Page MenuHomePhabricator

Security review for FileExporter extension
Closed, ResolvedPublic

Description

Project Information

Description of the tool/project

A simple extension to provide a link on File pages which will redirect the user to page provided by the FileImporter extension on Wikimedia Commons.

Description of how the tool will be used at WMF

If will be installed on all wikis (except for commons).

Dependencies

  • This also depends on the development of the FileImporter extension

Has this project been reviewed before?

Only review inside the WMDE-TechWish team.

Working test environment

  • None setup on labs, but the extension is easy to install (see instructions on mw.org)
  • After enabling the extension, navigate to a file page and see the new link in the top bar

Post-deployment

WMDE-TechWish

Event Timeline

Code is fine security wise. Literally nothing to it.

Minor non security issues:

  • i18n/en.json should be tab indented
  • extension.json should be tab indented
  • Readme.md is empty, should at least have a basic description (possibly after T158072 ?)
  • Add COPYING or similar licence file to root

Change 341537 had a related patch set uploaded (by addshore):
[mediawiki/extensions/FileExporter] Add COPYING file

https://gerrit.wikimedia.org/r/341537

Change 341538 had a related patch set uploaded (by addshore):
[mediawiki/extensions/FileExporter] TAB indents in .json files

https://gerrit.wikimedia.org/r/341538

Change 341537 merged by jenkins-bot:
[mediawiki/extensions/FileExporter] Add COPYING file

https://gerrit.wikimedia.org/r/341537

Change 341539 had a related patch set uploaded (by addshore):
[mediawiki/extensions/FileExporter] Add basic README file

https://gerrit.wikimedia.org/r/341539

Patches uploaded for the comments from the review.

Change 341538 merged by jenkins-bot:
[mediawiki/extensions/FileExporter] TAB indents in .json files

https://gerrit.wikimedia.org/r/341538

Reedy claimed this task.

Change 341539 merged by jenkins-bot:
[mediawiki/extensions/FileExporter] Add basic README file

https://gerrit.wikimedia.org/r/341539

I should note...

We had an extension like this for the WikimediaShopLink, and we eventually just swapped it for a hook in CommonSettings and messages in WikimediaMessages

https://github.com/wikimedia/mediawiki-extensions-WikimediaShopLink/commit/a8cfbfce9eee3fef6c1bec3635d0e5e2e415745a

It's possible the functionality of this might expand slightly over the coming year, hence the extension.
Permission checks & other possible checks with the FileImporter extension.