Page MenuHomePhabricator

Prepare GlobalCssJs extension for IP Masking
Closed, ResolvedPublic

Description

A preliminary investigation (T326759) has found that the GlobalCssJs extension may be affected by IP Masking

Event Timeline

Mimurawil changed the task status from Open to In Progress.Jul 11 2024, 5:12 PM
Mimurawil changed the task status from In Progress to Open.Jul 11 2024, 6:09 PM
Mimurawil removed Mimurawil as the assignee of this task.
Mimurawil subscribed.
Amdrel changed the task status from Open to In Progress.Jul 19 2024, 9:04 PM
Amdrel claimed this task.

It looks like this extension already disallows editing user CSS and JS pages for temporary accounts. The only possible oddity I see is the help link for editing those pages shows up if you try to visit them with a temporary account, while an anonymous user does not get this help link.

Thanks @Amdrel! Sounds like it might be worth removing those help links for temp accounts to avoid confusion.

Change #1055978 had a related patch set uploaded (by Amdrel; author: Amdrel):

[mediawiki/extensions/GlobalCssJs@master] Do not show help links for temp accounts

https://gerrit.wikimedia.org/r/1055978

Change #1055978 merged by jenkins-bot:

[mediawiki/extensions/GlobalCssJs@master] Do not show help links for temp accounts

https://gerrit.wikimedia.org/r/1055978

Testing Instructions

The following configurations were used for this test.

$wgResourceLoaderSources = [
	'my_wiki' => [
		'apiScript' => $wgServer . '/w/api.php',
		'loadScript' => $wgServer . '/w/load.php',
	],
];

$wgUseGlobalSiteCssJs = true;
$wgAllowUserCss = true;
$wgAllowUserJs = true;

$wgGlobalCssJsConfig = [
	'wiki' => 'my_wiki',
	'source' => 'my_wiki',
];
Steps
  1. Enable temporary accounts and make an edit on the wiki to get an account.
  2. Navigate to /wiki/User:<username>/global.css and confirm there is no help link and no permission to create the page.
  3. Navigate to /wiki/User:<username>/global.js and confirm there is no help link and no permission to create the page.

I have verified the new code has been implemented and is functioning, and displaying as expected (Help link is not displaying, and No Permission to create the page)...
Thank you for the Testing Instructions @Amdrel.