MediaWiki talk:Common.js/Archive 21: Difference between revisions
Content deleted Content added
m Archiving 2 discussion(s) from MediaWiki talk:Common.js) (bot |
m Archiving 2 discussion(s) from MediaWiki talk:Common.js) (bot |
||
Line 249:
:I will disable all CSS form IEFixes.js; The print bug is likely IE7 only, the overflow bug is redundant as nothing seems to use these classes, and I can no longer trigger the bug targeted by the zoom fix in IE8. <code style="white-space:nowrap">-- [[[[User:Edokter|<span style="color:#006">User:Edokter</span>]]]] {{[[User talk:Edokter|<span style="color:#060">talk</span>]]}}</code> 19:35, 14 November 2014 (UTC)
== Protected edit request on 21 September 2014: [[MediaWiki:Common.js/secure new.js]] ==
{{edit protected|MediaWiki:Common.js/secure new.js|answered=yes}}
I want to remove these domains from Line 35:
* lists -- HTTPS only, [[gerrit:145616]]
* bugzilla -- HTTPS only, [[gerrit:127256]]
* wikitech -- HTTPS only, [[gerrit:145491]]
* ticket -- HTTPS only, [[gerrit:145495]]
* noc -- support both HTTP and HTTPS, [[bugzilla:23004]]
* eiximenis -- http://eiximenis.wikimedia.org/ ___domain doesn't exist
* static -- http://static.wikimedia.org/ ___domain doesn't exist
* volunteer -- http://volunteer.wikimedia.org/ ___domain doesn't exist
* survey -- http://survey.wikimedia.org/ ___domain doesn't exist
* prototype -- http://prototype.wikimedia.org/ ___domain doesn't exist
[[User:Chmarkine|Chmarkine]] ([[User talk:Chmarkine|talk]]) 02:48, 22 September 2014 (UTC)
:Also the <code>sub === 'shop'</code> on Line 29 can be removed now. See [[bugzilla:37790#c9]]. [[User:Chmarkine|Chmarkine]] ([[User talk:Chmarkine|talk]]) 03:44, 22 September 2014 (UTC)
::{{done}}, thanks! [[User:Legoktm|Legoktm]] ([[User talk:Legoktm|talk]]) 06:13, 22 September 2014 (UTC)
:::Pinging {{U|TheDJ}} to determine if this script can be retired. <code style="white-space:nowrap">-- [[[[User:Edokter|<span style="color:#006">User:Edokter</span>]]]] {{[[User talk:Edokter|<span style="color:#060">talk</span>]]}}</code> 06:19, 22 September 2014 (UTC)
::::{{U|TheDJ}}? [[User:He7d3r|Helder]] 20:20, 4 October 2014 (UTC)
:::::After receiving some unjustified negative feedback, TheDJ has left the building. If you urgently want to attract their attention, try [[Special:EmailUser/TheDJ]]; otherwise, post at [[mw:User talk:TheDJ]] or [[m:User talk:TheDJ]], possibly: [[c:User talk:TheDJ]]; [[:nl:Overleg gebruiker:TheDJ]]; [[d:User talk:TheDJ]]. --[[User:Redrose64|<span style="color:#a80000; background:#ffeeee; text-decoration:inherit">Red</span>rose64]] ([[User talk:Redrose64|talk]]) 18:06, 5 October 2014 (UTC)
::::::Pinged him on [[mw:User talk:TheDJ]]. <code style="white-space:nowrap">-- [[[[User:Edokter|<span style="color:#006">User:Edokter</span>]]]] {{[[User talk:Edokter|<span style="color:#060">talk</span>]]}}</code> 17:37, 16 October 2014 (UTC)
:I have disabled secure_new.js. With HTTPS being the default for logged in users, and protocol-relative linking being the standard, I don't see any added value for this script, unless I'm missing something... <code style="white-space:nowrap">-- [[[[User:Edokter|<span style="color:#006">User:Edokter</span>]]]] {{[[User talk:Edokter|<span style="color:#060">talk</span>]]}}</code> 09:35, 13 November 2014 (UTC)
::{{ping|Edokter}} A lot of users post HTTP "external" links that actually go to Wikipedia pages (like [http://en.wikipedia.org/wiki/MediaWiki_talk:Common.js this one]). Without this script, users will become insecure as soon as they click on one of them. I think we should re-enable the script ASAP to avoid users dropping out of SSL when they haven't before. [[User:Jackmcbarn|Jackmcbarn]] ([[User talk:Jackmcbarn|talk]]) 15:42, 13 November 2014 (UTC)
