User talk:Enterprisey/script-installer

From WikiProjectMed
Jump to navigation Jump to search

Links

Hey. Now that you created this, you may want to change the installation instructions for your other user scripts to this script-installer, as opposed to Equazcion's. Just a thought --DannyS712 (talk) 05:43, 9 January 2019 (UTC)[reply]

Good idea! Might do that eventually. Enterprisey (talk!) 02:44, 20 January 2019 (UTC)[reply]
@Enterprisey: Would you be okay if I did it for you? I'm bored and it kind of bugs me. If not, no worries --DannyS712 (talk) 05:29, 20 January 2019 (UTC)[reply]
DannyS712, the thing is after script-installer becomes a gadget, we can just say "if you don't have script-installer yet, just go to the preferences and check this box". (Actually that's not a valid objection to the proposed edits, so...) Thanks for offering to edit it, and go right ahead if you want to. Enterprisey (talk!) 05:36, 20 January 2019 (UTC)[reply]
@Enterprisey:  Done I think --DannyS712 (talk) 05:51, 20 January 2019 (UTC)[reply]
Thanks! Enterprisey (talk!) 05:56, 20 January 2019 (UTC)[reply]

Feature request: generate code that matches {{subst:iusc}}

Here's my common.js right now. 

importScript( 'User:Enterprisey/script-installer.js' ); // Backlink: User:Enterprisey/script-installer.js
importScript('User:Enterprisey/easy-brfa.js'); // Backlink: User:Enterprisey/easy-brfa.js
importScript('User:Enterprisey/cv-revdel.js'); // Backlink: User:Enterprisey/cv-revdel.js
importScript('User:Enterprisey/reply-link.js'); // Backlink: User:Enterprisey/reply-link.js
importScript('User:Enterprisey/talk-tab-count.js'); // Backlink: User:Enterprisey/talk-tab-count.js
importScript('User:Enterprisey/user-tabs-on-contribs.js'); // Backlink: User:Enterprisey/user-tabs-on-contribs.js

Does that bug you? It bugs me. Would it be possible to change script-installer to match {{subst:iusc}}'s output? (For that matter, is there a reason it doesn't just generate that subst in the first place? DRY and all that.) Gaelan 💬✏️ 09:39, 24 February 2019 (UTC)[reply]

Gaelan, is this still an issue? I checked your common.js and my common.js and couldn't see what you're talking about - I'm probably not understanding your comment. Enterprisey (talk!) 06:28, 13 October 2019 (UTC)[reply]
Oh, spacing inside the parentheses. Huh. Yeah, the subst would be fine. I don't feel very strongly about this. I guess I'll consider adding spaces. Enterprisey (talk!) 04:19, 26 January 2021 (UTC)[reply]

Problem installing scripts with multiple

Hi, I just experienced an issue installing User:BrandonXLF/WatchDoc which has "JS: User:BrandonXLF/WatchDoc" in the source field and then it imported that litterally: "importScript('JS: User:BrandonXLF/WatchDoc.js'); // Backlink: JS: User:BrandonXLF/WatchDoc.js" in this edit. Do whatever you want with this information. ‑‑Trialpears (talk) 07:49, 11 November 2019 (UTC)[reply]

Should be fixed now. Enterprisey (talk!) 07:51, 13 November 2019 (UTC)[reply]

Suggestion for edit summary

@Enterprisey: I suggest making the reference to the script being installed a wikilink in the edit summary. For example, for my installation of "reply-link.js", the edit summary would be Installing [[User:Enterprisey/reply-link.js]] + ADVERT. I'm not familiar with JavaScript, but I would guess that function getDescription in script-installer-core.js needs to be amended for that: 

    Import.prototype.getDescription = function () {
        switch( this.type ) {
            case 0: return "[[" + this.page + "]]";
            case 1: return STRINGS.remoteUrlDesc.replace( "$1", this.page ).replace( "$2", this.wiki );
            case 2: return this.url;
        }
    }

—⁠andrybak (talk) 08:51, 5 February 2020 (UTC)[reply]

 Done, thanks for the idea. Enterprisey (talk!) 08:19, 10 November 2020 (UTC)[reply]

