Page MenuHomePhabricator
Create Task
Maniphest T210946

outreachdashboard.wmflabs.org violates Labs ToS
Closed, ResolvedPublic
Actions

Description

Going to https://outreachdashboard.wmflabs.org/training loads

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,600
https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UNirkOUuhp.woff2
https://fonts.gstatic.com/s/sourcesanspro/v11/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
https://fonts.gstatic.com/s/sourcesanspro/v11/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2
https://fonts.gstatic.com/s/sourcesanspro/v11/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
https://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFVZ0b.woff2
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UNirkOUuhp.woff2
https://cdn.tinymce.com/4/tinymce.min.js
https://wikiedu.org/analytics/piwik.js

By doing so it violates https://wikitech.wikimedia.org/wiki/Wikitech:Cloud_Services_Terms_of_use, in particular point #6 of What can and can’t be done with user information?: "Not share any Private Information outside of your Cloud Services Project", but also point #3 "Get express authorization from the End Users for the collection", #1 and #2, and probably others.
See J65 and T172065.

Related Objects
Search...

StatusSubtypeAssignedTask
 OpenNoneT133919 [EPIC] Protect end-user privacy by restricting non-consensual third-party browser interactions
 OpenNoneT130748 Add Content-Security-Policy header enforcing 3rd party web interaction restrictions to proxy responses
 OpenNoneT129936 Ensure that Terms of Use document restrictions on third-party web interactions
 OpenNoneT172065 Hunt for Toolforge tools that load resources from third party sites
 ResolvedKenrick95T172271 Tool "adas" loads fonts from fonts.googleapis.com
 ResolvedDanmichaeloT172272 Tool "arkivbot" loads assets from bootsrtrapcdn and code.jquery.com
 OpenNoneT172273 Tool "arowf" loads jquery and bootstrap from cloudflare
 ResolvedAsh_CrowT172274 Tool "ash-django" loads bootstrap from bootstrapcdn
 ResolvedKrinkleT172275 Tool "blankpages" loads jquery from ajax.googleapis.com
 OpenNoneT172276 Tool "bub" loads assets from ajax.googleapis.com
 ResolvedJarry1250T172277 Tool "bytesadded" loads jquery ui from ajax.googleapis.com
 ResolvedAddshoreT172278 Tool "cgstat" loads jquery from ajax.googleapis.com
 ResolvedSurlycyborgT172279 Tool "citationhunt" loads assets from google
 OpenNoneT172280 Tool "cite-o-meter" loads fork-me-on-github ribbon from github
 ResolvedYarlT168786 Monumental imports css from fonts.googleapis.com
 ResolvedBeta16T172309 Tool "betabot" loads a badge from www.w3.org
 ResolvedferveoT172389 Tool "codeqc" loads assets from google and cloudflare
 ResolvedTheresNoTimeT172391 Tool "comidentgen" loads bootstrap and jquery from ajax.googleapis.com and bootstrapcdn
 ResolvedEmijrpT172395 Tool "commons-coverage" loads map tiles from OSM
 ResolvedMystT172396 Tool "coord" loads Google Maps
 ResolvedEarwigT172397 Tool "copyvios" loads assets from code.jquery.com
 OpenNoneT172399 Tool "corenlp" loads assets from google, cloudflare, bootstrapcdn
 ResolvedFnielsenT172400 Tool "cvrminer" loads bootstrap and jquery from cloudflare
 OpenNoneT172403 Tool "denkmalliste" loads assets from Google Maps
 ResolvedNoneT172404 Tool "detox" loads bootstrap and jquery from getbootstrap.com and ajax.googleapis.com
 ResolvedRicordisamoaT172405 Tool "dewkin" loads fork-me-on-github ribbon from Amazon AWS
 OpenNoneT172516 Tool "dimensioner" loads jquery and bootstrap from bootstrapcdn and ajax.googleapis.com
 ResolvedRanjithsijiT172517 Tool "editathonstat" loads assets from google
 OpenNoneT172518 Tool "etwikibots" loads fork-me-on-github ribbon from github
 ResolvedEpantaleoT172519 Tool "etytree" loads jquery, jquery-mobile, and jquery-ui from code.jquery.com, mixed http/https
 OpenNoneT172522 Tool "everythingisconnected" loads assets from google
 ResolvedFastilyT172524 Tool "fastilybot" loads assets from google and bootstrapcdn
