Page MenuHomePhabricator

User preference to disable frame-breakout code
Closed, DeclinedPublic

Description

Author: marco

Description:
Current, the iframe protection is not overridable.
Can it be changed in a way that it can be disabled for a specific user via
monobook.js via including...let's say a variable "var
disable_iframe_protection=true;"?

Regards,
Marco


Version: unspecified
Severity: enhancement

Details

Reference
bz8175

Event Timeline

bzimport raised the priority of this task from to Lowest.Nov 21 2014, 9:32 PM
bzimport set Reference to bz8175.
bzimport added a subscriber: Unknown Object (MLST).

This would I think require moving the frame breakout to run later, say after
body load rather than during the script.

marco wrote:

I heard it is located in wikibits.js. Why not just move the wikibits.js
inclusion after user/monobook.js inclusion?

Then things run from monobook.js would not work due to uninitialized variables
and missing functions.

marco wrote:

Why not create a JS called "frame.js" and including only this after monobook?

marco wrote:

Patch to do it.

Added skins/common/frame.js
Changed skins/MonoBook.php and skins/common/wikibits.js

attachment patch_8175.txt ignored as obsolete

robchur wrote:

  1. "Cutted out" isn't proper English; if you're going to comment there, or

anywhere else, do it properly. I don't personally think you *need* those comments.

  1. You need to include frame.js in more skins than just Monobook.

marco wrote:

(In reply to comment #6)

  1. "Cutted out" isn't proper English; if you're going to comment there, or

anywhere else, do it properly. I don't personally think you *need* those comments.

OK.

  1. You need to include frame.js in more skins than just Monobook.

*doing*

marco wrote:

nowhere else located

grep doesn't find any inclusion of wikibits.js in whole skin directory

Attached:

marco wrote:

New version

attachment patch_8175.txt ignored as obsolete

marco wrote:

full patch

Now really all I could find is replaced.

Attached:

ayg wrote:

Non-Monobook skins use the reference in includes\Skin.php.

Avoid adding another file; that means yet another
HTTP hit on first page view, slowing down the
user experience.

There's already a system in place to add functions
to run on body load, better to hook into that.

marco wrote:

As I can see, a user (a normal wikipedia user) can't decide if he can put off
the frame protection for himself only. This is very useful for things like the
Interwiki-Linkchecker and browser-based anti vandal tools which display diffs in
framesets.

rotemliss wrote:

(In reply to comment #14)

As I can see, a user (a normal wikipedia user) can't decide if he can put off
the frame protection for himself only. This is very useful for things like the
Interwiki-Linkchecker and browser-based anti vandal tools which display diffs in
framesets.

Please open another bug. This bug is fixed.

rotemliss wrote:

I probably didn't read properly. The fix was about an option on
LocalSettings.php; this bug is about a user preference. Reopening for now.

robchur wrote:

Changed summary, though I'm not sure we really want this at a user level.

robchur wrote:

There's now a site-wide configuration option, $wgBreakFrames, which I think is much more useful than having this kind of thing selectable at a user preference level, since "frame breaking" is intended to combat hotlinking, which registered users aren't likely to do.