In 889716e13798 Kartographer was changed to automatically add the map server to the CSP source list for pages that include a map on them. However this doesn't seem to work for Wikidata, due to Wikibase\Repo\ParserOutput\GlobeCoordinateKartographerDataUpdater::updateParserOutput not copying that data over.
This wouldn't affect anything in production (Because CSP is not in use yet, but also the plan is to whitelist all of *.wikimedia.org just generally). However, this is breaking things on beta wiki.
My suggested fix would be:
diff --git a/repo/includes/ParserOutput/GlobeCoordinateKartographerDataUpdater.php b/repo/includes/ParserOutput/GlobeCoordinateKartographerDataUpdater.php index a6963cc409..6a79c92ba5 100644 --- a/repo/includes/ParserOutput/GlobeCoordinateKartographerDataUpdater.php +++ b/repo/includes/ParserOutput/GlobeCoordinateKartographerDataUpdater.php @@ -81,6 +81,11 @@ class GlobeCoordinateKartographerDataUpdater implements StatementDataUpdater { $parserOutput->addModules( $kartographerParserOutput->getModules() ); $parserOutput->addModuleStyles( $kartographerParserOutput->getModuleStyles() ); + $srcs = $kartographerParserOutput->getExtraCSPDefaultSrcs(); + foreach( $srcs as $src ) { + $parserOutput->addExtraCSPDefaultSrc( $src ); + } + $parserOutput->setExtensionData( 'kartographer', $kartographerParserOutput->getExtensionData( 'kartographer' )
However, I'm not sure if that would work during preview. I also haven't tested this as of yet.
Alternatively, it may make sense to use ParserOutput::mergeInternalMetaDataFrom, so that this is less coupled to internal implementation details.
Acceptance Criteria: 🏕️🌟(October 2021):
- all Wikibase pages that may contain a map add the map server to the CSP source list
- this includes entity pages that don’t contain a map yet, but where users may add a coordinate statement – the editing UI shows a map preview