Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please remove unintended google search #2588

Open
chang-zhao opened this issue Nov 20, 2018 · 4 comments · May be fixed by #2802

Comments

@chang-zhao
Copy link
Contributor

commented Nov 20, 2018

When /inc/parser/renderer.php meets a link with an "unknown" protocol, such as "file://", clicking that link sends the contents of the link to Google search WHICH WAS OBVIOUSLY NOT INTENDED BY THE USERS and can disclose personal information.

  821      function _resolveInterWiki(&$shortcut, $reference, &$exists = null) {
  822          //get interwiki URL
  823          if(isset($this->interwiki[$shortcut])) {
  824              $url = $this->interwiki[$shortcut];
  825          } else {
  826              // Default to Google I'm feeling lucky
  827              $url      = 'https://www.google.com/search?q={URL}&btnI=lucky';
  828              $shortcut = 'go';
  829          }

Please remove this feature.

@phy25

This comment has been minimized.

Copy link
Collaborator

commented Jan 8, 2019

Good observation. Some clarification:

When /inc/parser/renderer.php meets a link with an "unknown" protocol, such as file://...

The link in this situation (file://...) just doesn't render at all, instead of guiding user to Google. The code mentioned (whose idea exists for 10+ years) handles interwiki syntax like file>....

Demo: https://www.dokuwiki.org/playground:issue2588

I wonder where is better for us to direct users to in this situation? Maybe the first item in interwiki.conf (as the default/fallback)?

@FosseWay

This comment has been minimized.

Copy link

commented May 20, 2019

While I'm not convinced that the fallback Google "I'm Feeling Lucky" behaviour presents much of a risk for most users, I don't see that it adds much value either. Given that, and given that it is possible to imagine a scenario where this might present a risk to a user connecting to the Internet via a proxy controlled by e.g. an authoritarian government, I agree that it should be removed.

As for how to handle undefined interwiki types, my suggestion is to create no link at all, and add a warning message:

2 links on this page refers to an undefined interwiki type:
[[fruit>apple]]
[[fruit>banana]]

where fruit is not defined as an interwiki.

The current Google behaviour could be retained as a config option for anyone who wanted to keep doing that. I'm struggling to imagine when the current behaviour is ever what people want though.

I'm willing to code my proposal, if there is consensus that it's a worthwhile thing to do.

phy25 added a commit that referenced this issue Jun 18, 2019
Remove Google Lucky for non-existing interwiki links
For compatibility renderer will return string '' of $shortcut and $url instead of NULL when seeing a non-existing interwiki link. In the meantime, media and link output in xhtml renderer is adjusted, to show title text instead when src/href is null. In interwiki case, the title will be the "reference" part of the interwiki link.

This makes it possible to also support no URL cases in `interwiki.conf`. Before it will output a URL as `rawurlencode($reference)`, which doesn't make too much sense since it's encoded. However, I am not sure the use case under the current behavior (no URL, but text as `$reference`).

Docs needs to be added to warn renderer plugin developers of this situation.

This fixes #2588.
@phy25 phy25 referenced a pull request that will close this issue Jun 18, 2019
@selfthinker

This comment has been minimized.

Copy link
Collaborator

commented Jul 5, 2019

I'd rather make it configurable, for example via a default keyword in the interwiki config file.

@phy25

This comment has been minimized.

Copy link
Collaborator

commented Sep 16, 2019

Not sure if it's worth adding a new syntax of interwiki link ignoring the wikiname >query (equals to default>query).

phy25 added a commit that referenced this issue Sep 16, 2019
Remove Google Lucky for non-existing interwiki links
For compatibility renderer will return string '' of $shortcut and $url instead of NULL when seeing a non-existing interwiki link. In the meantime, media and link output in xhtml renderer is adjusted, to show title text instead when src/href is null. In interwiki case, the title will be the "reference" part of the interwiki link.

This makes it possible to also support no URL cases in `interwiki.conf`. Before it will output a URL as `rawurlencode($reference)`, which doesn't make too much sense since it's encoded. However, I am not sure the use case under the current behavior (no URL, but text as `$reference`).

Docs needs to be added to warn renderer plugin developers of this situation.

This fixes #2588.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
4 participants
You can’t perform that action at this time.