Page MenuHomePhabricator

Matching gift company search changes required
Open, Needs TriagePublic

Description

Hep Development, the provider that stores and services all of the participating companies around the Matching Gift program, was acquired by Affinaquest during 2023. Since the acquisition, Affinaquest apprised me of some changes this week which will require that we make changes to the way our donors search for whether their employer participates in the Matching Gift program. Instead of using this web search on the Affinaquest page as we do today on [[ https://donate.wikipedia.org/wiki/Matching_Gifts | name ]]we need to move to an embedded search box on our matching gift page. I have created the search widget for us to embed on https://donate.wikipedia.org/wiki/Matching_Gifts. It is below. Can this change be made as Affinaquest advise that they will be terminating the ability for us to continue to use their page for the look up.

Widget for embedding:
<script src="https://matchbox.hepdata.com/edl/wikimedia_iframe/m00u8ssh/script.js" async></script><div id="edl-template"></div>

Event Timeline

Hi @EMartin @RKumar_WMF - there's a question as to whether we will require a security review for the CSP update [h/t @Pcoombe @Ejegg ] - how do we determine whether this does indeed need review?

@Pcoombe do you know when the old stuff will stop working?

@greg Affinaquest said sometime in the next year the current search will stop working but they have not published a date. They made it clear they are not updating the current search mechanism/approach going forward from now.

When asked about security review, Evelyn didn't think it was required "The donor is searching through a widget for companies that participate in matching. There is no access to our data here."

However, would we need to embed non WMF code that would go against our policies?

Yes, the code in the task description involves embedding external javascript

@AKanji-WMF to follow up - will require a review (CSP change)

This comment was removed by EMartin.