Thank you both!

In T293341#7445678, @sbassett wrote:

Did you still want to get a change set up to gerrit for review? Looks like I have +2 on that repo, so I could merge it if it passes CI and someone +1s it as confirmed testing and working for master. Let me know.

In T293341#7433534, @Malvineous wrote:

Hi all, definitely haven't touched this for a while so can't help much, but I've eyeballed the patch and it looks fine so I'd be happy to +2 it if I still can.

In T293341#7428882, @sbassett wrote:

1. What the Security-Team would suggest, prior to publicly disclosing an issue via gerrit, is for the skin/extension maintainers or discoverers of any vulnerabilities like this, to reach out to as many people as possible (tagging them on this task if they have Phabricator accounts would work) so they can code-review and then deploy this patch to their MediaWiki installations prior to public disclosure. Unfortunately, this can be a tedious process and sites like WikiApiary, while helpful, are not always representative of actual usage of a given skin or extension.

Here is a patch but I am not sure how to get it through Gerrit. Does that need to be done by the Security Team even for non-Wikimedia-deployed extensions?

Adding the author.

Thank you, @Urbanecm!

This seems like the Dark Mode gadget, not the MediaWiki extension.

In T221897#7140324, @Frap wrote:

Since MediaWiki can be installed on a domain where other applications or JavaScript scripts may be installed it would be good to put the LocalStorage key in a namespace by prefixing the key with mw or mediawiki or something, followed by a dot (the . character)...

In T283406#7123702, @Aklapper wrote:

@R4356th : Why?

In T281193#7084527, @Legoktm wrote:

Please read https://www.mediawiki.org/wiki/Phabricator/Project_management#Priority_levels "Unbreak Now! – Something is broken and needs to be fixed immediately, setting anything else aside". - I don't know if the /test interface being broken meets that criteria, but "Unbreak Now!" does not have to impact WMF production, I have no idea why you'd say that..

This does not impact WMF production and does not appear to have anyone actively working on this.

In T274040#7022477, @Tacsipacsi wrote:

In T274040#7020097, @R4356th wrote:

this is making translating big strings using the translation interface impossible.

I think adding a blank line at the end should work this bug around. When saving the Translations-namespace page, this blank line is dropped, and I hope it’s dropped in the actual translatable page as well. However, I couldn’t test this, because…

In T274040#6811970, @Nikerabbit wrote:

Could you post a direct link to an example message for testing?

Link:
https://meta.wikimedia.org/w/index.php?title=Special:Translate&group=page-User%3ATimur+Vorkul+%28WMDE%29%2FSuggested+values+announcement&language=bn&action=page&filter=
Snip:

It was due to a downstream configuration issue with permissions, not an issue with the extension itself.

Adding User-notice as this is included in the upcoming publication of Tech News.

This was announced in Tech News yesterday.