From 73094965b10ab66273493245662e8267cf611962 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Mon, 27 Jul 2026 09:53:03 +0200 Subject: [PATCH] Sync LDAP et fix ACLs --- hosts/vm/mediakiwi/category-lockdown.patch | 12 ++++++------ hosts/vm/mediakiwi/mediawiki.nix | 10 ++++++++++ secrets/mediakiwi/mediawiki-ldap.age | Bin 2410 -> 2800 bytes 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/hosts/vm/mediakiwi/category-lockdown.patch b/hosts/vm/mediakiwi/category-lockdown.patch index 7816d48..37de940 100644 --- a/hosts/vm/mediakiwi/category-lockdown.patch +++ b/hosts/vm/mediakiwi/category-lockdown.patch @@ -1,8 +1,8 @@ diff --git a/CategoryLockdown.php b/CategoryLockdown.php -index 3309c52..c4f4cb0 100644 +index 1e17ec7..8108615 100644 --- a/CategoryLockdown.php +++ b/CategoryLockdown.php -@@ -15,6 +16,8 @@ class CategoryLockdown { +@@ -16,6 +16,8 @@ class CategoryLockdown { */ public static function onGetUserPermissionsErrors( $title, $user, $action, &$result ) { global $wgCategoryLockdown; @@ -11,7 +11,7 @@ index 3309c52..c4f4cb0 100644 $explicitGroups = MediaWikiServices::getInstance()->getUserGroupManager()->getUserGroups( $user ); $implicitGroups = MediaWikiServices::getInstance()->getUserGroupManager()->getUserImplicitGroups( $user ); -@@ -25,6 +28,11 @@ class CategoryLockdown { +@@ -26,6 +28,11 @@ class CategoryLockdown { return; } @@ -23,7 +23,7 @@ index 3309c52..c4f4cb0 100644 $categories = array_keys( $title->getParentCategories() ); // Apply rules to the category page itself -@@ -32,16 +40,11 @@ class CategoryLockdown { +@@ -33,16 +40,11 @@ class CategoryLockdown { $categories[] = $title->getFullText(); } @@ -42,7 +42,7 @@ index 3309c52..c4f4cb0 100644 if ( !$permissions ) { continue; } -@@ -56,15 +59,44 @@ class CategoryLockdown { +@@ -57,15 +59,44 @@ class CategoryLockdown { $combinedGroups[] = $allowedGroup; } } @@ -72,7 +72,7 @@ index 3309c52..c4f4cb0 100644 + continue; # Skip if this group rule doesn’t match the user + } + -+ $requiredCat = $groupCategories[$action]; ++ $requiredCat = $groupCategories[ $action ] ?? null; + if ( $requiredCat == null ) { + continue; + } diff --git a/hosts/vm/mediakiwi/mediawiki.nix b/hosts/vm/mediakiwi/mediawiki.nix index 9d4e376..6279eb9 100644 --- a/hosts/vm/mediakiwi/mediawiki.nix +++ b/hosts/vm/mediakiwi/mediawiki.nix @@ -146,6 +146,7 @@ in $wgGroupPermissions['*']['delete'] = true; # Création de comptes depuis LDAP et Note mais pas local $wgCategoryLockdownWhitelist = [ "Spécial:Connexion", + "Spécial:Déconnexion", "Spécial:Connexion/return", "Spécial:PluggableAuthLogin", "Spécial:Recherche", @@ -286,6 +287,15 @@ in # Pas de meilleure solution à ma connaissance pour suivre les releases. sha256 = "sha256-/9VISvpvhaVq/sAHE10INlTju7+PTirFO/6U68WBOgM="; }; + LDAPGroup = pkgs.fetchFromGitHub { + name = "LDAPGroup"; + owner = "wikimedia"; + repo = "mediawiki-extensions-LDAPGroups"; + tag = "3.1.0"; + # Le SHA doit être changé à chaque nouveau commit de traduction. + # Pas de meilleure solution à ma connaissance pour suivre les releases. + sha256 = "sha256-aW1nVechxy4CfyT953LfNgeUOXZGeIkV3KwPJJwlyug="; + }; WSOAuth = pkgs.applyPatches { src = pkgs.fetchFromGitHub { name = "WSOAuth"; diff --git a/secrets/mediakiwi/mediawiki-ldap.age b/secrets/mediakiwi/mediawiki-ldap.age index b28cc2b9c6e6835e10f87aa2f2ed5ece22d96e12..66b95e117a2d69004889298a89e9fad633e8eca3 100644 GIT binary patch literal 2800 zcmZXUiI>v^9>;l$%no(A_AT;2j&hDrXWBGv)2>`;liumww5eQankH?MUTM-!*;!9u z9AvpfZqPxILzhcX&J_?4fk99Nbdgi=i3p4ihX}LmzUO

|gMCzwht+{g4b@OJ}G; zeXf|wX6mv9MlA!1+R;i;WNYb!R<8$4N;zi4nUXS`Q3;$otHu6pz9+jWJJ`b0)7@{2!LV;#T_}vU1jXgQj55 zYG|Fc1WFpOPKSg7wu}WqCBkXPFsGm9fQq*qGb=!XlAKW)lLC1MD}dgd5zMM0syGJX zl;AJnE;VBE8r+yjIv!1t_QK&Hqoh)_H|JqkLQkMFL|LF<-e0Nsy}FQ&WKupRL)cI! zEV2+vC_-Gys1e9K=jCJZNQ~CvDU-*7ddXx3!018>LE|`U1Vo>T`;Ar*No4>fV`f+p z7Lc%DG^u!-1BmGY!6240vN2Bp<6MDKEaySh87mF@cswiufG(NL#Tb5|zAB2Bct!#1rmBLh=A9v?RdBbRcd|TM#Ui@%Vx{GOQ_;OB9ToX~7-hVitcE zE(CZ5XtS6z8Tn!U80NL8K{DX60btY!YC*G;H-xAP7?TZdD-#X53j`Y$Vri8FI6`#Ziv~5>k}sQ1$Z;!@%u@zc zDHDyeK#I30#CX0E2qY=i!PrP`B_GFgqT7nfET(2bP(rjoUdj^nP=+$YB|ak}Du4-O zteoDO(Lfj+R7hG0N;&l~YSNPR5uOs#8d~t@jAA+$Gl-I;qR=2qiV=~5B^h^;ZXkn2 z3o(<<c5jm{p86cTQ@^&*&Dv?%iIF<0F{V7Pa@P54-f^tT?!xD(&u5 zda?ouF(Y?j79NVHGZ43Q=JOXj8Y^ud3O+{mnKYocqDNwcAs2l^<@=3#@j zl2XkPfKOk9D}X9gio-dd$s#cT4;ZvkM0DHAD3(sxh%69gbqb#Ks@)~hX#%*27s2CM zgEbyWK*5BFhXX|`WEQwe1hncPgn5)kM=`hvD;ZmT4)N)V(YPJZu4x|OvP_oyX5G*Q4I$u&W(73@bT5NnI_n_cXwDE$=WS&;BtfLFp!1Lr64%!2U9l3xa*CK)Ph*HVjLN8A zi<%L)CQgVR!QspXZF)Ip3|8vdhh5aLCgRcC;sHC3!^!}Ut3iJ*LF;(b>F^2WqQz7Y zV-)U50jSI4aAJ0=(~uI4c8!AcF^VXk1$dmA#aKJjVhY~^dl@;DY-5FB$yYtR5~PzW}Q@VDBw72 zNH}AHkd<7SQj){MD%cqbL`p6a>ZUahdaQnV`><|})6a{0=wY_SFRk11hpNWl)em32``+sK znq0S?#qOltyi~h+=wS0-s?AB=yaOBu=Rsxp~v#$$0~-xRL$QW zE7)(p;%^jhNpmLJJNC~KYt9Vn-O?0aQx|m!7w%8(5o>9DY~XQ!4fI2wx0|`dAiQ;3 z>*3?j+`4Vj;z7?I9FbjlviI&C9j(Qs`?2<@VtM-~1!