Last modified: 2014-08-28 20:16:22 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T65728, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 63728 - ResourceLoader: User scripts should not execute in global scope
ResourceLoader: User scripts should not execute in global scope
Status: NEW
Product: MediaWiki
Classification: Unclassified
JavaScript (Other open bugs)
1.23.0
All All
: Low enhancement (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks: code_quality
  Show dependency treegraph
 
Reported: 2014-04-09 14:45 UTC by Helder
Modified: 2014-08-28 20:16 UTC (History)
6 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Helder 2014-04-09 14:45:06 UTC
If a user uses something like
> window.windowDotSomething = true;
> justSomething = true;
to declare a few variables they will be global variables, and if the user uses
> var varSomething = true;
in a ResourceLoader-enabled gadget or in their new global.js provided by the GlobalCssJs extension, this will create a local variable (they are inside of a mw.loader.implement wrapper). This is the expected behavior.

However
> var varSomething = true;
results in a *global* variable if inserted in user subpages like [[Special:MyPage/common.js]] or [[MediaWiki:Common.js]]:
> window.varSomething
true

Using "var" should not create a global variable in any case, and users should not rely in the current behavior when writing their scripts, because this usually causes bugs when porting user scripts to gadgets, due to the need to replace lots of "var example"s with explicitly declared globals like "window.example".

TLDR: drop support for executing page.js scripts in the global scope.
Comment 1 Bartosz Dziewoński 2014-04-09 18:56:25 UTC
This will break badly written user scripts and the users will blame us. :)
Doesn't mean that it shouldn't be done, but it probably should be part of
a larger cleanup action. Also related: bug 33836, bug 33837.
Comment 2 Helder 2014-04-09 19:55:42 UTC
Indeed. If this is ever implemented, there should be more than one announcement in as many channels as possible or something like that, and giving users a good amount of time to (at least ask how to) fix any scripts they care about.

And MediaWiki could also get this implemented under a $wgWrapScripts flag which could be set to false on WMF initially but could be true for MediaWiki software (for which there are release notes).
Comment 3 Krinkle 2014-07-07 23:58:33 UTC
Removing blocker of tracking bug 9968 as this has nothing to do with the phasing out of MediaWiki global variables (specifically PHP, but those of JS as well).

This bug doesn't relate to the exposure or support of global interfaces. It just relates to a script executing in the global scope and thus producing local variables as globals.

Re-filing as low priority enhancement because them executing in the global scope right now is that way for legacy reasons and very much intentional, not a bug.

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links