5 ms·

wait as a wikipedia user you can just put random JS to some settings and it will just... run? privileged? this is both really cool and really really insane

hk__2 8mo ago
Yes, you can have your own JS/CSS that’s injected in every page. This is pretty useful for widgets, editing tools, or to customize the website’s apparence.
- karel-3d 8mo ago
  It sounds very dangerous to me but who am I to judge.
  - corndoge 8mo ago
    That is how Mediawiki works. Everything is a page, including CSS and JS. It is not really different than including JS in a webpage anywhere else.
  - Brian_K_White 8mo ago
    It's nothing. For the global ones that need admin permissions to edit, it's no different from all the other code of mediawiki itself like the php. For the user scripts, it's no worse than the fact that you can run tampermonkey in your browser and have it modify every page from evry site in whatever way your want.
    - karel-3d 8mo ago
      Well it has just been shown it's not nothing
      - Brian_K_White 8mo ago
        No it hasn't.
  - bawolff 8mo ago
    It is kind of risky - you now have an entire, mostly unreviewed, ecosystem of javascript code, that users can experiment with. However its been really useful to allow power users to customize the interface to their needs. It also is sort of a pressure release for when official devs are too slow for meeting needs. At this point wikipedia has become very dependent on it.
  - hk__2 8mo ago
    It only affects your user; it’s just like adding random extensions to your browser.
kemayo 8mo ago
It's a mediawiki feature: there's a set of pages that get treated as JS/CSS and shown for either all users or specifically you. You do need to be an admin to edit the ones that get shown to all users. https://www.mediawiki.org/wiki/Manual:Interface/JavaScript https://www.mediawiki.org/wiki/Manual:Interface/JavaScript
Ekaros 8mo ago
Fundamentally I feel whole "web" as in anything running in browser is insane an broken security wise. When you allow mostly arbitrary code to run when you load a page... Well it can do mostly arbitrary things and everyone else needs to protect against it. And when you have enough rights, you get to add arbitrary code to everywhere on your site.

hk__2 8mo ago

Yes, you can have your own JS/CSS that’s injected in every page. This is pretty useful for widgets, editing tools, or to customize the website’s apparence.

karel-3d 8mo ago
It sounds very dangerous to me but who am I to judge.
- corndoge 8mo ago
  That is how Mediawiki works. Everything is a page, including CSS and JS. It is not really different than including JS in a webpage anywhere else.
- Brian_K_White 8mo ago
  It's nothing. For the global ones that need admin permissions to edit, it's no different from all the other code of mediawiki itself like the php. For the user scripts, it's no worse than the fact that you can run tampermonkey in your browser and have it modify every page from evry site in whatever way your want.
  - karel-3d 8mo ago
    Well it has just been shown it's not nothing
    - Brian_K_White 8mo ago
      No it hasn't.
- bawolff 8mo ago
  It is kind of risky - you now have an entire, mostly unreviewed, ecosystem of javascript code, that users can experiment with. However its been really useful to allow power users to customize the interface to their needs. It also is sort of a pressure release for when official devs are too slow for meeting needs. At this point wikipedia has become very dependent on it.
- hk__2 8mo ago
  It only affects your user; it’s just like adding random extensions to your browser.

kemayo 8mo ago

It's a mediawiki feature: there's a set of pages that get treated as JS/CSS and shown for either all users or specifically you. You do need to be an admin to edit the ones that get shown to all users. https://www.mediawiki.org/wiki/Manual:Interface/JavaScript https://www.mediawiki.org/wiki/Manual:Interface/JavaScript

Ekaros 8mo ago

Fundamentally I feel whole "web" as in anything running in browser is insane an broken security wise. When you allow mostly arbitrary code to run when you load a page... Well it can do mostly arbitrary things and everyone else needs to protect against it. And when you have enough rights, you get to add arbitrary code to everywhere on your site.