~NU&u6STJH74lW@qiVJ@Wg< z+9IlNHus)EfARLjKD)jXJ{@)xTVWYI>Gt^f=<}Cxb#>MEhZe)ow92aCbKmNRHIHq% z>D#wUTkAMJzoF){&u+Du_VK$;9;yCm{i3G6yY^0*y8Zq7&+%XO4!uhj)f-0c*BCq8 z5Z`(J+v3$0D%3b~+i2#6olj~nt~7KRr(Sh!=d8V}hpYQm?_YXo&ezR1c3?fZz8$Zu z=L&MUxhRjhG_d=D2V>6fp1u0ZOXI5A8#c|l zzW>sw7pnj0{d)_($3KmKRsEc8$eP{v%H40&omsD>&$GDtgPr3BEI%D`RxFp_eQx(a zMSIQub$=y~URwFZg7m?nuW97gQ>(&H6yNLp`X;OD95Vy!IIi%~$R*j;liu`@{~Yqh zV%Lx5)N~D1Jzjn9?EAy(CY1;M?&hU$uJ64tcJbq(*$orN^!bygy}`GkZO)Np5AN;t zIkR2$A743qGCXw0+Hr1l>D+v$txr8uTCoj&aIe?S3C=zIfTo|TF5H>${VC7OTAFJ) zbaBhn8#@**>firb?;R&$|A3wwYvA=ncCF^kJC#hYW%j{OgxBr+7<#fLuVNSk#Tu|K|Bp$kc|My2PHcUI*A#rx`(}ray4hVnHTov5Su>KHXO3=r{hA$>;j~xy{K|Z`kw3m0d&nQ!Bm% z(xWGBoiuUl39tBh=lHRzQ?Fee)zEmKjE|j%wvBc@uJt{!Y;>=q^G}aB7onb7nEznV lb<51L?L)4$&FS|`jqeoq?1EV)drRkqCx*`MvL$iW^Dib?PH_ML literal 2410 zcmZXU{nyik8HN$%hy|R0Q>O>4It7idY15`n6~%nCP1>eS(k4xNrYuR*q-olwX__=~ z2RY8YjyXQ2+wr&|_<=fgPClFthu~zw*_aM>z7B`Z4N-B5Lx(cO*Rdb`Vfq(b&wZc! zdL&I9Q@e`oTTZLjy{u`)SE!8nJR0o@` z&?6*IZblfyBXYT7IbZ9y)ErPNXR&t5u~^$HL{mn|G%?JRx!#~4#u|Kl6v!367y^+I zWOiD81ayien!s&EK9m1cwxHy&!@qS_INPA{r0KklIRB z@{w8@>JfFe1nMN{4(uQq5iHxSA_P)Rw4$JZ=XntiT)G~`du}V2DWP#A4YdFP4RQH0 z-)C{SB(;09%8N#G(s3j z=M))^THQXVL@-iS;uYB&Ax;+0@r4c*Ee{G^N^^L%+_VYb=ZXYa13lU{>NL+J{g5J6 z@_sFXGsidKl1v<0{w*X4^YMFXrI3yibWNTlhWs7<_>xH}3WU7#}O0iBiDd$ieb~r^z zmGX8=RTG60AYhUTnI4+N;-Ny6qB}HEOiOID>)729HXsDKowmA6R)BIz0jZ^Y*GzcI zS0xi^)Ir0;XutqYiWBM%F_H5#-G4F(HXpyBJo z7-kf8#bA0pK5pR7zzU!SV{=X!90~qcvcbC8Q`oRof?yHtleohqg+#ST%7AH=Gj6Sw z2w=kPRdLq@U~Ncv@sQsnn=(v_eG>6~&m-DRSBy%zk)6@1i5!$jlnpISbc#|O{c@8s zM+yQOZtA_7%HnvL6Dc;rf&o6r*tBhlBGep8$l$ou2&I<>mE$iUj^|T7Nap>1m2Q?& zty+fgm}sNjNJmnx)XSQ(+wPiy30PmrMrzfRiiTT_ILsEPLLy$n8i`t4SMn&HkR?tm z3s!}S%5*Q|1MQ$xRYDxv7eqa9ijWlK4b<*28Br{0L|#ZX3Sh>MH&E6}^|g`gg~rCl z!b9CIBinAtvKRjjcP4Al*-gD7UW}=ZzTh5uozVXS9?Q>SQ zZv5k#a_qp4yUi7Y)oYJ6C%^fxhZg;Lq)d6>?C@Dj7Dp#{`jZFy-+K1oFKhcBf8c^6 zTfcVoscOng>8bj89AUte&^rftG`g*gWf?z;8FtKNNJ*4Uz*+jeg{dFra~ zpY`6V;;nBlW47#J+Te`Or#@7n?!B#f{!I0SyWaWD<|nL)j~+R+_x5+RS6(}D>A!D1 z`uOt;G6$}n+h%|8;TgZeFJ2m+cc4G*_IXcC()-t6x%S}le>^{U{tkX!Co4X7#kuCR z_xG${QT@haQy!hQ`;yg%=A61?`9f-~`toVLkGGwA;oWzwI`Y>KmmEg-A3c2WrHS_@ zru~PXx$nLg$F6}snAou|nE%o})UtIePe1rsY4@Q^ix<3=m2zu0Tt4sS8*X~}&ZE1b zVPd|$_!a$)8H4?3SG#2~y?Z-$_Ttk&N!-70Y|Z$O!&ht{U$&3k^4R$5gC9)O zcfw0H3|B51zh;Jf#}ng`r6+8jO+5IfzA84!A}8JW3rxGAV6EYPe$vUeJvnvd7WSu- z_1uZ`W}o}o375Njs?Qufk2-$&%p>w_YW<;Er(N{oVm@+Naz?E5vjeN^zumi;czZJT zqWo}s*)zxdY&ySa%FQpG|LNGDR(*WZ;VZ?5u79-l$lKP&&6_6fgD;zT&vnO^C)S^H zdUw^<@9o|2yVKU8%Hmzu?0BW}mw)E}u;Op`F1U6fyCD1Q^~X+F@bT2;vvYH;r{3LZ iK7H|XQ(_yYe|O?=5&&l8U}(XdJI>s-