While the likelihood of abuse is low here, certain Gadgets or even site-wide JS on some projects is not watched closely (or it imports obscure subpages, etc.).
Pages like Special:UserRights, Special:UserLogin, Special:ChangePassword should not import JavaScript to avoid potential abuse.
Version: unspecified
Severity: enhancement
I'll take a look at this. Should be able to do something like we did with Special:UserLogin (cf bug 10005)
herd wrote:
ChangePass and UserLogin make perfect sense to disable gadgets on. UserRights does not. Lemme splain:
If you have compromised someone's javascript, you can simply send an ajax request to Special:UserRights, scrape the form, get the token, and submit it it back. Same for most other Special pages.
You can't do this for ChangePass, because it requires them to enter their password. Same for UserLogin.
Site JS should be trusted enough to load on all pages (except maybe UserLogin).
Suggest WONTFIX for UserRights (some people automate the process, especially on Meta) and Site JS suggestions, and dupe to bug 18186 for the Gadgets (both CSS and JS, CSS can execute javascript in some browsers!) disabling on ChangePass/etc.
No reason to disable for user rights, per comment #2.
Closing as FIXED: Userlogin, Resetpass, Preferences all have user JS disabled.