Change this to a widget

We could create a page at Widget:AutoServerStatus and put this inside: <div class="center" style="width: 358px;"><object data="http://shywreaths.org/MabiServerStat/index.php" type="text/html" style="width: 358px; height: 210px; border-width: 0;" standby="Loading Server Statuses"></object></div>

And then on the homepage we would have {{#widget:AutoServerStatus}}. This removes the XSS risk of allowing anyone to use iframes but also makes the code valid XHTML 1.0 Strict because it uses the object tag instead. It also works on all modern browsers, including IE ~小太郎 ^TALK_CONTRIBS 2011:10:11:05:30 (Tuesday)

So precisely, what difference does it make?

Visually, nothing. Apart from that, "This removes the XSS risk of allowing anyone to use iframes but also makes the code valid XHTML 1.0 Strict because it uses the object tag instead." ~小太郎 ^TALK_CONTRIBS 2011:10:11:08:41 (Tuesday)

i don't think it's needed, the reason we use the Widget extension instead of the Iframe extension is because it's made to be secure against that... http://www.mediawikiwidgets.org/Talk:Iframe#Security_risk.3F

What stops other users from making their own iframe widgets? If nothing, then doing this and removing the iframe widget would be safer. Just because the widget isn't as crazy insecure as the other one mentioned doesn't mean it's not a security hole. Though I'm not sure about the whole object tag thing. MediaWiki is HTML, not XHTML so that part is irrelevant.

Users can create widget instances at will, so I deleted the iframe widget and made a server status widget. When the actual iframe contents are hosted on the wiki, I think we should be ok.

OK, thanks. Just a quick question: How does the AutoServerStatus widget work? I had to include the "target" element in my script's links due to the iframe. Is that still needed?

It works the same as before, so yes.

Thats something to be fixed then, 'Target' is not valid HTML strict... Perhaps we use AJAX instead?

Oh, I guess I was wrong. The wiki is supposed to be XHTML strict. I don't see a point in worrying about it because there are a zillion other errors anyway.

Do what we can in the user code to make the wiki as valid as possible. Even if the wiki code itself is not valid, when they finally do become valid, it would be easier for us since our code is already valid ~小太郎 ^TALK_CONTRIBS 2011:10:11:22:39 (Tuesday)

I don't think it is possible to make it valid using iframes.

Hence my suggestion of Ajax.

Using AJAX defeats the purpose of all of your JavaScript fallback code.

Remember, using my method, we wouldn't be using iframes anymore, but objects ~小太郎 ^TALK_CONTRIBS 2011:10:11:23:03 (Tuesday)

That would make the main page validate but not the included page.

The included page is counted as a completely different page, so it isn't really "de-validating" the wiki ~小太郎 ^TALK_CONTRIBS 2011:10:11:23:31 (Tuesday)

IMO, if you're going to worry about validating in the first place, you should be worried about *everything* validating. But my line of caring has crossed, so it's up to you guys.

It looks like object tags don't respect width/height CSS. See the main page.

Fixed it. Uses width/height attributes just like iframes.

You forgot the standby="Loading Server Statuses" attribute! It shows the text when the page is being loaded ~小太郎 ^TALK_CONTRIBS 2011:10:11:23:32 (Tuesday)

Fixed.

You forgot the standby="Loading Server Statuses" attribute! It shows the text when the page is being loaded ~小太郎 ^TALK_CONTRIBS 2011:10:11:23:32 (Tuesday)

Just tell me when I can remove the target attribute xD.

Try removing the target attribute in firebug on the wiki frontpage and then clicking it. If it works and changes the whole page, then you can safely remove it on your site ~小太郎 ^TALK_CONTRIBS 2011:10:11:23:36 (Tuesday)

Does not work.

Google chrome would also work in place of firebug, would it not? That's my tool of choice.

Yes, that is what I used to test.