Secure custom css/js

[bootstraponline]

There should be a secure way to inject CSS and JS. Currently editing custom.js is not possible via the web UI because . is translated to dot

[dekimsey]

The question is do you trust those with push access to your wiki repository?

[bootstraponline]

The question is do you trust those with push access to your wiki repository?

I'm thinking of the MediaWiki use case. A public wiki that's editable by anyone on the web, however they don't have push access. I don't think it's worth attempting to try and lock down direct access to the git repo.

[dometto]

I think a neat way to solve this in 5.x is just to add custom.js and custom.css to the SASS (pre)compilation path, thus removing the need to add them to the repository. Makes sense performance-wise, too.

For those who do want to have these files committed to the repo, we can just disallow update and delete requests to their respective paths.

[bartkamphorst]

Sounds good.

[dometto]

Secure customs available in 5.x. See #1324.