Skin support

This seems to install things automatically to common.js. Anyway it can default/be bypassed to install things to specific skins like monobook.js instead? Headbomb {t · c · p · b} 19:02, 15 February 2020 (UTC)[reply]

Headbomb, now it does; try adding window.scriptInstallerInstallTarget = "monobook"; to your common.js. Enterprisey (talk!) 08:32, 10 November 2020 (UTC)[reply]

It doesn't work on Common.js

Hello @Enterprisey:, I'm from ckbwiki. I created this gadget, but it doesn't work on Common.js properly. I mean when we click on Uninstall and/or Disable, the gadget create a new page like ckb:User:Aram/:Aram/common.js. The gadget should work with original common.js except of this action. Can you fix it? Thanks! ⇒ AramTalk 13:33, 11 March 2020 (UTC)[reply]

Aram, the new version at MediaWiki:Gadget-script-installer-core.js (wrap in MediaWiki:Gadget-script-installer.js while copying it over) should work. Also, I added more keys to the STRINGS map at the top so it's easier (harder, lol!) to translate. Enterprisey (talk!) 09:51, 10 November 2020 (UTC)[reply]
@Enterprisey: Thank you very much for solving this problem! I updated the tool and the problem was gone. :) Emm... I think the |updated= parameter should be updated because you updated it's document today. We have the document. So, can we link your page to our language on Wikidata? Thank you again! ⇒ AramTalk 17:25, 10 November 2020 (UTC)[reply]
Aram, sure, go right ahead. Enterprisey (talk!) 02:39, 14 November 2020 (UTC)[reply]

Global

@Enterprisey: It would be neat if this script was extended to allow installing scripts on global.js, too. ~★ nmaia d 01:05, 15 September 2020 (UTC)[reply]

Status: I have no plans to work on this, but would be happy to mentor someone if they wanted to work on it themselves. Enterprisey (talk!) 23:53, 13 August 2021 (UTC)[reply]

TODO: Bulk deletion support

With checkboxes. Enterprisey (talk!) 04:10, 26 January 2021 (UTC)[reply]

👍 That'd be great! — 𝐆𝐮𝐚𝐫𝐚𝐩𝐢𝐫𝐚𝐧𝐠𝐚 (talk) 23:41, 26 May 2021 (UTC)[reply]
Status: I have no plans to work on this, but would be happy to mentor someone if they wanted to work on it themselves. Enterprisey (talk!) 23:53, 13 August 2021 (UTC)[reply]

id vs data-

I don't think relying on IDs for getting script paths is a good idea as it results in invalid HTML if the same path appears more than once per page. Shouldn't it use a data-* attribute? Nardog (talk) 23:18, 8 April 2021 (UTC)[reply]

scriptManager

@Enterprisey: It would be helpful if you added a function allowing you to add scripts using scriptManager's syntax. ― Qwerfjkl | 𝕋𝔸𝕃𝕂  (please use {{reply to|Qwerfjkl}} on reply) 13:53, 23 May 2021 (UTC)[reply]

Agreed. — Guarapiranga (talk) 23:50, 26 May 2021 (UTC)[reply]
Status: I have no plans to work on this, but would be happy to mentor someone if they wanted to work on it themselves. Enterprisey (talk!) 23:53, 13 August 2021 (UTC)[reply]

Error

@Enterprisey, I can't install scripts with this, or move them, but can uninstall them, and normalize the links. I don't get any JavaScript errors when this happens. Please can you fix this. ― Qwerfjkl | 𝕋𝔸𝕃𝕂  (please use {{reply to|Qwerfjkl}} on reply) 20:55, 30 May 2021 (UTC)[reply]

Nevermind, this was a dialouge box issue. ― Qwerfjkl | 𝕋𝔸𝕃𝕂  (please use {{reply to|Qwerfjkl}} on reply) 16:47, 12 June 2021 (UTC)[reply]

Lusc instead of iusc

This script still seems to be using {{Iusc}}, rather than {{Lusc}}, which I understand to be the preferred method. Enterprisey, would it be possible to update that? {{u|Sdkb}} talk 03:47, 23 November 2021 (UTC)[reply]

