Disable raw HTML in https://foundation.wikimedia.org/
Closed, ResolvedPublic

Description

It is a very strong security risk: anyone who compromised any active account in this wiki may insert arbitary HTML, which may be loaded by everyone visiting the site. Raw HTML are mainly used in many outdated and historical pages, many may be migrated to non-raw HTML (e.g. wiki syntax and TemplateStyles), and I don't think it is essential for this wiki as it is not a public portal for Wikimedia Foundation anymore.

Once it is done the wiki may possibly be made open.

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 6 2018, 6:45 AM
Bugreporter updated the task description. (Show Details)Aug 6 2018, 6:52 AM

anyone who compromised any active account in this wiki may insert arbitary HTML

How and why is that a different behavior than any other wiki site, and with which wiki site do you compare?

Raw HTML are mainly used in many outdated and historical pages

Could you please link to a specific example page on that wiki which uses "raw html"?

For the records, https://foundation.wikimedia.org/wiki/Special:Statistics lists about ~1000 users.

Varnent added a subscriber: Seddon.Aug 6 2018, 5:08 PM

Just saying i agree 100% with this task. If fundraising/whoever else no longer needs it we would strongly like to get raw html disabled. Especially now that it under wikimedia.org

Varnent added a subscriber: Varnent.EditedSep 25 2018, 7:53 PM

Just a quick update that a vast majority of these pages have been cleaned up or removed in preparation for disabling this. I believe there are just 3 reports left - which @Jseddon is working on migrating (sans-HTML) to Meta-Wiki. :)

Change 462834 had a related patch set uploaded (by Jforrester; owner: Jforrester):
[operations/mediawiki-config@master] [GovernanceWiki] Disable wgRawHTML, no longer needed

https://gerrit.wikimedia.org/r/462834

Varnent triaged this task as High priority.Oct 19 2018, 5:46 PM
Restricted Application added a subscriber: Dereckson. · View Herald TranscriptOct 19 2018, 5:46 PM

Change 462834 merged by jenkins-bot:
[operations/mediawiki-config@master] [GovernanceWiki] Disable wgRawHTML, no longer needed

https://gerrit.wikimedia.org/r/462834

Mentioned in SAL (#wikimedia-operations) [2018-11-07T18:51:34Z] <jforrester@deploy1001> Synchronized wmf-config/InitialiseSettings.php: T201285: Disable wgRawHTML on Governance wiki (duration: 05m 12s)

Jdforrester-WMF closed this task as Resolved.Nov 7 2018, 6:51 PM
Jdforrester-WMF removed a project: Patch-For-Review.

Done.