Seems like a security issue

@Aklapper: This allows circumventing a technical restriction. It should be Security.

I don't think it needs to be private, T221887: Ignore css in displaytitle when $wgRestrictDisplayTitle is enabled is public and explains a different way to bypass $wgRestrictDisplayTitle.

In T285329#7170182, @Legoktm wrote:

I don't think it needs to be private, T221887: Ignore css in displaytitle when $wgRestrictDisplayTitle is enabled is public and explains a different way to bypass $wgRestrictDisplayTitle.

Was going to clear the linked page, but I missed this is already public for quite some time, so I reverted myself. Thanks for noting this.

In T285329#7170182, @Legoktm wrote:

I don't think it needs to be private, T221887: Ignore css in displaytitle when $wgRestrictDisplayTitle is enabled is public and explains a different way to bypass $wgRestrictDisplayTitle.

I wasn't aware of the other task. I'm not 100% sure of the differences but I trust you to make that call. I always edge on the side of caution with security issues.

I think T221887#5171826 applies here as well. Plus, as long as T40848 is not fixed this is kind of moot.

Is this really a massive 😱 OMG drop everything and panic security issue?

It seems to me that $wgRestrictDisplayTitle=true is a security fix for a problem that is mostly abstract in nature. It's basically saying "we don't trust Wikipedia editors to deal with vandalism" -- except in real life editors routinely deal with vandalism. In the case of vandalism, reacting to real problems is better than trying to prevent them with ideas that don't work. This is how the page move vandalism went from being somewhat of a problem to being only a minor issue.

It's like putting up a gate because that will stop people from getting in. Except you don't have a fence:
https://commons.wikimedia.org/wiki/File:Gates_without_wall.jpg and the gate isn't even locked. Great job guys. 👍🙄

So, why not just set $wgRestrictDisplayTitle=false?