https://bugzilla.wikimedia.org/show_bug.cgi?id=22929
Summary: Special:Userlogin loads mw gadget scripts, potential
security orifice
Product: MediaWiki
Version: unspecified
Platform: All
OS/Version: All
Status: NEW
Severity: enhancement
Priority: Normal
Component: User login
AssignedTo: [email protected]
ReportedBy: [email protected]
The userlogin page does disable the MediaWiki:Common.js and
so on down to the the user's javascript.
However if a user has selected gadgets using specialprefs
and re-visits the userlogin page after logging in (perhaps
to switch to their other-other account :p) a malicious
gadget could go south with the password, just as easily as
it could on the specialprefs page where on-wiki javascript
is disabled for (I thought) the same concern.
--
Configure bugmail: https://bugzilla.wikimedia.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are on the CC list for the bug.
_______________________________________________
Wikibugs-l mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/wikibugs-l
