Page MenuHomePhabricator
Create Task
Maniphest T254802

Make the external image block list / allow list into an extension
Open, Needs TriagePublic
Actions

Description

Core contains a bunch of code for allowing direct reference to external images which isn't used in WMF production. This code isn't currently supported by Parsoid either (T75581).

This could be replaced by a small hook to validate an image URL, and moved out of core into an extension.

Details

SubjectRepoBranchLines +/-
WIP: move external image allow/deny functionality into an extensionmediawiki/coremaster+48 -7
Deprecate external image related configuration in ParserOptionsmediawiki/coremaster+13 -0
Hard deprecate $wgAllowImageTag configurationmediawiki/coremaster+4 -0
Customize query in gerrit

Related Objects

Event Timeline

cscott created this task.Jun 8 2020, 6:47 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 8 2020, 6:47 PM
cscott mentioned this in T254803: Rename or deprecate $wgEnableImageWhitelist (and related code).Jun 8 2020, 6:49 PM
cscott mentioned this in T75581: Parsoid doesn't support image allow/deny configuration.Jun 8 2020, 6:52 PM
cscott mentioned this in T254804: Remove whitelist/blacklist in Parsoid.Jun 8 2020, 8:36 PM
ssastry moved this task from Needs Triage to Non-Parsing-Team Tasks on the Parsoid board.Jun 9 2020, 10:39 PM
gerritbot added a comment.Jun 10 2020, 5:05 PM

Change 604449 had a related patch set uploaded (by C. Scott Ananian; owner: C. Scott Ananian):
[mediawiki/core@master] Deprecate external image related configuration in ParserOptions

https://gerrit.wikimedia.org/r/604449

gerritbot added a project: Patch-For-Review.Jun 10 2020, 5:05 PM
gerritbot added a comment.Jun 10 2020, 7:59 PM

Change 604496 had a related patch set uploaded (by C. Scott Ananian; owner: C. Scott Ananian):
[mediawiki/core@master] WIP: move external image allow/deny functionality into an extension

https://gerrit.wikimedia.org/r/604496

gerritbot added a comment.Jun 10 2020, 9:00 PM

Change 604508 had a related patch set uploaded (by C. Scott Ananian; owner: C. Scott Ananian):
[mediawiki/core@master] Hard deprecate $wgAllowImageTag configuration

https://gerrit.wikimedia.org/r/604508

gerritbot added a comment.Jun 11 2020, 6:55 AM

Change 604508 merged by jenkins-bot:
[mediawiki/core@master] Hard deprecate $wgAllowImageTag configuration

https://gerrit.wikimedia.org/r/604508

ReleaseTaggerBot added a project: MW-1.35-notes (1.35.0-wmf.37; 2020-06-16).Jun 11 2020, 7:00 AM
gerritbot added a comment.Jun 15 2020, 2:10 PM

Change 604449 merged by jenkins-bot:
[mediawiki/core@master] Deprecate external image related configuration in ParserOptions

https://gerrit.wikimedia.org/r/604449

MBinder_WMF edited projects, added Parsoid (Tracking); removed Parsoid.Dec 10 2020, 8:12 PM
Arlolra mentioned this in T127884: Respect $wgAllowImageTag wiki configuration flag in the Sanitizer.Dec 10 2020, 8:25 PM
Ciencia_Al_Poder subscribed.Dec 13 2021, 6:01 PM
cscott added a comment.Feb 17 2022, 12:07 AM

Hm, it would be nice if this could make 1.38.

Aklapper added a comment.Feb 17 2022, 9:57 AM

There isn't a non-WIP patch to review for 1.38 if I understand correctly.

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL