Page MenuHomePhabricator

Allowlist for namespaces in uploads should be replaced with allowlist filter
Open, Needs TriagePublic

Description

Feature summary (what you would like to be able to do and where):

Namespaces in uploaded SVGs are currently checked against a hard-coded list. It would be simpler and easier if there was a Mediawiki: allowlist .

Use case(s) (list the steps that you performed to discover that problem, and describe the actual underlying problem which you want to solve. Do not describe only a solution):

In T383949 I requested the addition of a namespace (used by a tool I'm developing) to the hard-coded allowlist. It would have been easier just to ask Commons admins to add the namespace.

The function checkSvgScriptCallback suggests this in its comments:

/**
 * @todo Replace this with a allow list filter!

Benefits (why should this be implemented?):

It saves updating the code every time someone wants to add a new namespace. This increases the autonomy of extension authors.

Draft patch to follow.

Event Timeline

Draft patch:

This is the first time I've submitted a patch to MediaWiki, so apologies in advance for errors; I'd appreciate some hand-holding. Where do we keep the defaults?

It might be good to have a central allowlist parsing function, which would ignore comments and so on.

@Marnanel: Thanks for taking a look at the code! You are very welcome to use a Developer Account to submit the proposed code changes as a Git branch directly into Gerrit which makes it easier to review and provide feedback. If you don't want to set up Git/Gerrit, you can also use the Gerrit Patch Uploader. Thanks again!

Change #1119886 had a related patch set uploaded (by Marnanel; author: Marnanel):

[mediawiki/core@master] Replace hardcoded list of permitted SVG namespaces with allow list

https://gerrit.wikimedia.org/r/1119886