Pulling in non-WMF hosted content to a WMF-hosted site is an absolute no legally, isn't it?

per T107085, legal seems to be ok to allow non-WMF data as long as there is a clear indication that this data is coming from an external site, proper warnings, and that the action was initiated by the user. This is what WikiVoyage has had for the past two years with the WMF-labs created workaround. See example.
BTW, the workaround itself is not compliant with the privacy statement, hence we are working on migrating WV to <mapframe>/<maplink> solution.

That sounds like they are ok the short term fix. That's different to enabling such violations with new features.

@Esanders, true, its a gray area - should the community allow users to choose what map they want to see without leaving the site? How is this different from clicking an external link? How about using a widget hosted on wmflabs? Basically the only difference between "default view" and inclusion of external content is the consent of the reader - if they are ok to expose their browsing behavior to the 3rd party, should they be allowed to do it? Especially if the community also wants to provide this functionality?

We could improve the library, to basically intercept the selection of the different layer, and allow us to throw an oojs alert with a disclaimer to the user, before the actual selection is set. ?

Proposed by @TheDJ in the discussion. Moved here to reduce the page size of the discussion.

Yurik we could have a mw.hook, fired when we configure our leaflet views, that a MediaWiki:common.js page could use to add their own layers during the configuration phase. It could then do:

mw.hook( 'wikipage.maps').add( function( map ) {
  var basemaps = [];
  basemaps[L._('Wikimedia') + ' <img src="./lib/images/wmf-logo-12.png" />'] = wikimedia;
  basemaps[L._('Mapnik') + ' <img src="./lib/images/external.png" />'] = mapnik;  
  basemaps[L._('Mapquest_open') + ' <img src="./lib/images/external.png" />'] = mapquestopen;
  basemaps[L._('Mapquest_aerial') + ' <img src="./lib/images/external.png" />'] = mapquest;
  basemaps[L._('Relief_map') + ' <img src="./lib/images/external.png" />'] = landscape;
  
  var overlays = [];  
  overlays[L._('Traffic_line_network') + ' <img src="./lib/images/external.png" />'] = traffic;
  overlays[L._('Mapquest_labels') + ' <img src="./lib/images/external.png" />'] = maplabels;
  overlays[L._('Boundaries') + ' <img src="./lib/images/external.png" />'] = boundaries;
  overlays[L._('Hill_shading') + ' <img src="./lib/images/external.png" />'] = hill;
  overlays[L._('Cycling') + ' <img src="./lib/images/external.png" />'] = cycling;
  overlays[L._('Hiking') + ' <img src="./lib/images/external.png" />'] = hiking;
  overlays[L._('Points_of_interest') + ' <img src="./lib/images/wv-logo-12.png" />'] = markers;
  overlays[L._('Destinations') + ' <img src="./lib/images/wv-logo-12.png" />'] = wvarticles;
  overlays[L._('GPX_tracks_Map_mask') + ' <img src="./lib/images/wv-logo-12.png" />'] = tracks;
  
  map.addControl(new L.Control.Layers(basemaps, overlays));
} );

In T129355#2103679, @Yurik wrote:

Especially if the community also wants to provide this functionality?

The only consideration is our privacy policy. The desires of a tiny community do not change that; they are what got us into this mess in the first place.

In T129355#2117494, @Esanders wrote:

In T129355#2103679, @Yurik wrote:

Especially if the community also wants to provide this functionality?

The only consideration is our privacy policy. The desires of a tiny community do not change that; they are what got us into this mess in the first place.

We could improve the library, to basically intercept the selection of the different layer, and allow us to throw an oojs alert with a disclaimer to the user, before the actual selection is set. ?

I'm all for allowing per-wiki customizations, as long as we make sure users know that they are downloading data from an external site. Also, for usability, if we do a popup, users should be able to never see that popup again.

I'd like to note that allowing access to third-party map tiles should also have the consent of the third party. Usually requests like this is meant to add the OpenStreetMap Standard map style, but OSM explicitly forbids heavy usage of this map layer due to limited resources. I guess this might be OK for Wikivoyage, but I expect this will not be allowed for Wikipedia due to the heavy traffic involved. Remember that one of the reasons why WMF is rolling out its Maps service is to remove the burden of the heavy use of OSM's map tiles.

Exactly - this is just formalising yet another WikiVoyage hack into extension code that we can't use anywhere else. It would be a total waste of our time.

Change 281168 had a related patch set uploaded (by JGirault):
Add wikipage.maps JS hook to allow community to customize map.

https://gerrit.wikimedia.org/r/281168

Change 281168 merged by jenkins-bot:
Add wikipage.maps JS hook to allow community to customize map.

https://gerrit.wikimedia.org/r/281168

Clarification: the purpose of this task, just like the purpose of adding CSS classes, is to give community the opportunity to customize the behavior of the wiki. This means that any developer may add their own customizations to the map for their own account. The community as a whole may decide to alter the default behavior of the map, assuming it follows the rules of privacy/copyrights/etc. Community can already do all this by simply adding an iframe to any page via common.js, pointing to external content, introduce XSS, etc etc. Yet, communities are not doing it because of these rules, so we shouldn't assume the community will do it the moment they have this popup. At the same time, we should work with the community to ensure that customizations do not violate anything by accident.