:::Over the last few months I have noticed a significant increase in the number of cases where a full URL is used when a normal wikilink, interwiki link or interlanguage link would have been better. It is no longer possible to locate and fix these through [[Special:LinkSearch]], see [[bugzilla:72185]]. --[[User:Redrose64|<span style="color:#a80000; background:#ffeeee; text-decoration:inherit">Red</span>rose64]] ([[User talk:Redrose64|talk]]) 15:52, 13 November 2014 (UTC)
::::Right. That's why we need this turned back on. [[User:Jackmcbarn|Jackmcbarn]] ([[User talk:Jackmcbarn|talk]]) 16:14, 13 November 2014 (UTC)
:::{{ping|Jackmcbarn}} Then they shouldn't post these links (idea for edit filter?) All projects have HTTPS enabled by default for logged in users now. Is there any common scenario that absolutely requires this script? One of the reasons I'd like to kill it is processing time; every link on every page needs to be enumerated, which has quite an impact on load time. <code style="white-space:nowrap">-- [[[[User:Edokter|<span style="color:#006">User:Edokter</span>]]]] {{[[User talk:Edokter|<span style="color:#060">talk</span>]]}}</code> 17:32, 13 November 2014 (UTC)
::::{{ping|Edokter}} If the filter were set to disallow, it would be seen as too BITEy, and if it weren't, it would be the same as not having it at all, since the links could still get through. (And there'd also be the problems of false negatives and old revisions.) The script needs to stay enabled until WMF turns on [[HTTP Strict Transport Security|HSTS]]. [[User:Jackmcbarn|Jackmcbarn]] ([[User talk:Jackmcbarn|talk]]) 03:56, 14 November 2014 (UTC)
:::::The original script was never intended to target external link put in by editors, but to handle all interface- and wikilinks that were still hardcoded to use http before protocol-relative linking was introduced. As it is now, the script hogs CPU during page load enumerating ''all'' the links, even for 99.9% of the pages that do not need it. It may also interfere with the "Always use a secure connection when logged in" where editors have disabled that option on ohter projects. Those conscious enough about security already have measures in place like HTTPSAnywhere. Most other projects have disabled it already; the performance hit is simply not worth it. If the WMF is so concerned, why not skip HSTS and ''dis''allow HTTP alltogether? <code style="white-space:nowrap">-- [[[[User:Edokter|<span style="color:#006">User:Edokter</span>]]]] {{[[User talk:Edokter|<span style="color:#060">talk</span>]]}}</code> 09:38, 14 November 2014 (UTC)
::::::Some users are unable to use HTTPS for various reasons, so I don't think we'll ever be able to disable insecure connections. Right now with the script disabled, the only thing keeping me on HTTPS is HTTPS Everywhere, and most users don't have that and will fall out of it now. [[User:Jackmcbarn|Jackmcbarn]] ([[User talk:Jackmcbarn|talk]]) 13:11, 14 November 2014 (UTC)
:::::::I don't think it shoud go back into Common.js, perhaps as an alternative, it could be made into a gadget. -- [[User:WOSlinker|WOSlinker]] ([[User talk:WOSlinker|talk]]) 13:14, 14 November 2014 (UTC)
::::::::That only benefits users that are logged in here, but not on other projects. And then SUL usually kicks in and logs them in, resetting them to a secure connection. Only anonymous users seem to be affected here. <code style="white-space:nowrap">-- [[[[User:Edokter|<span style="color:#006">User:Edokter</span>]]]] {{[[User talk:Edokter|<span style="color:#060">talk</span>]]}}</code> 15:38, 14 November 2014 (UTC)
