Change Details

Bug 70672 fixes the security hole of allowing Javascript in CSS in the Mediawiki namespace. It does this by breaking the functionality of loading CSS when on the Special:UserLogin and Special:Preferences pages. Unfortunately this means that any custom styles are not loaded. To the end user it causes momentarily confusion that they may have been maliciously redirected to a different site to enter their username and password. This is an undesirable side effect for the user interface. I have created an example extension that will prevent saving any custom CSS that contains Javascript imports. https://github.com/Alexia/Bug70672 Example error output: http://imgur.com/a/TnsTY#0 Original bug: https://bugzilla.wikimedia.org/show_bug.cgi?id=70672 -------------------------- **Version**: 1.23.5 **Severity**: major **See Also**: https://bugzilla.wikimedia.org/show_bug.cgi?id=70672

Bug 70672 (T72672) fixes the security hole of allowing Javascript in CSS in the Mediawiki namespace. It does this by breaking the functionality of loading CSS when on the Special:UserLogin and Special:Preferences pages. Unfortunately this means that any custom styles are not loaded. To the end user it causes momentarily confusion that they may have been maliciously redirected to a different site to enter their username and password. This is an undesirable side effect for the user interface. I have created an example extension that will prevent saving any custom CSS that contains Javascript imports. https://github.com/Alexia/Bug70672 Example error output: http://imgur.com/a/TnsTY#0 Original bug: https://bugzilla.wikimedia.org/show_bug.cgi?id=70672 -------------------------- **Version**: 1.23.5 **Severity**: major **See Also**: https://bugzilla.wikimedia.org/show_bug.cgi?id=70672

Bug 70672 (T72672) fixes the security hole of allowing Javascript in CSS in the Mediawiki namespace. It does this by breaking the functionality of loading CSS when on the Special:UserLogin and Special:Preferences pages. Unfortunately this means that any custom styles are not loaded. To the end user it causes momentarily confusion that they may have been maliciously redirected to a different site to enter their username and password. This is an undesirable side effect for the user interface. I have created an example extension that will prevent saving any custom CSS that contains Javascript imports. https://github.com/Alexia/Bug70672 Example error output: http://imgur.com/a/TnsTY#0 Original bug: https://bugzilla.wikimedia.org/show_bug.cgi?id=70672 -------------------------- **Version**: 1.23.5 **Severity**: major **See Also**: https://bugzilla.wikimedia.org/show_bug.cgi?id=70672