On MW 1.39, appending safemode=1 doesn't appear to do anything, and doesn't function as it should. In practice, this should disable JS and CSS on the wiki, but it doesn't actually appear to do anything. I'm not entirely sure if this is something new in 1.39, or if it was present in 1.38, but it doesn't work in 1.39.
Description
Description
Event Timeline
Comment Actions
Docs says:
- safemode: Only register modules that have ORIGIN_CORE as their origin. This disables ORIGIN_USER modules and mw.loader.store. (T185303, T145498) See also: OutputPage::disallowUserJs()
It does not disable all JS and CSS, it disables all user provided JS and CSS (for example scripts from user pages 'User:<User>/common.js', but also from mediawiki namespace like 'MediaWiki:Common.js' or Gadgets)
Scripts provide by mediawiki itself are still working.
Comment Actions
It doesn't work, though, from what you're saying, Common.css should also not be loaded, correct? If correct, then my original comment is correct because Common.css is still loaded.
Comment Actions
Yes, it includes Common.css.
Works for me with the current master and the latest REL1_39 from git
Steps to reproduce:
- Login as interface admin
- Go to MediaWiki:Common.css and include the content: #firstHeading { background-color: orange; }
- Go to Main Page and the heading should be orange
- Load the Main Page with safemode=1 and the heading is no longer orange
Comment Actions
I'm also using the latest release and it isn't working? Following the above steps. This is also being reported over at Wiki.gg
Comment Actions
Do you have $wgAllowSiteCSSOnRestrictedPages enabled? That allows Common.css to get through safemode.
Comment Actions
wgAllowSiteCSSOnRestrictedPages is false by default because while much less exploitable than JavaScript, there are numerous ways to exploit CSS as well. Depending on your wiki's risk profile, and depending and the kind of trust and skill placed in site admins that edit MediaWiki:Common.css you may choose to allow site-wide CSS on restricted pages. This configuration variable exists intentionally and specifically only to do one thing, to allow site-wide CSS on restricted pages (such as login and password-related special pages, and indeed page views with safemode=1).
Regardless of this configuration variable, however, MediaWiki always prevents restricted pages from loading user-specific CSS or JavaScript (e..g "User:Foo/common.css and js), and also prevents loading of side-wide JavaScript (e.g. "MediaWiki:Common.js").
I've updated the safemode docs at https://www.mediawiki.org/wiki/Manual:Parameters_to_index.php#User_preference_overriding accordingly.