@Enterprisey: Any update on this? importScript() (which {{iusc}}) uses has been deprecated for a while now. See T95964 ―sportzpikachu my talkcontribs 10:45, 10 December 2021 (UTC)[reply]
I plan to get to this at some point, but it's not urgent; there's still no good official replacement ("Gadgets 3.0" or whatever number they're on now). So it would just be for the slight performance benefit. Enterprisey (talk!) 04:42, 11 December 2021 (UTC)[reply]

Outdated information in "Installation instructions" section

"Installation instructions" section mentions "Editing" section in Preferences/Gadgets page, but in reality the feature is now in "Advanced" section Nyq (talk) 13:49, 29 January 2022 (UTC)[reply]

Nyq,  Fixed: Special:Diff/1068841134. —⁠andrybak (talk) 12:22, 30 January 2022 (UTC)[reply]

Various to-dos

@Enterprisey: Now that phab:T300743 is fixed, I can list the other to-do items that I noticed while looking for XSS issues. These are all suggestions for future development that you can take or leave as you see fit.

  • The gadget should check the content model of script pages before installing them, and only install ones with a content model of JavaScript. In theory, not checking this would allow an attacker to add JavaScript code to a wikitext page in a trusted user's userspace (which anyone can edit), and then trick the victim into installing the attacker's code while the victim believes it is written by the trusted user. In practice, this attack is stopped by MediaWiki setting the X-Content-Type-Options header to "nosniff", which prevents loading scripts from pages that don't have a MIME type of "text/javascript". This could be a problem in very old browsers though, so it would be worth fixing.
  • Import.fromJs is broken for scripts with double or single quotes in them (e.g. User:Example/foo"bar.js). The script trims the first quote character and everything after it, which means it tries to install e.g. User:Example/foo instead. Fixing this would mean parsing the string with a JavaScript parser instead of with regex - unfortunately, I'm not aware of an easy way of doing that without installing third-party libraries, so this could be a lot of work.
  • The cookie attributes of the open_script_installer need fixing. Firefox was giving the following warning in the console: Cookie “open_script_installer” will be soon rejected because it has the “SameSite” attribute set to “None” or an invalid value, without the “secure” attribute. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite.
  • There are some missing translation strings: see the latter half of the diff of the Chinese translation to see where they are. They also use different pipe and bracket characters, so those might be worth including as well. The mw.Message class might be worth a look into for this.

Best — Mr. Stradivarius ♪ talk ♪ 13:33, 7 February 2022 (UTC)[reply]

Adding vector-2022.js to the list of skins

Hi @Enterprisey, now that editors here are increasingly moving to vector-2022, can you please add vector-2022.js to the list of available .js pages? It's now available through preferences. Meanwhile, cologneblue is removed from preferences and according to this thread, its unmaintained for years now and its use discouraged. Maybe that should be removed now? Thanks! —CX Zoom[he/him] (let's talk • {C•X}) 05:21, 15 May 2022 (UTC)[reply]

Done, thanks. Enterprisey (talk!) 20:13, 16 August 2022 (UTC)[reply]

editRestriction is null

At [1]: jQuery.Deferred exception: editRestriction is null buildCurrentPageInstallElement @ MediaWiki:Gadget-script-installer-core.js
Indeed, mw.config.get( "wgRestrictionEdit" ); is null. — Alexis Jazz (talk or ping me) 21:11, 15 August 2022 (UTC)[reply]

Done, thanks. Enterprisey (talk!) 20:12, 16 August 2022 (UTC)[reply]

unable to uninstall autoFormatter & cleanDiff

@Enterprisey: i am unable to uninstall both autoFormatter & cleanDiff on common.js. can you please look into it. <_> jindam, vani (talk) 13:56, 27 December 2022 (UTC)[reply]

Updater functionality?

Hello! Is there functionality for a button in which an update check can be performed for scripts? I briefly glanced at the code, and cannot find one. I understand that auto-updating functionality would be dangerous, but the ability to manually execute a poll/check for updates I think would prove useful, if the feature does not already exist (even if the user has to then manually diff and re-install a script to update it). Thanks for all your hard work! Top5a (talk) 10:51, 22 March 2023 (UTC)[reply]

Pinging in case this went unseen! Top5a (talk) 14:33, 26 July 2023 (UTC)[reply]
Any changes made to a script are immediately automatically propagated to all of those who have installed it via this gadget because importScript() only supports loading the latest revision. It is installing a script fixed at a given revision and not automatically receiving updates that the gadget lacks support for. Nardog (talk) 14:48, 26 July 2023 (UTC)[reply]
Doesn't that only trigger during install/manual import? That seems like a major security and performance issue if the script were to continually refresh and load updated code without user intervention. Also, could potentially load in test/incomplete bugfixes pushed to modules. Top5a (talk) 19:08, 26 July 2023 (UTC)[reply]
Security issue yes, by installing a script you're basically giving its author permission to execute arbitrary code in your browser, hence all the warnings. Performance not so much, because scripts are cached in your browser. If you're so concerned about the vulnerability you could do e.g.
mw.loader.load('//en.wikipedia.org/w/index.php?title=User:RedWarn/.js&oldid=1161037431&action=raw&ctype=text/javascript');
mw.loader.load('//en.wikipedia.org/w/index.php?title=User:Writ_Keeper/Scripts/massRollback.js&oldid=1166752807&action=raw&ctype=text/javascript');
to load specific revisions, though that doesn't stop them from loading the latest versions of other scripts, which some scripts, including RedWarn, do to improve performance. Nardog (talk) 00:24, 27 July 2023 (UTC)[reply]

Recognize Full Protection

@Enterprisey Currently, the script claims that Wikipedia:AutoEd/complete.js is insecure, in spite of the full protection. Could support be added? Aaron Liu (talk) 16:56, 13 September 2023 (UTC)[reply]

Gadget update

Hello! I moved the CSS to a separate page, and also added the missing lines to the STRINGS that need to be translated. Can anyone update the gadget plz:

Thanks! Iniquity (talk) 18:24, 27 November 2023 (UTC)[reply]

 Done * Pppery * it has begun... 18:30, 25 December 2023 (UTC)[reply]
Thanks! Iniquity (talk) 08:29, 26 December 2023 (UTC)[reply]

Bug report: TypeError: Cannot read properties of null (reading '0')

When trying to parse this page. –Novem Linguae (talk) 21:19, 24 December 2023 (UTC)[reply]

Fixed it! Andre🚐 03:09, 25 December 2023 (UTC)[reply]
Thanks for fixing the wikicode, but I think the gadget still needs a fix as well. JS should not be throwing type errors, and the gadget should not be failing on pages with a user script infobox. No rush on this, just leaving a bug report in case some work is done in the future. –Novem Linguae (talk) 05:22, 25 December 2023 (UTC)[reply]
I am not an expert, but this was the fix [2] it was an old type of infobox. Andre🚐 05:29, 25 December 2023 (UTC)[reply]


Interface-protected edit request on 25 December 2023

Make the changes in Special:Diff/1191745662/1191763956. The changes allow the script to better detect piped links in the |source= parameter of the {{infobox user script}} and {{Infobox Wikipedia user script}} templates. (Previously piped links would trip up the script and cause it to error out per this thread.) Ping @Enterprisey, Novem Linguae, and Andrevan: as script maintainers and editors involved in the thread :) Sohom (talk) 17:46, 25 December 2023 (UTC)[reply]

 Done * Pppery * it has begun... 19:56, 25 December 2023 (UTC)[reply]

Interface-protected edit request on 27 January 2024

Please change

Line 11: Line 11:
// The master import list, keyed by target. (A "target" is a user JS subpage // The primary import list, keyed by target. (A "target" is a user JS subpage

to use more inclusive language. Thanks, --DannyS712 (talk) 06:00, 27 January 2024 (UTC)[reply]

Courtesy ping @Enterprisey --DannyS712 (talk) 06:00, 27 January 2024 (UTC)[reply]
 Done I'm personally not a fan of the entire inclusive language initiative, but since somebody apparently cares there's no reason not to just comply. * Pppery * it has begun... 17:31, 27 January 2024 (UTC)[reply]
Retrieved from "https://mdwiki.org/wiki/User_talk:Enterprisey/script-installer"