediawiki-admin-user"],
-    :enable_ssl       => params[:enable_ssl] || FALSE
+    :enable_ssl       => params[:enable_ssl] || FALSE,
+    :private          => params[:private] || FALSE
   }
 
 #----------------
diff --git a/cookbooks/mediawiki/templates/default/LocalSettings.php.erb b/cookbooks/mediawiki/templates/default/LocalSettings.php.erb
index e3236159e..d03b78cf9 100644
--- a/cookbooks/mediawiki/templates/default/LocalSettings.php.erb
+++ b/cookbooks/mediawiki/templates/default/LocalSettings.php.erb
@@ -167,6 +167,20 @@ $wgGroupPermissions['bureaucrat']['deletelogentry'] = true;
 $wgGroupPermissions['bureaucrat']['deleterevision'] = true;
 $wgGroupPermissions['bureaucrat']['suppressrevision'] = true;
 $wgGroupPermissions['bureaucrat']['suppressionlog'] = true;
+<% if @mediawiki[:private] -%>
+
+#Disable reading by anonymous users
+$wgGroupPermissions['*']['read'] = false;
+
+#Allow anonymous users to access the login page
+$wgWhitelistRead = array ("Special:Userlogin");
+
+#Prevent new user registrations except by sysops
+$wgGroupPermissions['*']['createaccount'] = false;
+
+#Restrict access to the upload directory
+$wgUploadPath = "$wgScriptPath/img_auth.php";
+<% end -%>
 
 #Allow Subpages on Main Namespace
 $wgNamespacesWithSubpages[NS_MAIN] = true;
diff --git a/cookbooks/mediawiki/templates/default/apache.erb b/cookbooks/mediawiki/templates/default/apache.erb
index 6cbbc76e6..dcded20cc 100644
--- a/cookbooks/mediawiki/templates/default/apache.erb
+++ b/cookbooks/mediawiki/templates/default/apache.erb
@@ -200,6 +200,14 @@
     php_admin_flag engine off
     Options -ExecCGI -Includes -Indexes
     AllowOverride None
+<% if @mediawiki[:private] -%>
+<% if node[:lsb][:release].to_f >= 14.04 -%>
+    Require all denied
+<% else -%>
+    Order allow,deny
+    Deny from all
+<% end -%>
+<% end -%>
   </Directory>
 
   <Directory <%= @mediawiki[:directory] %>/images/thumb/>
-- 
2.39.5