Page MenuHomePhabricator

Rename or deprecate $wgEnableImageWhitelist (and related code)
Open, Needs TriagePublic

Description

The $wgEnableImageWhitelist configuration option permits allowing non-local images if they match an allow list.

This is not used in production at WMF, and it's not clear that Parsoid will support this functionality (T75581). But the name is also problematic, and is used in a bunch of related code.

If we're going to go through the trouble of deprecating this configuration and the various functions which reference it, it's possible we should just do T254802: Make the external image block list / allow list into an extension instead.

Event Timeline

Maybe put out a call on mediawiki-l to see if anyone uses this functionality before we get deprecate it?

For alternative names, this basically enables hotlinking so $wgEnableImageHotlinking?

Maybe put out a call on mediawiki-l to see if anyone uses this functionality before we get deprecate it?

I know Wikia/FANDOM allow hotlinking images from certain websites, but I have no idea if they use $wgEnableImageHotlinking to do it, and I also don't know if this functionality is being carried forward into their new UCP platform.

Maybe put out a call on mediawiki-l to see if anyone uses this functionality before we get deprecate it?

For alternative names, this basically enables hotlinking so $wgEnableImageHotlinking?

I highly suspect it still sees use in the third-party user world. It isn't a great practice to generally condone, but, I can foresee genuine use cases where a business may reuse images/assets hosted on other bits of its infrastructure instead of creating a whole mess of various file repositories to grab content from its different systems as technical time or storage capacity is limited. And if the feature is removed from core, it'll encourage more people to use potentially far less secure extensions or hacks to add this functionality back in. I guess this also applies to T254802, which would be fine, I just see no discussion about said extension being maintained, and from a third party perspective, its very hard to find extensions that are actively maintained unless they're deployed on WMF infrastructure (or by one or two bigger users of MediaWiki, which even then doesn't guarantee support for a specific version as they're not always running a specific MW version.

Having checked, it seems we've got it enabled globally at ShoutWiki - I don't ever recall setting it or having a discussion about it - my assumption is it probably predates me and I couldn't tell you if/how widely it is used. I don't recall ever seeing it in use. I'll have to investigate, but, I'm certainly not opposed to turning it off.

As for the variable naming, it is worth noting that there are currently three variables related to hotlinking (that I found in a brief MW.org check) -

I think my current plan (under-resourced at the moment, alas) is to move this functionality into an extension, so that it's not in core but anyone who does need it can install the extension. That's T254802. But it certainly wouldn't be a bad idea for ShoutWiki to investigate whether it can turn it off in production if it's not actually being used.