Page MenuHomePhabricator
Create Task
Maniphest T240264

Gerrit loads font from fonts.googleapis.com and fonts.gstatic.com
Closed, ResolvedPublic
Actions

Description

May cause privacy issues. See https://gerrit.wikimedia.org/r/plugins/gitiles/+static/base.css

Details

SubjectRepoBranchLines +/-
Update Gerrit to 3.3.9 + pluginsoperations/software/gerritdeploy/wmf/stable-3.3+12 -13
Merge tag 'v3.3.9' into wmf/stable-3.3operations/software/gerritwmf/stable-3.3+6 -12
[WMF] fork gitiles to prevent loading fonts from 3rd partyoperations/software/gerritwmf/stable-3.2+4 -3
Merge 'refs/changes/97/273397/1' into wmf/stable3.2operations/software/gerrit/plugins/gitileswmf/stable-3.2+0 -0
Customize query in gerrit

Related Objects
Search...

Event Timeline

Bugreporter created this task.Dec 9 2019, 8:56 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 9 2019, 8:56 PM
Paladox subscribed.Dec 9 2019, 9:02 PM

Filed upstream https://bugs.chromium.org/p/gerrit/issues/detail?id=12054

Reedy subscribed.Dec 10 2019, 1:31 AM
In T240264#5725695, @Paladox wrote:

Filed upstream https://bugs.chromium.org/p/gerrit/issues/detail?id=12054

Is this not a dupe of {T239122}, or does that bug only cover part of this issue?

Paladox added a comment.Dec 10 2019, 1:33 AM

That bug is for one part, this one is for a plugin.

Reedy added a project: Upstream.Dec 10 2019, 1:36 AM
Aklapper moved this task from Backlog to Reported Upstream on the Upstream board.Dec 10 2019, 5:13 AM
• JFishback_WMF moved this task from Intake to Backlog on the Privacy board.Feb 4 2020, 11:27 PM
Paladox mentioned this in T255977: Gerrit 3.x test instance loads content from third-party website fonts.gstatic.com.Jun 23 2020, 6:08 PM
hashar added a parent task: T268019: Use upstream Gerrit.war instead of building our own.Jan 28 2021, 3:58 PM
hashar moved this task from Reported Upstream to Patch proposed upstream on the Upstream board.Jan 28 2021, 4:03 PM
hashar subscribed.

This got addressed by T255977 QChris has crafted https://gerrit-review.googlesource.com/c/plugins/gitiles/+/273397 which we include in our build but that is pending upstream review/merge/release. Meanwhile we have to carry that patch in a fork of plugins/gitiles

hashar mentioned this in T268019: Use upstream Gerrit.war instead of building our own.Jan 28 2021, 4:04 PM
Aklapper changed the task status from Open to Stalled.Jan 28 2021, 4:13 PM

Setting stalled as there is nothing else we can do on our side

hashar changed the task status from Stalled to Open.May 22 2021, 11:11 AM

Marking as open again since we need to work with upstream to get the patch reviewed and merged there. Meanwhile I am setting up a fork on our Gerrit with the patch applied.

gerritbot added a comment.May 22 2021, 11:11 AM

Change 693553 had a related patch set uploaded (by Hashar; author: Hashar):

[operations/software/gerrit/plugins/gitiles@wmf/stable-3.2] Merge 'refs/changes/97/273397/1' into wmf/stable3.2

https://gerrit.wikimedia.org/r/693553

gerritbot added a project: Patch-For-Review.May 22 2021, 11:11 AM
gerritbot added a comment.Jun 22 2021, 3:06 PM

Change 693553 merged by Hashar:

[operations/software/gerrit/plugins/gitiles@wmf/stable-3.2] Merge 'refs/changes/97/273397/1' into wmf/stable3.2

https://gerrit.wikimedia.org/r/693553

Maintenance_bot removed a project: Patch-For-Review.Jun 22 2021, 3:10 PM
gerritbot added a comment.Jun 22 2021, 3:14 PM

Change 700932 had a related patch set uploaded (by Hashar; author: Hashar):

[operations/software/gerrit@wmf/stable-3.2] [WMF] fork gitiles to prevent loading fonts from 3rd party

https://gerrit.wikimedia.org/r/700932

gerritbot added a project: Patch-For-Review.Jun 22 2021, 3:14 PM
gerritbot added a comment.Jul 13 2021, 7:34 AM

Change 700932 merged by jenkins-bot:

[operations/software/gerrit@wmf/stable-3.2] [WMF] fork gitiles to prevent loading fonts from 3rd party

https://gerrit.wikimedia.org/r/700932

hashar mentioned this in rGERRITDEPLOY4883183ff51a: [WMF] fork gitiles to prevent loading fonts from 3rd party.Jul 13 2021, 7:43 AM
Maintenance_bot removed a project: Patch-For-Review.Jul 13 2021, 8:10 AM
hashar added a subscriber: QChris.Jan 5 2022, 8:15 PM

@QChris upstreamed patch https://gerrit-review.googlesource.com/273397 has been released with Gerrit 3.3.9.

hashar mentioned this in T299451: Upgrade Gerrit from 3.3.6 to 3.3.9.Jan 18 2022, 9:29 PM
gerritbot added a comment.Jan 18 2022, 9:30 PM

Change 755024 had a related patch set uploaded (by Hashar; author: Hashar):

[operations/software/gerrit@wmf/stable-3.3] Merge tag 'v3.3.9' into wmf/stable-3.3

https://gerrit.wikimedia.org/r/755024

gerritbot added a project: Patch-For-Review.Jan 18 2022, 9:30 PM
gerritbot added a comment.Jan 18 2022, 10:12 PM

Change 755028 had a related patch set uploaded (by Hashar; author: Hashar):

[operations/software/gerrit@deploy/wmf/stable-3.3] Update Gerrit to 3.3.9 + plugins

https://gerrit.wikimedia.org/r/755028

hashar added a subtask: T299451: Upgrade Gerrit from 3.3.6 to 3.3.9.Jan 18 2022, 10:14 PM
gerritbot added a comment.Jan 19 2022, 9:28 AM

Change 755024 merged by jenkins-bot:

[operations/software/gerrit@wmf/stable-3.3] Merge tag 'v3.3.9' into wmf/stable-3.3

https://gerrit.wikimedia.org/r/755024

gerritbot added a comment.Jan 19 2022, 9:28 AM

Change 755028 merged by jenkins-bot:

[operations/software/gerrit@deploy/wmf/stable-3.3] Update Gerrit to 3.3.9 + plugins

https://gerrit.wikimedia.org/r/755028

Maintenance_bot removed a project: Patch-For-Review.Jan 19 2022, 10:10 AM
hashar closed this task as Resolved.Jan 19 2022, 1:28 PM
hashar claimed this task.
hashar closed subtask T299451: Upgrade Gerrit from 3.3.6 to 3.3.9 as Resolved.

The patch is now included in the gitiles plugin by upstream. The Gerrit 3.3.9 deployment I have completed a minute ago use the plugin from upstream without needing a fork. So essentially this is finally complete :]

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL