https://bugzilla.wikimedia.org/show_bug.cgi?id=16805
--- Comment #2 from Splarka <[email protected]> 2009-04-03 21:33:10 UTC --- ChangePass and UserLogin make perfect sense to disable gadgets on. UserRights does not. Lemme splain: If you have compromised someone's javascript, you can simply send an ajax request to Special:UserRights, scrape the form, get the token, and submit it it back. Same for most other Special pages. You can't do this for ChangePass, because it requires them to enter their password. Same for UserLogin. Site JS should be trusted enough to load on all pages (except maybe UserLogin). Suggest WONTFIX for UserRights (some people automate the process, especially on Meta) and Site JS suggestions, and dupe to bug 18186 for the Gadgets (both CSS and JS, CSS can execute javascript in some browsers!) disabling on ChangePass/etc. -- Configure bugmail: https://bugzilla.wikimedia.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug. _______________________________________________ Wikibugs-l mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
