User CSS URL and wikiconfig option for custom CSS

[UlrichB22]

In the user settings there is an option to specify a “User CSS URL”. This can lead to a CSS injection and should IMO be disallowed.
We can either

• remove this option or
• change it to a local file or path relative to wiki_local. However, this only allows the use of CSS files provided by the webadmin/wikiadmin.

Also, I would like to have a wikiconfig option to specify a custom CSS file or path relative to wiki_local. This makes custom styles easier as it is not necessary to copy and adapt the snippets.html for simple changes like logos, fonts and colors. This file would need to be maintained if there are changes to the snippets.html source.

Please advise.

[UlrichB22]

CSS_URL is also available in moin1.9 and migrated to moin2 by import19.
Is anybody using this feature?

[RogerHaase]

I admit to being a security lightweight.

I thought inline CSS was the problem. But the user setting only allows use of files created by a wiki admin.

There was #508.

I have mixed feeling about adding more options to wikiconfig.py as that increases the size of an already big file and creates 2 ways of doing the same thing. Would the docs say one way is better? Or should we go big and try to eliminate the snippets file and try to move everything to wikiconfig.

[UlrichB22]

But the user setting only allows use of files created by a wiki admin.

It is possible to specify a URL from another web server. For example, you can log in to moinmo.in and add https://wiki.python.org/wiki/europython/css/common.css to “User CSS URL”. The font and the color of the headings for wiki pages are changed with the foreign CSS file. This example is from moin1.9, but the same applies to moin2. An attacker only needs access to any web server to create a malicious CSS file.

[UlrichB22]

Another option would be to add a check for a custom.css file in wiki_local at startup. This avoids adding further options to wikiconfig.py.

[RogerHaase]

change it to a local file or path relative to wiki_local. However, this only allows the use of CSS files provided by the webadmin/wikiadmin.

I think the above is best. The wikiadmin retains full control and can provide custom CSS files for users if need be.

[UlrichB22]

change it to a local file or path relative to wiki_local.

I plan to add a new user option called "CSS_PATH". What should we do with the old values in existing user profiles for "CSS_URL"?
We can either

• keep the old option for a while and show it in usersettings_forms.html but ignore the CSS. This allows the user and admin to show the value and decide on the change.
• remove it from usersettings_forms.html and remove it on the next change of the user profile.
• while running import19 add an info message with username and CSS_URL in the logs and don't migrate the value.

Do you have any ideas?

[UlrichB22]

Above PR adds a feature to allow a default custom CSS by providing a file named custom.css in the wiki_local directory.

In a next step I will check snippets.html and check which macros can be replaced using CSS.

[UlrichB22]

What should we do with the old values in existing user profiles for "CSS_URL"? We can either

• keep the old option for a while and show it in usersettings_forms.html but ignore the CSS. This allows the user and admin to show the value and decide on the change.
• remove it from usersettings_forms.html and remove it on the next change of the user profile.
• while running import19 add an info message with username and CSS_URL in the logs and don't migrate the value.

@RogerHaase, do you have any suggestions regarding this question?

[RogerHaase]

I suggest the 2nd and 3rd options, remove it from usersettings_form.html and add an info message to import19 and do not migrate the value.