diff options
Diffstat (limited to 'includes/OutputPage.php')
| -rw-r--r-- | includes/OutputPage.php | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/includes/OutputPage.php b/includes/OutputPage.php index a3a9592d..68c771bc 100644 --- a/includes/OutputPage.php +++ b/includes/OutputPage.php @@ -2359,8 +2359,7 @@ $templates * @return string html <script> and <style> tags */ protected function makeResourceLoaderLink( Skin $skin, $modules, $only, $useESI = false ) { - global $wgLoadScript, $wgResourceLoaderUseESI, - $wgResourceLoaderInlinePrivateModules; + global $wgLoadScript, $wgResourceLoaderUseESI; // Lazy-load ResourceLoader // TODO: Should this be a static function of ResourceLoader instead? $baseQuery = array( @@ -2444,8 +2443,11 @@ $templates $query['modules'] = ResourceLoader::makePackedModulesString( array_keys( $modules ) ); - // Support inlining of private modules if configured as such - if ( $group === 'private' && $wgResourceLoaderInlinePrivateModules ) { + // Inline private modules. These can't be loaded through load.php for security + // reasons, see bug 34907. Note that these modules should be loaded from + // getHeadScripts() before the first loader call. Otherwise other modules can't + // properly use them as dependencies (bug 30914) + if ( $group === 'private' ) { if ( $only == ResourceLoaderModule::TYPE_STYLES ) { $links .= Html::inlineStyle( $resourceLoader->makeModuleResponse( $context, $modules ) |