Page MenuHomeMiraheze

Security Review for Extension:WikiSEO
Closed, ResolvedPublic

Description

What I am trying to do
I add articles to my wiki and then there is a link to the source. I post these wiki articles to FB groups that specialise in the UK alternative media. It is important that when I post it is clear where the source of the information originates. Much of this media is open - non copyrighted - on condition that it is clear where it is sourced. Where it is copyrighted, Copyright law allows the first couple of paragraphs to be added and then clicking on a ...See more opens the article at source. To this end I need to post to fb the Article title, the first few paragraphs (ish) and a source media logo.

Note: My page name does not match the name of the article. This is because I use the createpage extension to create the page and it is far easier to manage if I use sequence numbers. So for example if I have 3 articles from openDemocracy, the pages will be named OD1, OD2 and OD3. This allows me to use other admins to add articles who are lacking in confidence when updating the wiki. Particularly as some article titles are so long they would be truncated.

How I provide the information
When I create a page using extension:createpage I use<onlyinclude> and <includeonly> to create a copy of the main page with only the information I need. I then create the article on the new page and transclude the article to the main page. This way I have a separate page per article so that I can post to FB and a main page that lists all the articles for a given publication so people using the wiki can see a clear list of all articles on one page.

I want to pass the key information into HTML. This is what I do:

Article Title: <seo title="this is a rather tedious title for a dreadfully dull task that some poor Miraheze staff member is having to read"/>
Artcle Text: Picked up from the first section - which is perfect
Article Image: I put the image in the header area and when I save the image is automatically added to HTML as <meta property="og:image" content="https://static.miraheze.org/campaignlabwiki/4/4d/DNS_Image.png"/> - yay!

Problem is gives me no control over the image. I can't format it and generally regardless of what size I make the image, it is not good in the upload to fb.

So I enabled the '''OpenGraphMeta''' extension in the hope of having more influence on what was sent to Facebook.

Problem: It automatically populates the og:title with the page name. Not good as article page titles are sequences ... OD1, OD2 etc

In short:

  • With '''OpenGraphMeta''' I get the image I want, but it messes up my page title I wish to provide to Facebook
  • With '''HTML Meta and Title''' I get the title I want, but the image is messed up as it is not in the seo meta at all and I think just forcing it in by it being in the header area means it does not have any formatting controls.

So....

  1. Is it possible to look at '''OpenGraphMeta''' and see if there is a way I can influence the og:title selection?
  2. Or should I be asking you to install the WikiSEO extension?

Or any solution that it is felt will work is fine for me

Many thanks,

Example page: https://wiki.campaign-labour.org/wiki/The_London_Economic
Sub page: https://wiki.campaign-labour.org/wiki/TLE5

Revisions and Commits

Event Timeline

AmandaCath added a subscriber: AmandaCath.

This doesn’t involve importing anything - rather its a possible bug with an extension.

The extension has been around a long time. My understanding is that when you push a open graph item to HTML for it to accept it, it needs to inclue other meta properties...

og:title
og:image
og:type
og:url

The extension is defaulting everything except for the og:image which the OpenGraphMeta extension allows a function to provide to the HTML. I think it just works that way. I'd like to think not, because it solves one problem and creates new ones.

I don't think that OpenGraphMeta will be fixable. Could be wrong. Maybe WikiSEO is better. It allows all OG properties to be controlled I think. In reality I would like to not have to provide the og:title at all and just provide the image, but I can't see that being viable if I want a formatted image. I think me pushing the image into the HTML by including it in the header area puts it in the wrong place in the HTML code, so it can't be formatted. I'm guessing on that.

@Reception123 is anybody able to take this one up? I'm using a messy workaround at the moment and as each day goes by I add more articles, which means more to fix when I have a solution to the og:image problem.

Can I have Extension:WikiSEO installed? That might work better. I am pretty sure with WikiSeo I can control the open graph inputs better.

AmandaCath claimed this task.

No response since the end of August. Reopen if needed at a later time.

