On 11/6/14 6:58 AM, Mark A. Hershberger wrote: > > TL;DR: Should we merge https://gerrit.wikimedia.org/r/#/c/165979/ and > release it with MediaWiki 1.24? > > A lot of sites have used MediaWiki:Common.js and MediaWiki:Common.css to > customize the appearance of their site. > > In a recent security release[1], support for JS and CSS with on-wiki > origins was removed from being displayed on the Special:Login and > Special:Preferences page.
To be clear, only CSS was removed. JS was already not allowed on Special:Login/Preferences. > Because of how the on-wiki MediaWiki:Common.* pages are used and the > access restrictions on them, I think it is reasonable to allow JS and > CSS from them while continuing to disallow individual's JS and CSS on > the Special:Preferences and Special:Login page. > > Alexia filed a bug[2] and Kunal (Legoktm) has provided a patch[3] to allow > site-wide styling back on those pages. Right, the patch only re-adds site-wide CSS, not JS. -- Legoktm _______________________________________________ Wikitech-l mailing list Wikitech-l@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/wikitech-l
