Users should be warned againts putting arbitrary code to personal scripts
Closed, ResolvedPublic
Actions

Description

When you attempt to edit eg. your own /common.js, you will see:

Please note: JavaScript subpages should not contain confidential data as they are viewable by other users.

I think this should be extended to warn against putting a code that for instance comes from another users' subpage.

	Subject	Repo	Branch	Lines +/-
	Inform users about common.js's power	mediawiki/core	master	+6 -0

Mentioned Here: T60291: load.php should check read permissions on private wikis (exposes content of wiki pages part of a module)

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 1 2018, 7:35 AM

That's userjsispublic (and usercssispublic/userjsonispublic), FWIW.

See also T60291.

...and T186391.

@Tgr: Both tasks are restricted for me. Feel free to close this task if it's redundant.

• chasemp triaged this task as Medium priority.Dec 9 2019, 4:53 PM

Change 572415 had a related patch set uploaded (by Urbanecm; owner: Urbanecm):
[mediawiki/core@master] Inform users about common.js's power

Change 572415 merged by jenkins-bot:
[mediawiki/core@master] Inform users about common.js's power

Urbanecm closed this task as Resolved.Feb 19 2020, 6:57 PM

Thank you.