Why have you closed it? I haven't had a response. It should stay open until it is resolved?

@Reception123, @MacFan4000 As this is not moving forward can I turn it into a formal request to have WikiSEO extension added please. I've tagged a couple of people because I'm not sure what status it is at on your outstanding list, so didn't know if my update would get seen. I've tried living with extension:OpenGraph, but it really is not what I need to control my og tags.

AmandaCath changed the task status from Open to Stalled.Sep 18 2018, 21:03

Oh this one :-( I have a facebook audience of 100,000 members and I wanted to start releasing articles. But they don't look professional if I can't control the og tags, so I've held off. First impressions and all that. Wouldn't WikiSEO be the natuaral progression for the Wiki.?The available extension: HTML Meta and Title is the older version? I hate to push this as I know you guys are volunteers and I can see the work you are doing everyday to improve the Wiki. Some great stuff. But I would love to give WikiSEO a shot and see if it solves my issue. I have been teaching myself JS to see if I could write something myself, but to be fair I just don't have the bandwidth to progress that quickly on that approach.

I hope it doesn't cause offence that I'm pushing this one. If you tell me you can't put on WikiSEO for some reason, I live with it. But I'd love to know if it is a viable option.

@Michaeldakin the only reason that the task is stalled is because the WikiSEO extension you have requested requires a security review by either @labster or @Samwilson before it can be installed, and these reviews usually take a long time to even get started.

WikiSEO is not a large extension and thus wouldn't require that much time to review (and this commit gives me hope WikiSEO is already security wise fine), but I think adding support for {{#setmaintitle}} (or similar) in OpenGraphMeta is the better thing to do here, because that means we won't have to support multiple extensions basically doing the same thing.

Hi @Southparkfan - could I go back and test OpenGraphMeta again in that case. I tested it the other day and it didn't appear to actually work correctly. It wouldn't create the image in meta property without actually displaying the image on screen. The idea of writing them as SEO tags is that you can pick an uploaded image without needing to display on the page you are sharing to FB. For example when uploading to FB it might be you want your logo, but you wouldn't want that in the body of your page. I didn't test for long because of time and turned it back off because it was impacting negatively on some articles I was sharing. I can turn it on in the morning and do a few more tests.

@Paladox . I tested. Sorry the results are fairly long winded. {{setmainimage}} does not work according to my tests and {{setmaintitle}} creates issues in that it then forces me to set it on every single page. See test results below for details:

Test 1

Result: Shows file name on page with no link and does not write meta property og:image to html

Comment: Expected result

Test 2

Use full instruction including [[File:…]] with setmainimage parser

Result: Image appears on page and is saved to html meta property

<meta name="ResourceLoaderDynamicStyles" content=""/>
<meta name="generator" content="MediaWiki 1.31.0"/>
<meta name="keywords" content="wikilab,fracking"/>
<meta name="description" content="word5,word6"/>
<meta name="google-site-verification" content="123456789-abfd123456"/>
<meta property="og:image" content="https://static.miraheze.org/campaignlabwiki/2/28/CLW2.png"/>

Comment: Adding open graph images should not display on page. Part of the logic of opengraph is that you can use an image which is different from the ones you display on the page. For example in the test I have used I have selected the wiki logo. I would not want this to appear on most pages, but there are pages where I would want to upload to Facebook and be promoting the theme of the wiki.

Test 3

Put a file at the top of the page and don’t use the {{#setmainimage}} parser.

Used image: [[File: CLW2.png]]

Result; Identical to using the {{#setmainimage}} parser. Any image that is before the first section in a document is picked up.

Comment: Negates the purpose of using {{#setmainimage}} as any image put into the header area is automatically picked up by meta property og:image. Contents of html are…

<meta name="ResourceLoaderDynamicStyles" content=""/>
<meta name="generator" content="MediaWiki 1.31.0"/>
<meta name="keywords" content="wikilab,fracking"/>
<meta name="description" content="word5,word6"/>
<meta name="google-site-verification" content="123456789-abfd123456"/>
<meta property="og:image" content="https://static.miraheze.org/campaignlabwiki/2/28/CLW2.png"/>

Test 4

Result: Displays image on page – does not create meta property in html.

