It is a very strong security risk: anyone who compromised any active account in this wiki may insert arbitary HTML, which may be loaded by everyone visiting the site. Raw HTML are mainly used in many outdated and historical pages, many may be migrated to non-raw HTML (e.g. wiki syntax and TemplateStyles), and I don't think it is essential for this wiki as it is not a public portal for Wikimedia Foundation anymore.
Once it is done the wiki may possibly be made open.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| [GovernanceWiki] Disable wgRawHTML, no longer needed | operations/mediawiki-config | master | +0 -1 |
anyone who compromised any active account in this wiki may insert arbitary HTML
How and why is that a different behavior than any other wiki site, and with which wiki site do you compare?
Raw HTML are mainly used in many outdated and historical pages
Could you please link to a specific example page on that wiki which uses "raw html"?
For the records, https://foundation.wikimedia.org/wiki/Special:Statistics lists about ~1000 users.
Ah, thanks, so this is about $wgRawHtml and changing it in https://noc.wikimedia.org/conf/InitialiseSettings.php.txt
Just saying i agree 100% with this task. If fundraising/whoever else no longer needs it we would strongly like to get raw html disabled. Especially now that it under wikimedia.org
Just a quick update that a vast majority of these pages have been cleaned up or removed in preparation for disabling this. I believe there are just 3 reports left - which @Jseddon is working on migrating (sans-HTML) to Meta-Wiki. :)
Ok, the rest are done, https://foundation.wikimedia.org/w/index.php?search=insource%2F%5C%3Chtml%5C%3E%2F&title=Special%3ASearch&profile=all&fulltext=1 is empty - Lets kill raw html :D :D
Change 462834 had a related patch set uploaded (by Jforrester; owner: Jforrester):
[operations/mediawiki-config@master] [GovernanceWiki] Disable wgRawHTML, no longer needed
Change 462834 merged by jenkins-bot:
[operations/mediawiki-config@master] [GovernanceWiki] Disable wgRawHTML, no longer needed
Mentioned in SAL (#wikimedia-operations) [2018-11-07T18:51:34Z] <jforrester@deploy1001> Synchronized wmf-config/InitialiseSettings.php: T201285: Disable wgRawHTML on Governance wiki (duration: 05m 12s)