We imported the File Upload Wizard from English Wikipedia ([[:en:Wikipedia:File_Upload_Wizard]]) to Chinese Wikipedia ([[:zh:Wikipedia:上传/new]]).
It almost works but as the X-Frame-Options on zhwiki is set to DENY, the tool cannot get document from IFrame. Thus the upload result cannot be shown to the user. Maybe the value should be set SAMEORIGIN to fix this problem.
The bug was originally reported on village pump on zhwiki ([[:zh:Special:Diff/45718401]]) by Vozhuo.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Set X-Frame-Options: SAMEORIGIN if UploadWizard enabled | operations/mediawiki-config | master | +1 -0 |
Hi @Alexander_Misel, thanks for taking the time to report this!
Looking at https://noc.wikimedia.org/conf/InitialiseSettings.php.txt I see the lines
'wgApiFrameOptions' => [ 'default' => 'DENY', 'enwiki' => 'SAMEORIGIN', // T41877 ],
which might be the reason why this works on en.wp but not zh.wp?
(If you'd like to prepare a patch to change mediawiki-config/wmf-config/InitialiseSettings.php , you are very welcome to use developer access to submit the proposed code changes as a Git branch directly into Gerrit. If you don't want to set up Git/Gerrit, you can also use the Gerrit Patch Uploader.)
Change 372789 had a related patch set uploaded (by Gerrit Patch Uploader; owner: Alexander Misel):
[operations/mediawiki-config@master] Set X-Frame-Options: SAMEORIGIN if UploadWizard enabled
@Aklapper I uploaded using diff tool and Gerrit Patch Uploader on https://gerrit.wikimedia.org/r/#/c/372789/. I'm not sure if I committed correctly.
Yes, it is correct! Assigning it to you then. There is one additional step needed! You must add it to one of SWAT windows (https://wikitech.wikimedia.org/wiki/Deployment) in order to get it merged and deployed. Then you need to be present in #wikimedia-operations during the SWAT time to test the patch and answer any questions. I can do it for you if you wish.
Change 372789 merged by Zfilipin:
[operations/mediawiki-config@master] Set X-Frame-Options: SAMEORIGIN if UploadWizard enabled
Mentioned in SAL (#wikimedia-operations) [2017-08-21T13:46:29Z] <zfilipin@tin> Synchronized wmf-config/InitialiseSettings.php: SWAT: [[gerrit:372789|Set X-Frame-Options: SAMEORIGIN if UploadWizard enabled (T173631)]] (duration: 00m 44s)
Deployed. Please do check if it works as expected and if you'll find any errors, please reopen&comment (by changing its status). Thank you!