994738 - Enable UserVoice JavaScript widget in MDN content

Status: RESOLVED WONTFIX

(developer.mozilla.org Graveyard :: General, enhancement)

Description

[Robert Nyman]

What problems would this solve?
===============================
Embedding 3rd party services that we use in context on MDN, e.g. UserVoice

Who would use this?
===================
Mainly Mozilla people to make sure we connect with developers cross our services and initiatives

What would users see?
=====================
JavaScript widgets on documentation pages, e.g. on the Developer Tools documentation pages

What would users do? What would happen as a result?
===================================================
As an example, for UserVoice and Developer Tools, give feedback and ideas about those.

Is there anything else we should know?
======================================

Comment 1

[Les Orchard [:lorchard]]

Can we make this bug more specific? i.e., exactly what widgets do you want to use, right now? The more generic functionality of widgets in general would probably take prohibitively long.

Comment 2

[Les Orchard [:lorchard]]

(In reply to Les Orchard [:lorchard] from comment #1)
> Can we make this bug more specific? i.e., exactly what widgets do you want
> to use, right now?

And by exactly what widgets, I mean: Exactly what (eg. UserVoice? what else?), configured how, and used where. The more details the better.

We can nail down embedding exactly what's needed right now, sooner than later, and iterate toward something more generic later.

Comment 3

[Robert Nyman]

Understood. At this time, we would like to be able to include widgets from the UserVoice service on the Developer Tools pages on MDN.

I’ve put together two example widget use cases at:

http://robertnyman.com/dev-tools/dev-tools-mdn.html

Comment 4

[Luke Crouch [:groovecoder]]

Per https://groups.google.com/d/msg/mozilla.dev.mdn/4IWjapA7vgE/zI3AbVF8EY8J ...

Filed bug 996251 to get a security & privacy review on the uservoice.com widget. [1]

If approved, we will:

1. Add the small <script> block to our template
2. Add 'data-uv-embed' to ALLOWED_ATTRIBUTES['div'] in our whitelist
3. Allow editors to add the <div> placeholder to wiki pages

[1] https://developer.uservoice.com/docs/widgets/methods/#embed-widget

Comment 5

[David Walsh :davidwalsh]

Yay, that was going to be my suggestion.

Comment 6

[Chris More [:cmore]]

Can http://ffdevtools.uservoice.com redirect to the secure version at https://ffdevtools.uservoice.com? It doesn't now and not sure if we can control that.

Comment 7

[Robert Nyman]

(In reply to Chris More [:cmore] from comment #6)
> Can http://ffdevtools.uservoice.com redirect to the secure version at
> https://ffdevtools.uservoice.com? It doesn't now and not sure if we can
> control that.

Not sure if you were referring to the widget here, but let me address that first:

The script for the widget is relative to the protocol of the page, i.e. http or https: 

uv.src='//widget.uservoice.com/fvaByByXPVQD9BF5i08YwQ.js'

As for the web site itself at http://ffdevtools.uservoice.com/, no it doesn't seem to redirect automatically, but it supports both protocols. So I'd recommend that we refer to the https version in all places where we mention it.

Comment 8

[David Walsh :davidwalsh]

The "fvaByByXPVQD9BF5i08YwQ" will become another `data-` attribute :)

Comment 9

[Chris More [:cmore]]

(In reply to Robert Nyman from comment #7)
> (In reply to Chris More [:cmore] from comment #6)
> > Can http://ffdevtools.uservoice.com redirect to the secure version at
> > https://ffdevtools.uservoice.com? It doesn't now and not sure if we can
> > control that.
> 
> Not sure if you were referring to the widget here, but let me address that
> first:
> 
> The script for the widget is relative to the protocol of the page, i.e. http
> or https: 
> 
> uv.src='//widget.uservoice.com/fvaByByXPVQD9BF5i08YwQ.js'
> 
> As for the web site itself at http://ffdevtools.uservoice.com/, no it
> doesn't seem to redirect automatically, but it supports both protocols. So
> I'd recommend that we refer to the https version in all places where we
> mention it.

Sounds good and I agree with the strategy. Thanks

Comment 10

[Luke Crouch [:groovecoder]]

To implement this per the steps in https://bugzilla.mozilla.org/show_bug.cgi?id=994738#c4, I give this an LOE:2

Comment 11

[Justin Crawford [:hoosteeno] [:jcrawford]]

:groovecoder, do the two blocking bugs added by :curtisk change the LOE on this? Or are fixes for them underway already independent of this bug?

Comment 12

[Luke Crouch [:groovecoder]]

Looks like we need uservoice to use secure, HTTPOnly cookies. We'll have to ask them to do that.

Comment 13

[Justin Crawford [:hoosteeno] [:jcrawford]]

Product council met and agreed: Uservoice integration is an effort we won't undertake now.