[00:00:03] I guess that'd be an API 2 kind of thing, though. [00:00:16] Krinkle: Do you think if I replaced jquery with zepto (for mobilefrontend), resource loader and mw.util would still work? [00:00:26] 03raindrift * 10/trunk/extensions/ArticleCreationWorkflow/ (4 files): Updated extension name, added message docs, added README and INSTALL [00:00:40] johnduhart: Not supported, tested or recommended for now. [00:00:58] I've heard of it but I know there are significant incompatibilities [00:01:06] Joan, Roan was wanting to go JSON only IIRC [00:01:12] Reedy: Right. [00:01:12] But still, this is an intermediatary [00:01:14] Zepto is jQuery-like and easy to port back and forth, but it's definitely not compatible. [00:01:35] hmmm. [00:01:35] Well, perhaps the docs should also be updated to say "use json #butreally". [00:01:39] If you're going to be updating docs. [00:02:07] A lot of the formats seemed to be "because we can" [00:02:12] 03inez * 10/trunk/extensions/VisualEditor/ (8 files in 3 dirs): Get getSelection in contenteditable working [00:02:13] johnduhart: Given the strong caching though, I think the bandwidth should be fine. Just load up normal ResourceLoader flow [00:02:25] johnduhart: or no JS at all [00:02:31] (without exceptions for anything) [00:03:06] I commented. [00:03:09] 03(mod) XSS vulnerability scanner false positives - 10https://bugzilla.wikimedia.org/34257 +comment (10MZMcBride) [00:03:22] 03tstarling * 10/trunk/phase3/includes/Xml.php: Revert r110321: introduces an XSS vulnerability because FormatJson::encode() does not prevent the termination of CDATA sections when JavaScript is embedded in HTML. [00:03:32] I mean really [00:03:51] we're like 2 days before the branch point, Roan marks it OK [00:04:06] and I just happened to look at it because it was related to that McAfee scan result [00:04:12] it could have so easily gone unnoticed [00:04:50] what made you look at File::transform() btw? [00:05:00] TimStarling: Eh ? that looks worrying? Is this about Services_JSON or php's native json_encode ? [00:05:15] both [00:05:24] Krinkle: I already am using RL for MobileFrontend2, just looking for ways to make it smaller (because I know some one is going to whine "it's bigger than before since it uses jquery!!!!1") [00:06:02] the issue is documented in Xml::escapeJsString [00:07:37] TimStarling: So FormatJson::encode should only be used for complete javascript responses (rather than partial output in a