Closing per what @Reedy said; there is no reason for the change to not take effect if you have updated the extension.

As pointed out by @Amousey, this has been fixed in recent versions. Is a backport needed?

For the record, the CSS was moved to GrowthExperiments in https://gerrit.wikimedia.org/r/963725.

@Lens0021, what else needs to be done here?

The upstream Firefox bug appears to have been fixed. Is this still an issue?

Other than 'this is the standard', is there any other rationale for this?

Doesn't T357598 make this unnecessary?

Regarding why it's not visible with uselang=x-xss, it should be because that doesn't actually mess with the messages in parser output unless there is something wrong with my MW config.

In T357203#9536582, @Samwilson wrote:

In my testing, JS I inserted was rendered as given (but not executed due to the way in which it was inserted into the page). Anyway, thanks for the quick patch.

Yeah, the script tag should be rendered but not executed. However, if you were to use <svg onload=alert('XSS')>, for example, it would work.

In T357203#9532378, @Samwilson wrote:

When I test with $wgLanguageCode = 'x-xss'; there is no JS alert raised (but the alert() is shown in escaped HTML).

I don't think that tests parser output. In my testing, JS I inserted was rendered as given (but not executed due to the way in which it was inserted into the page). Anyway, thanks for the quick patch.

This introduces an interesting regression:

It's fixed! Thank you. :)

In T351361#9337830, @Jdlrobson wrote:

I am also noticing that there are no icons in Minerva skin in the gadget and the extension. Should that be a new bug?

Is this about the extension or the gadget? If the former, I can't reproduce this with MW 1.40.

In T348203#9271624, @SCherukuwada wrote:

2. If we want to control this on our end, we need to set og:site_name (or use some of the other recommendations on Google's page) to wgNoticeProject or something, but I defer to those who know better. @ovasileva ?

@SCherukuwada, seeing T302625 and that you are working on T325607, could you please take a look here and at T349361? Thanks.

SRE is not responsible for this.

Can repro.

This actually appears like intended behaviour as clicking the edit button on a page where another page has been transcluded should indeed take users to the page being transcluded as that is where the actual content is. bnwikt will have to migrate away from these templates.

As an FYI for all interested, T340705 does point out that bnwikisource has the fifth(!) highest increase (i.e. in addition to the assets used by deployed software) in transferred assets of all Wikimedia wikis. Interface Admins may want to keep an eye on it.

Interestingly enough, on pages like https://bn.m.wiktionary.org/wiki/%E0%A6%AC%E0%A6%BE%E0%A6%B2%E0%A6%BE%E0%A6%AE, the template used to generate the first section is shown but other content remains invisible.

Do you have a working link (the provided one does not have DarkMode right now) or a screenshot?

This looks like T292697 to me.

Thank you both!

In T293341#7445678, @sbassett wrote:

Did you still want to get a change set up to gerrit for review? Looks like I have +2 on that repo, so I could merge it if it passes CI and someone +1s it as confirmed testing and working for master. Let me know.

In T293341#7433534, @Malvineous wrote:

Hi all, definitely haven't touched this for a while so can't help much, but I've eyeballed the patch and it looks fine so I'd be happy to +2 it if I still can.

In T293341#7428882, @sbassett wrote:

1. What the Security-Team would suggest, prior to publicly disclosing an issue via gerrit, is for the skin/extension maintainers or discoverers of any vulnerabilities like this, to reach out to as many people as possible (tagging them on this task if they have Phabricator accounts would work) so they can code-review and then deploy this patch to their MediaWiki installations prior to public disclosure. Unfortunately, this can be a tedious process and sites like WikiApiary, while helpful, are not always representative of actual usage of a given skin or extension.

Here is a patch but I am not sure how to get it through Gerrit. Does that need to be done by the Security Team even for non-Wikimedia-deployed extensions?

Adding the author.

Thank you, @Urbanecm!