Comment: This means that OpenGraphMeta does not work. The idea being that you can pick an image up from anywhere on the page and create the html meta property. With this way of working you can only ever put the image into the header to write to og:image, which is not what og:image is designed for. Also putting the image in the header writes to og:image in the html without using OpenGraphMeta… so in reality OpenGraphMeta doesn’t actually do anything that isn’t already part of Mediawiki functionality.

Test 5

Use {{#setmainimage}} with new function {{#setmaintitle}}

Result: Writes title to meta property og:title

Comment: As expected.

Test 6

Don’t set {{#setmaintitle}}

Result: <meta property="og:title" content="Work Page"/> (which is the page name).

Comment: Result as expected, but this creates a problem. For every single page in the wiki a og:title would need to be set. The standard way that Mediawiki works without the OpenGraphMeta extension is more intuitive where you only have intervene where you want the html normal title not to be used.

Also the title displays on the page. Again this is not what should happen. The idea of writing <SEO <seo og:title="Who chose this title?"/> would be that I chose the title on a purely random basis and it may not be the title in the page. My preferred choice is to only influence the title on pages that don’t have a sensible page name (sequence numbers). I influence this at the moment by using the normal SEO title option and it works like a dream that way. However I expect I’ll need to include a og:title in future if I want og:image … but not the way OpenGraphMeta works.

Test 7

Use the name of the first section as the title

Result: It works and writes section name to og:title

<meta property="og:title" content="==save for later=="/>

Comment: Not bad, but it doesn’t really add anything. I can do the same by copying the section title to the normal SEO title.

Test 8

Add {{#setmaintitle}} to a section

Result: <meta property="og:title" content="My given name is Dickie, I come from Billericay"/>

Comment: It works ok – but you are unlikely to ever use it in that way. For that purpose you would use the meta description extension.

The HTML looks like this with this workaround:

I set it as the title and it writes it to title and to meta property. Then on a new line I re-write the title with what I actually want and it leaves the meta property og:image and fixes the title to read correctly. It is messy, but it works and I can pick any image (my wiki logo in this example) without it displaying on the page

image.png (267×948 px, 30 KB)

I still thing the OpenGraphMeta extension is not very good for this purpose, even though I got it to work. I would still prefer WikiSEO as this works properly, rather than having to write the title twice and trick the system. Particularly worrying is that it may work now, a later fix may stop it working and SEO is written to most pages of a Wiki. Which is a lot of future risk.

AmandaCath renamed this task from Adding Open Graph data to HTML to Security Review for Extension:WikiSEO.Oct 3 2018, 00:47
AmandaCath moved this task from Deployed Extension Bugs to Backlog on the Extensions board.

As you have determined that the new extension is the best way to go, this task is now a request for that extension to be approved by either @labster or @Samwilson

Sigh. Now I'm trying to build up my twitter presense. And still struggling with the lack of WikiSEO. My cheat to get around open graph extension seems to have stopped working. Which hey ho, it was a troublesome workaround anyway. WikiSEO is the up to date version of what you presently have. You could dump "HTML Meta and Title" extension I suspect and any wikitext written it would still work. So users could switch over. Tell me no, tell me yes... but tell me something

The extension looks good to me. I will ask internally if we can install this.

Was approved by @Southparkfan here https://phabricator.miraheze.org/T3512#69074 (as in no security issues) so I'm going to install it.

Paladox added a commit: Unknown Object (Diffusion Commit).Dec 3 2018, 17:56
idris added a subscriber: idris.

Enabling this extension causes wikis to become inaccessible to normal users.

This is also true for the OP's wiki, wiki.campaign-labour.org.

Yeah, that's right, me too as well.

Thanks everybody. I hadn't had my usual email notifications for this, so didn't realise you'd added it until now. Much appreciated

@Paladox
@SA_13_Bro
@idris