By the way, you can configure the upload dialog in VE to upload to the shared wiki: https://www.mediawiki.org/wiki/Upload_dialog#Configuration_(for_wiki_sysadmins)

(at least theoretically… this works on Wikimedia wikis, but I don't know if it has been battle-tested on various different weird setups that are possible for shared uploads)

Thanks, I was able to get the wikicode to show up by following the restrictions you posted.

Regarding the upload dialog configuration, I followed the directions and I'm unfortunately getting the following error:

Failed to load the configuration for file uploads to the foreign file repository.

Upon inspection, it appears that two of the API queries are getting rejected by MediaWiki because they specify an origin parameter but without setting an Origin header. As specified in the API documentation, they have to be the same or else a 403 response will be returned.

I'll keep digging and if I don't find anything I'll create a new ticket since this is unrelated to the wikicode issue.

Well it seems that the Origin header is automatically added by the browser unless it's a same-origin request. Since my wikis are all on the same domain, it doesn't get sent, hence the error.

I'll see if I can find a way to disable the origin parameter then.

The origin parameter is automatically added by ForeignApi. I disabled this by commenting out line 63 in ForeignApi.js and this fixes the offending calls (meta=userinfo&uiprop=groups%7Crights and meta=siteinfo&siprop=uploaddialog) but it then breaks a subsequent call that for some reason does include the Origin header.

Before I create a ticket, is it more of a MW core or VE issue? It looks like it's a case of VE using ForeignApi when it should just be using api, but maybe it's more complicated than this?

@Ascotmonth Neat, thanks for debugging that.

It's probably possible to fix this this either in VE or in MW, but I think it's a MW core issue: ForeignApi is written with the assumption that the other wiki is on a different domain, but as you point out, it can also be on the same domain, only under a different path. In my opinion ForeignApi should be able to handle that (by just skipping all the 'origin' business).

Makes sense, after all API is just for the local API right?

For the record, here's the ticket: https://phabricator.wikimedia.org/T208601