Recently Yuri discovered that Lua is very effective when used with the graph extension. This has brought us to a point where we need to put the scripts between the external data (an API call) and the graph. This is only possible if we let Lua make external calls to an api url.
We are aware that this may bring up some concerns about security and speed. If this is strictly necessary we could limit this feature in some way to meet this security and speed requirements.
Description
Description
Event Timeline
Comment Actions
I do not think this should actually make external api calls. It should do internal api calls. (Although last I heard there were some issues with $wgParser recursion when doing that sort of thing during a parse. Not sure if that's fixed)
Provided that the calls are unauthenticated, I don't think its a security issue. It should obviously be marked as an "expensive" function. Performance concerns should be considered carefully (Whee loops), but don't seem insurmountable.
Comment Actions
I presume this is the same issue I proposed earlier - to allow forvarious readonly api.php?action=query and similar. Are there any specific API calls that should not be allowed this way?