On 05/27/2014 10:52 PM, Brian Wolff wrote:
I specifically said bits.wikimedia.org and upload.wikimedia.org (and not
commons.wikimedia.org), neither of which host user JavaScript.
Matt Flaschen
Gadgets are on bits and they are user controlled. Ditto for mediawiki:common.js et al. (Unless you mean users as in non admins). I see no usecase from allowing from bits. If someone wants an extension asset they can upload it.
You're right, I was completely wrong about the user JavaScript. Actually, user scripts are on bits too. Conceivably, it could limit it to directories starting with static-..., but that starts getting complicated. It's probably safer to limit it to user-uploaded Commons files as you said.
Matt Flaschen