Page MenuHomePhabricator

[Citation Bot] Tracking: Convert Citation bot's gadget feature to work via API rather than click-jacking [AOI]
Closed, ResolvedPublic

Description

Change how https://en.wikipedia.org/wiki/MediaWiki:Gadget-citations.js works so that it makes an API request to the Tool Labs code rather than using a click-jacking hack.

Component tasks:

  • Change the gadget code so it makes some sort of API request (possibly XHR, but that may run into same-origin problems). The gadget should submit either the article text or article title (as is done with doibot.html) and should get back the updated wikitext of the article. It should then load an edit window with the resulting edit summary and page text. This should be relatively easy for someone who's good with onwiki JS, but probably considerably harder for someone who's learning.
  • Change the backend code so that there is an appropriate web API to contact. It's probably best to write a new script to handle this; doibot.php is close in functionality and is a sort of API, but the script is mixed up with the page output and won't be easy to add to. The basic logic of this should be easy, while the surrounding code to set this up may be a bit trickier.

Acceptance criteria: same functionality (click the Citations button, get a diff-style edit window containing the expanded article), but now works with NoScript or a similar XSS-blocker enabled.

This will be a very good task to pair on, especially for the front-end portions. @Fhocutt knows how Citation bot goes together, while @kaldari and @NiharikaKohli have more JS and gadget experience.

Event Timeline

kaldari raised the priority of this task from to Needs Triage.
kaldari updated the task description. (Show Details)
kaldari added a project: Community-Tech.
kaldari subscribed.
kaldari added a subscriber: Fhocutt.

@Fhocutt: Could you provide a slightly more fleshed-out description for this task and also give us a rough estimate of how much work would be involved so that we can decide if it's worth moving into the sprint?

kaldari renamed this task from Convert Citation bot's gadget feature to work via API rather than click-jacking to [AOI][Citation Bot] Convert Citation bot's gadget feature to work via API rather than click-jacking.Oct 16 2015, 5:40 AM
kaldari set Security to None.

If there are same-origin problems, you should be able to work around them by using JSONP, which is supported by $.ajax().

Assessment for prioritization:
Support: Low/Medium (no one has asked for this explicitly, but improving Citation bot was asked for in the AOI survey)
Feasibility: Medium/Difficult (not trivial to implement, may require reorganizing some of the existing code, may have to work around same-origin restriction)
Impact: Low (mostly works for now, but this will make it work in more browsers and be more future-proof, enwiki only)
Risk: Medium (requires a fair bit of refactoring which could break things or require more work than expected)

Priority: Low

kaldari renamed this task from [AOI][Citation Bot] Convert Citation bot's gadget feature to work via API rather than click-jacking to [AOI][Citation Bot] Tracking: Convert Citation bot's gadget feature to work via API rather than click-jacking.Oct 27 2015, 5:36 PM
kaldari removed a project: Community-Tech-Sprint.
DannyH renamed this task from [AOI][Citation Bot] Tracking: Convert Citation bot's gadget feature to work via API rather than click-jacking to CB5. [AOI][Citation Bot] Tracking: Convert Citation bot's gadget feature to work via API rather than click-jacking.Oct 27 2015, 5:39 PM
DannyH renamed this task from CB5. [AOI][Citation Bot] Tracking: Convert Citation bot's gadget feature to work via API rather than click-jacking to [Citation Bot] Tracking: Convert Citation bot's gadget feature to work via API rather than click-jacking [AOI].Oct 28 2015, 7:05 PM