 InvalidNoneT172527 Tool "gdk-artists-research" loads assets from freegeoip.net
 OpenNoneT172530 Tool "gendergapdashboard" loads assets from many sites
 OpenNoneT172533 Tool "geoplotter" loads assets from google, bootstrapcdn, cloudflare, and cartocdn; mixed http/https
 ResolvedvalhallaswT172535 Tool "gerrit-patch-uploader" loads fork-me-on-github ribbon from Amazon AWS
 ResolvedFramawikiT172600 Tool "globalsearch" loads bootstrap from bootstrapcdn
 Declinedbd808T172603 Tool "hackmd" loads assets from github and google
 ResolvedCyberpower678T172605 Tool "iabot" loads assets from google and hotjar
 ResolvedSymacT172606 Tool "iacrop" redirects to localhost
 ResolvedNoneT172608 Tool "icalendar" loads bootstrap doc assets from getbootstrap
 ResolvedxSavitarT172609 Tool "ifttt-testing" loads assets from many sites, mixed http/https
 ResolvedTheresNoTimeT172611 Tool "iplookup" loads assets from ajax.googleapis.com
 ResolvedAhechtT172612 Tool "ircredirect" redirects to kiwiirc.com without consent
 ResolvedJackPotteT172613 Tool "jackbot" redirects to GitHub without consent
 ResolvedAviatorT172614 Tool "jawi" loads assets from google and bootstrapcdn
 OpenNoneT172654 Tool "jury" loads assets from a few sites, mixed http/https
 OpenNoneT172655 Tool "lalm" loads assets from OSM tiles and toolserver(?)
 OpenNoneT172656 Tool "languageproofing-ui" loads assets from www.languagetool.org
 OpenNoneT172657 Tool "limesmap" loads assets from openlayers.org and opencyclemap.org
 ResolvedKrinkleT172658 Tool "list" redirects to GitHub without consent
 ResolvedTheDJT172659 Tool "locator" loads Google Maps
 ResolvedyuvipandaT172660 Tool "masscamps" loads jquery and angularjs from ajax.googleapis.com
 ResolvedMatthewrbowkerT172661 Tool "matthewrbowker-dev" loads bootstrap from bootstrapcdn
 ResolvedjrbsT172662 Tool "media-reports" loads YouTube in an iframe
 ResolvedSamwilsonT172663 Tool "mediawiki-feeds" loads bootstrap and jquery from bootstrapcdn and ajax.googleapis.com
 OpenNoneT172741 Tool "montage" loads fonts from google
 ResolvedMusikAnimalT172742 Tool "musikanimal" loads fonts from google
 ResolvedMooeypooT172744 Tool "mwstew" loads fork-me-on-github ribbon from github
 ResolvedTheresNoTimeT172745 Tool "myrcx" loads jquery from ajax.googleapis.com
 OpenNoneT172749 Tool "navlink-recommendation" loads jquery and bootstrap from code.jquery.com and bootstrapcdn
 ResolvedPintochT172750 Tool "openrefine-wikidata" loads assets from bootstrapcdn and github
 ResolvedFramawikiT172751 Tool "orphan-groups" loads jquery from ajax.googleapis.com
 ResolvedMaxSemT172752 Tool "osmlint" loads form-me-on-github ribbon from github
 OpenNoneT172753 Tool "pagecount" loads assets from google
 ResolvedSlashmeT172754 Tool "parliamentdiagram" loads assets from ajax.googleapis.com and github
 ResolvedIncolaT172822 Tool "personabot" loads assets from bootstrapcdn, ajax.googleapis.com, and w3.org
 OpenNoneT172823 Tool "ramp" loads assets from google and cloudflare
 ResolvedKenrick95T172825 Tool "raun" loads fonts and analytics from google
 ResolvedTgrT172826 Tool "remarkup2wikitext" loads assets from code.jquery.com and Google Analytics
 ResolvedBenjavaleroT172827 Tool "replacer" loads bootstrap from bootstrapcdn
 ResolvedRicordisamoaT172828 Tool "ricordisamoa" loads fork-me-on-github ribbon from Amazon AWS
 ResolvedFramawikiT172830 Tool "seealsology" loads Google Analytics
 OpenNoneT172831 Tool "shuaib" loads assets from d.moviemodeapp.com
 ResolvedMmarxT172833 Tool "sqid" loads assets from bootstrapcdn, fonts.googleapis.com, and code.jquery.com
 Resolved• PrtksxnaT172834 Tool "styleguide" redirects to GitHub without consent
 ResolvedArlolraT172962 Tool "suggestor" loads botstrap from bootstrapcdn
 ResolvedFastilyT172963 Tool "text2hash" loads assets from bootstrapcdn, unpkg.com, and google
 ResolvedSuperHamsterT172964 Tool "traffic-grapher" loads jquery from code.jquery.com
 ResolvedFramawikiT172965 Tool "translate" loads bootstrap from bootstrapcdn
 ResolvedIjonT172966 Tool "videotutorials" loads buttons from i.creativecommons.org, w3.org, and licensebuttons.net
