Page MenuHomePhabricator

New informational security message for user .js pages
Closed, DuplicatePublicFeature

Description

Author: rockmfr

Description:
There should be a system message that is displayed on the top of the page for user .js (and possibly .css) pages when both viewing the page and when editing.

Security is the prime motivation for this enhancement. Right now, there are a number of system messages that can be used to inform users that they may be screwing themselves by editing a page (clearyourcache, usercssjsyoucanpreview, and userinvalidcssjstitle are the ones I know of), but it would be better to have a single centralized system message for security-related information. The purpose of this new system message would be to inform users that any code they preview or save can have negative consequences.

It is possible to include such a message in the current system messages, but it is both a pain in the ass to target to the correct pages and not the purpose of these system messages. This current situation is fine for enwiki, but other wikis would certainly benefit from a centralized message.


Version: unspecified
Severity: enhancement

Details

Reference
bz14534

Event Timeline

bzimport raised the priority of this task from to Low.Nov 21 2014, 10:09 PM
bzimport set Reference to bz14534.
bzimport added a subscriber: Unknown Object (MLST).

Component: Unknown -> User interface

alexsm333 wrote:

The enwiki is NOT fine, because I see this useless warning on other users .js pages, which I cannot edit anyway. The proposed new message is not going to fix this annoyance unless it's shown only for the page owner.

sbassett subscribed.

The Security-Team discussed this during our clinic today. We don't really have a problem with this, conceptually, if it gains further support. We do not feel that it is a critical issue though and do not have the resources to work on implementation any time soon.

Aklapper changed the subtype of this task from "Task" to "Feature Request".Feb 4 2022, 11:01 AM