Last modified: 2013-07-25 07:05:58 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T50381, the corresponding Phabricator task for complete and up-to-date bug report information.
First Last Prev Next    This bug is not in your last search results.
Bug 48381 - Remove '-', 'MediaWiki:Monobook.css' and 'MediaWiki:Monobook.js' from wgWhitelistRead in InitialiseSettings.php
Remove '-', 'MediaWiki:Monobook.css' and 'MediaWiki:Monobook.js' from wgWhite...
Status: RESOLVED FIXED
Product: Wikimedia
Classification: Unclassified
Site requests (Other open bugs)
wmf-deployment
All All
: Normal normal (vote)
: ---
Assigned To: This, that and the other (TTO)
: shell
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2013-05-12 15:33 UTC by Thehelpfulone
Modified: 2013-07-25 07:05 UTC (History)
9 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Thehelpfulone 2013-05-12 15:33:45 UTC 
Specifically for 

	'private' => array( 'Main Page', 'Special:Userlogin', 'Special:Userlogout', '-', 'MediaWiki:Monobook.css', 'MediaWiki:Monobook.js' ),

I don't think that those two pages need to be seen by users without an account because Vector is the default skin now. I believe we use MediaWiki:Common.js throughout wikis now instead of skin specific common files, but I'm not sure we need to allow people without accounts to see those either.
Comment 1 Liangent 2013-05-12 15:42:33 UTC 
I believe these entries were needed in the age when site CSS and JS were loaded with index.php?action=raw&ctype= so people can load them before logging in. With the introduction of ResourceLoader I don't think this and similar items are still needed.
Comment 2 Dereckson 2013-05-13 09:35:07 UTC 
I would like confirmation from a ResourceLoader/JS guy.

[ Adding Matma Rex as CC ]
Comment 3 Bartosz Dziewoński 2013-05-13 09:50:02 UTC 
I think Thehelpfulone and Liangent are right, but since I'm no ResourceLoader guy, I'm CC-ing Krinkle instead.
Comment 4 Andre Klapper 2013-06-25 10:41:32 UTC 
Krinkle: Could you answer comment 2, please?
Comment 5 MZMcBride 2013-06-26 03:17:50 UTC 
Why is '-' included (just curious)?
Comment 6 Liangent 2013-06-26 03:41:14 UTC 
(In reply to comment #5)
> Why is '-' included (just curious)?

In the past, &title=- was used in JS loading and I believe this was the reason to include '-' in wgWhitelistRead.
Comment 7 Krinkle 2013-06-26 07:28:22 UTC 
MediaWiki:Monobook.css and MediaWiki:Monobook.js are redundant indeed.

Note that you should still not put private information in there[1] as ResourceLoader's entry point essentially bypasses the whitelist indirectly through it's package for the 'site' module.


[1] there being both Common.js, Common.css as well as any skin .css/.js page.
Comment 8 Gerrit Notification Bot 2013-07-14 02:43:08 UTC 
Change 73603 had a related patch set uploaded by TTO:
(bug 48381) remove obsolete js/css entries from $wgWhitelistRead

https://gerrit.wikimedia.org/r/73603
Comment 9 Gerrit Notification Bot 2013-07-17 16:41:49 UTC 
Change 73603 merged by jenkins-bot:
(bug 48381) remove obsolete js/css entries from $wgWhitelistRead

https://gerrit.wikimedia.org/r/73603
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.

Navigation
Links