I am planning to setup a public wiki using mediawiki, but I never used mediawiki for a public site before and I am not experienced with it, even as a user.
I am planning to create a very restricted wiki setup with restricted account creation and editing only by registered users, but content open to the public. So I am planning to do the following :
- add a UserLoadFromSession hook to allow automatic logon to the wiki if the user is already authenticated (the wiki will be a part of an existing site, the site already contains a user database and login form. I want to disable all user management related functionality of mediawiki)
- remove several special pages by adding a SpecialPage_initList hook (do I need to do something else to prevent access to related functionality, for example list of users?)
- disable all kinds of file uploads or external content ($wgEnableUploads=false, $wgAllowCopyUploads=false, $wgAllowExternalImages=false, $wgAllowImageTag=false, $wgRawHtml=false etc )
- hide all private user information, like IP addresses, watchlists etc, except usernames. ($wgPageShowWatchingUsers=false, $wgShowIPinHeader=false,$wgAllowPageInfo=false, $wgRCShowWatchingUsers=false, $wgAllowUserCssPrefs=false)
- disable all functionality that involve sending emails ($wgEnableEmail=false, $wgEnableUserEmail=false, $wgEmailAuthentication=false)
- disable all unnecessary features like api, feeds, ajax, suggestions etc ($wgEnableAPI=false, $wgEnableWriteAPI=false, $wgDisableAnonTalk=true, $wgFeed=false, $wgUseAjax=false, $wgUseTrackbacks=false etc)
My question is : am I missing something, do I need to do anything else to secure the wiki?
Thanks