Difference between revisions of "T135963: Add support for Content-Security-Policy (CSP) headers in MediaWiki"

Latest revision as of 14:42, 30 June 2021

Phabricator Link	T135963
Status	open
Priority	Medium (orange)
Points
Phabricator Task Created	2016/05/22 09:03 PM
Wiki Page Created	2019/06/09 01:29 PM
Phabricator Task Last Modified	2021/06/30 01:01 PM
Wiki Page Last Updated	2021/06/30 03:42 PM
Phabricator Task Closed
Authored By	Bawolff (Brian Wolff)
Assigned To
Projects	ContentSecurityPolicy (MediaWiki) Epic MediaWiki-General Patch-For-Review Platform Team Legacy (Watching / External) Security-Team (Back Orders) TechCom-RFC (TechCom-RFC-Closed) (Implemented)
Platform Engineering Initiative Column
Platform Team Workboards Column
Subtasks	T209022: current CSP testing policy would block frames (invalid) T208188: RFC: Partial opt-out method for Content security policy (open) T120888: Create optional XSS filter step for the parser (open) T208191: Set hhvm.virtual_host[default][always_decode_post_data] = false (declined) T196923: CSP Report: Triggered by mediawiki.js's domEval() function in Chrome and Safari (but not Firefox) (resolved)
Parent Tasks

Column Transitions: (Added project: ⇑, Removed project: ⇓,Entered column: ⇒, Exited column: ⇐)

Project	Column	Date
TechCom-RFC	⇐ P1: Define	1 June 2016
TechCom-RFC	⇒ Request IRC meeting	1 June 2016
TechCom-RFC	⇐ Request IRC meeting	15 June 2016
TechCom-RFC	⇒ Under discussion	15 June 2016
TechCom-Has-shepherd	⇐ Backlog	13 July 2016
TechCom-Has-shepherd	⇒ Krinkle	13 July 2016
TechCom-Has-shepherd	⇐ Krinkle	13 July 2016
TechCom-Has-shepherd	⇒ Krinkle	13 July 2016
⇑ MediaWiki-Platform-Team		26 March 2018
MediaWiki-Platform-Team	⇐ Inbox	26 March 2018
MediaWiki-Platform-Team	⇒ Watching	26 March 2018
⇑ Epic		11 June 2018
Security-Team	⇐ Incoming	10 July 2018
Security-Team	⇒ Incoming	10 July 2018
⇓ MediaWiki-Platform-Team		11 July 2018
⇑ Core-Platform-Team-Old		11 July 2018
Core-Platform-Team-Old	⇐ Inbox	11 July 2018
Core-Platform-Team-Old	⇒ Watching	11 July 2018
⇑ Patch-For-Review		13 August 2018
Security-Team	⇐ Incoming	4 September 2018
Security-Team	⇒ Epics in progress	4 September 2018
⇓ TechCom-RFC		14 September 2018
TechCom-RFC	⇐ Under discussion	14 September 2018
TechCom-RFC	⇒ TechCom-RFC-Closed	14 September 2018
⇑ TechCom-RFC (TechCom-RFC-Closed)		14 September 2018
TechCom-RFC (TechCom-RFC-Closed)	⇐ Untriaged	14 September 2018
TechCom-RFC (TechCom-RFC-Closed)	⇒ Implemented	14 September 2018
⇓ Core-Platform-Team-Old		1 October 2018
⇑ Platform Team Legacy (Watching / External)		1 October 2018
Security-Team	⇐ Epics in progress	23 September 2019
Security-Team	⇒ Waiting	23 September 2019
⇑ ContentSecurityPolicy		3 November 2019
ContentSecurityPolicy	⇐ Backlog	25 November 2019
ContentSecurityPolicy	⇒ MediaWiki	25 November 2019
TechCom-RFC (TechCom-RFC-Closed)	⇐ Implemented	23 September 2020
TechCom-RFC (TechCom-RFC-Closed)	⇒ Implemented	23 September 2020
Security-Team	⇐ Waiting	17 May 2021
Security-Team	⇒ Back Orders	17 May 2021
⇑ MediaWiki-General		30 June 2021

@@ Line 5: / Line 5: @@
 |points=
 |dateCreated=1463965397
-|dateModified=1600895695
+|dateModified=1625072473
 |author={{Phabricator User
 |type=author
@@ Line 17: / Line 17: @@
 }}{{Phabricator Project
 |name=Epic
+|entryDate=1463965397
+}}{{Phabricator Project
+|name=MediaWiki-General
 |entryDate=1463965397
 }}{{Phabricator Project
@@ Line 23: / Line 26: @@
 }}{{Phabricator Project
 |name=Security-Team
-|column=Waiting
+|column=Back Orders
-|entryDate=1569254857
+|entryDate=1621268229
 }}{{Phabricator Project
 |name=TechCom-RFC (TechCom-RFC-Closed)
@@ Line 36: / Line 39: @@
 |subtasks=209022,208191,208188,196923,120888
 |transitions={{Transition
+|date=1625072473
+|type=Added Project
+|project=MediaWiki-General
+}}{{Transition
+|date=1621268229
+|type=Entered Column
+|project=Security-Team
+|column=Back Orders
+}}{{Transition
+|date=1621268229
+|type=Exited Column
+|project=Security-Team
+|column=Waiting
+}}{{Transition
 |date=1600895695
 |type=Entered Column