Wiki source code of Protected Users

Last modified by Vincent Massol on 2026/08/14 18:41

Show last authors
1 Every AntiSpam operation that disables, cleans or deletes an account asks the same question first: is this a protected user? The answer is computed rather than kept as a single list, and an account is protected as soon as any of the following holds:
2
3 * it is the guest user, which has no account to disable;
4 * it has Admin right on the wiki, or Admin right on the page being operated on;
5 * it is listed on ##AntiSpam.KnownUsers##;
6 * it belongs to a group listed on ##AntiSpam.KnownGroups##.
7
8 Two entries count whether or not they are written down: the ##superadmin## user is always a known user, and ##XWiki.XWikiAdminGroup## is always a known group.
9
10 Admin right on the **page** being operated on is enough, which is worth knowing because it makes protection contextual. An account that administers a single space is protected from every operation on that space's pages, so it can appear excluded in one cleaning result and be removed in another.
11
12 Protection does not mean exemption from the keyword list. It means that trusted accounts are never destroyed:
13
14 |=Feature|=Effect on a protected user
15 |Spam Checking|The save is still refused, but nothing is recorded against the account.
16 |Spam Cleaning|The account is not deleted and its revisions are not removed. The entry says why it was excluded.
17 |Inactive user deletion|The account is never listed, and the job filters it out a second time before deleting anything.
18
19 The consequence worth planning for is the one that surprises administrators: an administrator who saves a page containing a spam keyword still has that save refused. Add a space to ##AntiSpam.Excludes## when a page legitimately needs to discuss the words on the keyword list.

Get Connected