 ResolvedSmalyshevT172967 Tool "wdq2sparql" loads fork-me-on-github ribbon from github
 ResolvedFnielsenT172968 Tool "wembedder" loads jquery from cloudflare
 ResolvedFramawikiT172969 Tool "wikidata-nolabels" loads jquery and bootstrap from code.jquery.com and bootstrapcdn
 OpenNoneT172970 Tool "wikidata-primary-sources" loads assets from online.swagger.io
 OpenNoneT172971 Tool "wikidata-slicer" loads fonts from google
 ResolvedcdriniT172972 Tool "wikidata-timeline" loads Google Analytics
 ResolvedTarrowT173063 Tool "wikifactmine-api" loads assets from swagger.io
 ResolvedDB111T173064 Tool "wikimap" loads Google Maps
 ResolvedRicordisamoaT173065 Tool "wikinity" loads assets from bootstrapcdn and ajax.googleapis.com
 OpenNoneT173066 Tool "wikistats" loads assets from Amazon AWS
 ResolvedxSavitarT173067 Tool "wikipedia-fetch-content" loads jquery and bootstrap from code.jquery.com and bootstrapcdn
 OpenNoneT173068 Tool "wikitrends" loads cc-by buttons from creativecommons and licensebuttons.net
 OpenNoneT173069 Tool "wikiviz" loads assets from google, cloudflare, and bootstrapcdn, mixed http/https
 OpenNoneT173071 Tool "wikiwatchdog" loads assets from many sites, mixed http/https
 ResolvedRLutsT173072 Tool "wle" loads jquery from code.jquery.com
 ResolvedEmijrpT173073 Tool "wlm-maps" loads tiles from OSM
 ResolvedSamwilsonT173074 Tool "wscontest" loads fonts from google
 Resolved• jmatazzoniT186247 Hebrew Wikivoyage (via Tool "wikivoyage") loads assets by default from third-party sites
 ResolvedSamwalton9-WMFT189426 hashtags tool uses makes browser communicate with google apis and goodle drive without notice
 ResolveddbarrattT189759 InteractionTimeline loads fonts from Google font CDN
 ResolvedLegoktmT190246 "list" tool loads jQuery from code.jquery.com
 ResolvedHuskyT190514 Tool Hay's street wiki loads resources from google maps
 ResolvedMagnusT190516 Wikidata-todo loads map tiles from OSM
 ResolvedKolossosT190519 query2map uses map tiles from OSM
 ResolvedLokal_ProfilT190520 mapillary-commons/wlm-maps loads map tiles from OSM
 OpenNoneT190522 Look and Listen map uses map tiles from OSM
 ResolvedFramawikiT190646 Send a mail to tool owners to notify them of the situation
 ResolvedsamuelgueboT188765 awmd-stats tool loading assets from 3rd party sites
 ResolvedRagesossT210946 outreachdashboard.wmflabs.org violates Labs ToS
 OpenNoneT227277 shex-simple tool loads various 3rd party resource
 ResolvedRammanojpotlaT231312 WikiContrib violates user privacy by loading third party content from Google
 ResolvedRagesossT241512 outreachdashboard.wmflabs.org violates Labs ToS by loading Vega from cdnjs.cloudflare.com
 OpenNoneT242668 Tool "blockyquery" loads resources from cloudflare and jquery.com
 ResolvedthciprianiT242921 Tool "timerelengteam" loads resources from googleapis and cloudflare
 ResolvedsrishakatuxT245775 Tool "toolforge-gallery" loads resources from googleapis and fontawesome
 ResolvedPremeditatedT250922 MoeData causes visiting browser to load data from 3rd party sites
 ResolvedWMDE-leszekT252484 wdqs-wmil-tutorial tool causes visiting browser to load data from 3rd party sites
 OpenNoneT258232 fontcdn.toolforge.org loads assets for detail views directly from google
 ResolvedDaniloT269632 Abuse Filter Graphs on ptwikis.toolforge.org loads jquery from external website
 ResolvedDineshkarthikT271872 wiki-user-contributions tool causes visiting browser to load data from 3rd party sites
 Resolvedsimon04T312048 Tool "unpkg" loads assets from Google
 OpenNoneT321712 wikilovesbrasil.toolforge.org loads third-party content
 ResolvedEderportoT333889 Povo Conta Tool Loads An External Resource
 OpenNoneT333894 wmtran Tool Loads External Resource
 OpenNoneT334317 jitrixis Tool Loads External Resource
 OpenNoneT337205 GraphQL tool uses external CDNs
OpenNoneT348445 enkore.toolforge.org violates Privacy Policy by loading third-party resources
 OpenEugene233T324103 ISA tool uses third party cdn
 OpenNoneT354488 'request' Toolforge tool uses Cloudflare CDN