:::::::::If a logged-in user follows an insecure link, their browser will send all of the request data insecurely, then the server may kick them back to SSL, but by then it's too late. [[User:Jackmcbarn|Jackmcbarn]] ([[User talk:Jackmcbarn|talk]]) 15:56, 14 November 2014 (UTC)
:::::::::You just need to enable the gadget by default and it will be loaded to anonymous users too, while still being opt-out. [[User:He7d3r|Helder]] 18:07, 14 November 2014 (UTC)
:{{od|8}} I'm still not convinced. ((U|Jackmcbarn}} This is bordering on paranoia. {{U|He7d3r}} A default gadget still incurs a major performance hit. Again, what is the pressing rationale for keeping this script live? Shall we wait until there are some actual complaints? <code style="white-space:nowrap">-- [[[[User:Edokter|<span style="color:#006">User:Edokter</span>]]]] {{[[User talk:Edokter|<span style="color:#060">talk</span>]]}}</code> 19:10, 14 November 2014 (UTC)
::Because of the server's redirecting, users most likely won't notice that some links don't use SSL at first. The only reason nobody's complaining is because they don't realize it's happening. [[User:Jackmcbarn|Jackmcbarn]] ([[User talk:Jackmcbarn|talk]]) 21:28, 14 November 2014 (UTC)
:::::* I have "Always use a secure connection when logged in" disabled and this indeed is suspected of interfering and causing issues with that (if I remember correctly, mostly when editing/reading from a mobile device in desktop mode). — <span class="nowrap">{{U|[[User:Technical 13|Technical 13]]}} <sup>([[Special:EmailUser/Technical 13|e]] • [[User talk:Technical 13|t]] • [[Special:Contribs/Technical 13|c]])</sup></span> 20:16, 14 November 2014 (UTC)
=== Passing comment ===
(for secure new.js)
var m, main, sub, page, query;
if (m = href.match(re1)) {
// could be changed to
var m = href.match(re1), main, sub, page, query;
if (m) {
// if that would be clearer. <tt>[[User:PC-XT|—PC]][[User talk:PC-XT|-XT]][[Special:Contribs/PC-XT|+]]</tt> 17:00, 22 September 2014 (UTC)
== Replacing Wikiminiatlas.js with OSM.js ==
[[Magnus Manske]] has written a replacement for Wikiminiatlas.js called [https://meta.wikimedia.org/wiki/MediaWiki:OSM.js OSM.js]. It is a much nicer map interface as you can see by going to [[es:Los Barrios]] and clicking "mapa" in the upper-right corner. Can we switch to it? [[User:MoreTomorrow|MoreTomorrow]] ([[User talk:MoreTomorrow|talk]]) 01:03, 14 February 2015 (UTC)
:There's an older version here at the English Wikipedia, [[MediaWiki:Gadget-OSM.js]], but it needs to be updated to use WMF Labs instead of the Toolserver. The OSM gadget is currently used in place of WikiMiniAtlas at the German Wikipedia and a few other wikis ([[:de:Wikipedia:WikiProjekt Georeferenzierung/Anwendungen/OpenStreetMap/en|more info]]). Since that gadget uses a tile server that only supports labels in three languages, the Vietnamese Wikipedia has a [[:vi:Gadget-OpenStreetMap.js|separate OSM gadget]] hooked up to yet another tile server that supports all languages. It also uses the Leaflet library instead of OpenLayers, resulting in [{{fullurle:vi:Bắc Kinh|withJS=MediaWiki:Gadget-OpenStreetMap.js}} a smoother UI] than Gadget-OSM.js. In defense of WMA, though, it supports 3D buildings, [[Equirectangular projection|a different projection]] capable of displaying the poles, and several other planetary bodies. – [[User:Mxn|Minh <span style="font-variant: small-caps;">Nguyễn</span>]] <sup>[[User talk:Mxn|<span style="display: inline-block;">💬</span>]]</sup> 05:30, 14 February 2015 (UTC)
| |||