I have a website built with MediaWiki CMS which I host on a CentOS based Apache "shared server environment" (SiteGround).

This website contains a ContactPage contact form in which the subject field is hardcoded to the form wrapper via PHP;
This is odd, because all other fields aren't hardcoded like this and are actually optional and injected into the wrapper from the form's default template which I pasted into the main customization file of the CMS (LocalSettings.php);
By the way, All of these optional fields are HTMLForm template-engine fields.

If someone wants to remove the subject field from backend whatever reason, it would be a logistical pain, because, for example, after every automatic upgrade, it will have to be removed again, probably manually, from ContactPage extension relevant PHP source code (unlike all other fields which are optional from the very stable file LocalSettings.php).

My problem

I want to remove the aforementioned subject field and the only very stable ways I have with the current architecture of MediaWiki, are CSS and JS;
But this is problematic because a user can easily turn off both (most users won't do that, but still).

For now, I have removed the subject field with CSS only but I contemplate to add an "insurance" removal with JS as well to prevent end users that turned off CSS but forgot to turn off JS from whatever reason (say, random cognitive bias) from using that subject field.

My question

Considering IS literature, is it a plausible move to have such "JS insurance" for CSS removals and if not, what will be a better way?


You can't trust the client at all, for anything, ever, and JavaScript also runs on the client. If you want to make sure this field isn't actually used, you need to make the server not read it.

  • Hello ; thanks ; this is a shared Apache server on CentOS (SiteGround) ; I can SSH but a bit limited. Do you think I can still make the server not read it? Thanks anyway (you will really help me with an advice). – JohnDoea Jan 12 at 16:54
  • If you can edit PHP files, then yes. – Joseph Sible-Reinstate Monica Jan 12 at 17:06
  • Oh, you meant PHP, I thought you meant some Apache trick like telling Apache "don't retrieve anything with this HTML attribute or with this CSS class or some other similar nasty trick... PHP is something I almost know nothing about. Thanks, – JohnDoea Jan 12 at 17:20
  • And and Joseph, one more thing --- I invite you to review an associated question I asked in Webmasters SE: webmasters.stackexchange.com/questions/127161/… – JohnDoea Jan 15 at 5:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.