This code:
https://gerrit.wikimedia.org/r/#/c/254168/
has been uploaded for the upcoming "15 years Wikipedia" event combined with annual report 2015 for T599.
Requestor is the communications team and the uploader/developers are from muledesign.com.
Please see the .js part of that change and note that it has been requested to run on 15.wikipedia.org in the wikipedia domain.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Dzahn | T599 add 15.wikipedia.org / annual report 2015 | |||
| Resolved | Dzahn | T119478 security review 15.wikipedia/annual2015 code review |
First thing I noticed was a file called google-chart.js that calls out to Google from wikipedia.org.
https://gerrit.wikimedia.org/r/#/c/254614/1 says WIP, is this really ready for a security review?
I think we can't have it both ways and ask for a review before anything is merged but also expect it to be ready in first commit and that development is happening in incremental steps in public.
I've just submitted a Patch that include a license. Also, we are no longer using google-chart.js, so the call offsite will no longer be an issue. Thanks!
@csteipp Steph has uploaded https://gerrit.wikimedia.org/r/#/c/262586/ as the final commit. Could you review that please? thank you
@csteipp correction, Steph uploaded a new version here https://gerrit.wikimedia.org/r/#/c/262679/ that should contain all files
@Dzahn, the twitter urls there point to http://15.wikipedia.org. Do we have https on that domain?
From https://gerrit.wikimedia.org/r/#/c/262679/, I think 1 thing is needed before it's deployed:
And not security, but masonry.js, chart.js, and bodymovin.js all look like MIT licensed libraries, but their license comments are missing. Someone should check with legal to make sure that's appropriate.
And not security, but masonry.js, chart.js, and bodymovin.js all look like MIT licensed libraries, but their license comments are missing. Someone should check with legal to make sure that's appropriate.
Maybe @Slaporte?