@Sophivorus, @Dereckson, is this security review still needed?

If so, please update the description of this ticket and add the information requested at https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Security_reviews#Requesting_a_review.

I've asked in T149766 to @Sophivorus if they're happy with the code refactoring/fixes. In January, at the same task, @Sophivorus feedback was progress was made, two wikis would like it, a security review would be useful.

@dpatrick So yes, it's still needed:

In T149766#3119098, @Dereckson wrote:

@Sophivorus Are you confident you've addressed Legoktm concerns of robustness?

In T149766#3128431, @Sophivorus wrote:

@Dereckson Absolutely, I just double-checked everything.

Anyone remembers this task? The extension would still be useful at the English and Spanish Wikiversity.

In T149424#3413685, @Sophivorus wrote:

Anyone remembers this task? The extension would still be useful at the English and Spanish Wikiversity.

I don't know how many time lasts a security review, but 4 months have since passed.

Will this ever happen? Is there anything blocking it?

I'm curious if this would be better served by $wgEnableScaryTranscluding ?

It's been more than a year already...

I've just done a bit more cleanup in https://gerrit.wikimedia.org/r/#/c/393427/ - parse_url is seemingly noisy, so could potentially have resulted in log noise, error suppression added.

I'm really not a fan of the way everything is just stuck into static member variables, and nearly everything uses them. Or, in some cases, like $parser, it's only used in one place

The extension probably needs a README or similar in the extension, to include some of the stuff on https://www.mediawiki.org/wiki/Extension:WikipediaExtracts

I've added a vagrant role in https://gerrit.wikimedia.org/r/393431 so I can test it a bit more easily..

@Reedy Thanks for your review. Most static variables are gone, just one is left for convenience. Could you confirm for security please? Thanks!

Please. We could really use this feature at Wikiversity.

@Reedy / @Bawolff: Is this still "in progress"?

@Sophivorus To give further context, to move this forwards, this really needs a champion with deploy access to push it forward. @greg can help you in determining what other requirements beyond security review are needed in order to get this deployed.

In T149424#4860374, @Bawolff wrote:

determining what other requirements beyond security review are needed in order to get this deployed.

See documentation on https://www.mediawiki.org/wiki/Review_queue