A quick hack to hide a page from anyone who can’t edit it in MediaWiki

Today, a client asked for a way to hide the content of one page from casual browsers. I came up with the following:

$wgHooks['BeforePageDisplay'][] = 'stopDisplay';
function stopDisplay( $output, $skin ) {
        if( 'Passwords galore' === $output->getPageTitle() ) {
                global $wgUser, $wgTitle;
                if( !$wgTitle->userCan( "edit" ) ) {
                        $output->clearHTML();
                        $wgUser->mBlock = new Block( '127.0.0.1', 'WikiSysop', 'WikiSysop', 'none', 'indefinite' );
                        $wgUser->mBlockedby = 0;
                        $output->blockedPage();
                        return false;
                }
        }
        return true;
}

There may be another way to do this and this is certainly not secure against all attempts to read page content. For instance, if you want to hide a Wiki page like [[Passwords_galore]] from people using this technique, all they would have to do is include it using a template to get around this hack: {{:Passwords galore}}.

I’ll be looking at more ways to access the page and more ways to block it soon.