Re: [Wikitech-l] The right way to inject user-supplied JavaScript?

[Daniel Barrett]

Hmm… actually, looking at the ResourceLoader code, the makeInlineScript() 
function does not actually queue the script to execute. It only returns a 
properly wrapped, anonymized function as a string.  I still needed to call 
OutputPage->addScript() to make it execute.

DanB

From: Wikitech-l [mailto:wikitech-l-boun...@lists.wikimedia.org] On Behalf Of 
Daniel Barrett
Sent: Wednesday, December 30, 2015 11:03 AM
To: Wikimedia developers
Subject: Re: [Wikitech-l] The right way to inject user-supplied JavaScript?

Kevin Israel writes:
>Since MediaWiki 1.26, all ResourceLoader modules are loaded
>asynchronously, so inline scripts now need to account for the
>possibility they may be executed before the jquery and mediawiki modules
>have loaded.
>
>If you use ResourceLoader::makeInlineScript() to build the HTML script
>element, your JavaScript code will be automatically wrapped in an
>anonymous function and queued for execution once ResourceLoader has
>started up.

Thank you! I have documented your advice at 
https://www.mediawiki.org/wiki/ResourceLoader/Migration_guide_%28users%29#Inline_scripts.

DanB
___
Wikitech-l mailing list
Wikitech-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikitech-l
___
Wikitech-l mailing list
Wikitech-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Re: [Wikitech-l] The right way to inject user-supplied JavaScript?

[Daniel Barrett]

Kevin Israel writes:
>Since MediaWiki 1.26, all ResourceLoader modules are loaded
>asynchronously, so inline scripts now need to account for the
>possibility they may be executed before the jquery and mediawiki modules
>have loaded.
>
>If you use ResourceLoader::makeInlineScript() to build the HTML script
>element, your JavaScript code will be automatically wrapped in an
>anonymous function and queued for execution once ResourceLoader has
>started up.

Thank you!   I have documented your advice at 
https://www.mediawiki.org/wiki/ResourceLoader/Migration_guide_%28users%29#Inline_scripts.

DanB
___
Wikitech-l mailing list
Wikitech-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Re: [Wikitech-l] The right way to inject user-supplied JavaScript?

[Derk-Jan Hartman]

> On 29 dec. 2015, at 21:59, Daniel Barrett  wrote:
> I also read 
> https://www.mediawiki.org/wiki/ResourceLoader/Migration_guide_for_extension_developers
>  but did not find an answer.


Hmm, we should really update parts of those guides btw. They not yet take 1.26 
into account really.

DJ



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
Wikitech-l mailing list
Wikitech-l@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/wikitech-l

Re: [Wikitech-l] The right way to inject user-supplied JavaScript?

[Legoktm]

Hi,

On 12/29/2015 12:59 PM, Daniel Barrett wrote:
> tl;dr:  What's the right way for a tag extension to execute JavaScript 
> provided by the user? (On a private wiki without Internet access.)
> 
> Details:
> I run a private wiki for developers (not accessible from the Internet) that 
> lets any wiki page author run JavaScript on a page by adding a tag:
> 
>  alert("hi"); 
> 
> (We understand  the security implications, which is why the wiki isn't 
> accessible by the world.) When we upgraded to MediaWiki 1.26 (from 1.24), a 
> problem occurred: the  tag stopped recognizing the "mediawiki" 
> and "mw" objects, but otherwise works. The following code reports an 
> undefined variable "mw":
> 
>  mw.loader.using() 
> 
> I assume this is because the  extension builds a 

Re: [Wikitech-l] The right way to inject user-supplied JavaScript?

[Kevin Israel]

On 12/29/2015 03:59 PM, Daniel Barrett wrote:
> I run a private wiki for developers (not accessible from the Internet) that 
> lets any wiki page author run JavaScript on a page by adding a tag:
> 
>  alert("hi"); 
> 
> (We understand  the security implications, which is why the wiki isn't 
> accessible by the world.) When we upgraded to MediaWiki 1.26 (from 1.24), a 
> problem occurred: the  tag stopped recognizing the "mediawiki" 
> and "mw" objects, but otherwise works. The following code reports an 
> undefined variable "mw":
> 
>  mw.loader.using() 
> 
> I assume this is because the  extension builds a 

[Wikitech-l] The right way to inject user-supplied JavaScript?

[Daniel Barrett]

tl;dr:  What's the right way for a tag extension to execute JavaScript provided 
by the user? (On a private wiki without Internet access.)

Details:
I run a private wiki for developers (not accessible from the Internet) that 
lets any wiki page author run JavaScript on a page by adding a tag:

 alert("hi"); 

(We understand  the security implications, which is why the wiki isn't 
accessible by the world.) When we upgraded to MediaWiki 1.26 (from 1.24), a 
problem occurred: the  tag stopped recognizing the "mediawiki" and 
"mw" objects, but otherwise works. The following code reports an undefined 
variable "mw":

 mw.loader.using() 

I assume this is because the  extension builds a