Event Timeline

Framawiki created this task.Dec 2 2018, 3:35 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 2 2018, 3:35 PM
Aklapper added a parent task: T172065: Hunt for Toolforge tools that load resources from third party sites.Dec 2 2018, 3:36 PM
Framawiki added a parent task: T133919: [EPIC] Protect end-user privacy by restricting non-consensual third-party browser interactions.Dec 2 2018, 3:37 PM
Aklapper edited projects, added Education-Program-Dashboard; removed Community-Tech, Event Metrics.Dec 2 2018, 3:37 PM
Restricted Application added a subscriber: Base. · View Herald TranscriptDec 2 2018, 3:37 PM
Krenair added projects: Privacy, WMF-Legal, cloud-services-team.Dec 2 2018, 3:50 PM
Aklapper removed projects: cloud-services-team, WMF-Legal.Dec 2 2018, 4:05 PM
Aklapper added a subscriber: Krenair.

@Krenair: I don't see why this should be tagged WMF-Legal or cloud-services-team. It's up to maintainers of that instance and the Toolforge-standards-committee which are already on the parent task of https://phabricator.wikimedia.org/maniphest/?parentIDs=172065 .

Krenair added projects: cloud-services-team, WMF-Legal.EditedDec 2 2018, 4:08 PM

As far as I know Toolforge-standards-committee is unrelated, this is not tools.wmflabs.org. Seeing as this task is asserting that a project is violating the WMCS ToU, cloud-services-team and WMF-Legal are definitely relevant.

Ragesoss subscribed.Dec 3 2018, 5:20 PM
Ragesoss added a comment.Dec 3 2018, 8:33 PM

Thanks for identifying these problems!

I've got a set of patches in progress that should get rid of all these cases of loading assets from 3rd parties: https://github.com/WikiEducationFoundation/WikiEduDashboard/pull/2271

I'm hoping to deploy it later today.

Ragesoss added a comment.Dec 3 2018, 9:04 PM

I've deployed those changes, and I think it takes care of all those cases.

Aklapper closed this task as Resolved.Dec 6 2018, 11:24 AM
Aklapper assigned this task to Ragesoss.

Yes, this all looks good to me. Thanks for the quick reply and action!

sbassett triaged this task as Medium priority.Oct 16 2019, 4:38 PM
sbassett moved this task from Intake to Done on the Privacy board.
Aklapper mentioned this in T241512: outreachdashboard.wmflabs.org violates Labs ToS by loading Vega from cdnjs.cloudflare.com.Dec 28 2019, 3:23 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL