[MediaWiki-l] [Wikitech-l] MediaWiki:Common.js and MediaWiki:Common.css blocked on Special:Login and Special:Preferences

Legoktm legoktm.wikipedia at gmail.com
Thu Nov 6 17:26:28 UTC 2014


On 11/6/14 6:58 AM, Mark A. Hershberger wrote:
> 
> TL;DR: Should we merge https://gerrit.wikimedia.org/r/#/c/165979/ and
> release it with MediaWiki 1.24?
> 
> A lot of sites have used MediaWiki:Common.js and MediaWiki:Common.css to
> customize the appearance of their site.
> 
> In a recent security release[1], support for JS and CSS with on-wiki
> origins was removed from being displayed on the Special:Login and
> Special:Preferences page.

To be clear, only CSS was removed. JS was already not allowed on
Special:Login/Preferences.

> Because of how the on-wiki MediaWiki:Common.* pages are used and the
> access restrictions on them, I think it is reasonable to allow JS and
> CSS from them while continuing to disallow individual's JS and CSS on
> the Special:Preferences and Special:Login page.
> 
> Alexia filed a bug[2] and Kunal (Legoktm) has provided a patch[3] to allow
> site-wide styling back on those pages.

Right, the patch only re-adds site-wide CSS, not JS.

-- Legoktm



More information about the MediaWiki-l mailing list